EU AI Act compliance software for providers and deployers of AI

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority in its work. The role is set per system, so one company is often both. Under Article 25, a deployer that puts its name on a high-risk system, changes it substantially or changes its intended purpose becomes its provider.

The prohibited practices and AI literacy have applied since 2 February 2025, the rules for general-purpose AI models since 2 August 2025, and the rest of the Act, with the Article 50 transparency duties, since 2 August 2026. A further prohibition, on AI-generated non-consensual intimate content and child sexual abuse material, applies from December 2026. The high-risk duties apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in Annex I products. These two dates come from Regulation (EU) 2026/1744, which is adopted law in force since 27 July 2026, not a proposal.

Under Article 27, some deployers of high-risk systems assess the impact on fundamental rights before first use: bodies governed by public law, private entities providing public services, and deployers of systems for credit scoring or for risk assessment and pricing in life and health insurance. In Acuna GRC the impact assessment can hold a fundamental-rights section. The fundamental rights impact assessment, explained

Every provider and deployer takes measures to support the AI literacy of its staff and of others who use AI systems on its behalf, whatever the risk class. Since Regulation (EU) 2026/1744 it does not have to guarantee a set level for each person. An AI use policy that staff read and acknowledge is one such measure, and the Staff Portal keeps the record. The AI literacy obligation, explained

Providers make sure people know when they interact with an AI system and mark AI-generated content in a machine-readable way. Deployers disclose deepfakes and tell people exposed to emotion recognition or biometric categorisation. It has applied since 2 August 2026.

They apply to the providers of the models, since 2 August 2025: technical documentation, information for the companies that build on the model, a copyright policy and a summary of the training content. If you build on or use such a model, you are the provider or deployer of your own AI system, and its record in Acuna GRC names the provider behind it.

Up to EUR 35 million or 7% of worldwide annual turnover for the prohibited practices, up to EUR 15 million or 3% for most other duties, and up to EUR 7.5 million or 1% for giving authorities incorrect information. The higher amount applies, except for SMEs, where it is the lower one.

No. ISO 42001 is a voluntary standard for an AI management system, and the AI Act is law. The certificate gives no presumption of conformity, but the management system does much of the groundwork. In Acuna GRC you adopt both, and one measure counts for each requirement it meets. ISO 42001 software for your AIMS

Both apply when an AI system processes personal data. The GDPR covers the data, and the AI Act covers the system and how it is used. A fundamental rights impact assessment complements the DPIA, and in Acuna GRC the AI system links to its processing activities. GDPR compliance software

Yes, if you place an AI system on the EU market or put it into service there, or if the output of your system is used in the EU. No EU entity is needed for that. Providers of high-risk systems established outside the EU also appoint an authorised representative in the EU (Article 22).

No tool can do that for you. Acuna GRC keeps the register and the records the AI Act asks for, and our experts can assess where you stand. It does not certify conformity with any law or standard.

In Switzerland or the EU, as you choose, or in your private cloud or on your own premises.