EU AI Act for technical teams
Technical consulting for the EU AI Regulation at the level of code, pipelines, logs and infrastructure. That's where compliance is actually demonstrated.
Phased application through 2027. The bulk of technical weight falls on high-risk systems under Annex III — biometrics, HR, credit, education, essential services — with obligations applicable from August 2026.
01 · What it is
What is the EU AI Act.
The Regulation (EU) 2024/1689, known as the EU AI Act, is the first comprehensive law on artificial intelligence in the world. It entered into force on 1 August 2024 and applies in phases through 2027. It is directly applicable in all 27 member states: no national transposition required.
It classifies AI systems into four risk tiers — prohibited, high, limited and minimal — and assigns concrete obligations to each. Most of the technical weight falls on high-risk systems under Annex III: biometrics, HR, credit, education, critical infrastructure, law enforcement and essential services.
It obliges providers (those who develop and place AI on the market), professional users (companies using it in operations), and applies outside the EU too when the output of the system is used inside. The territorial scope is broad.
02 · Dates & who's obliged
Phased application through 2027.
Application is phased. Each layer starts on a different date, and knowing which window each of your systems falls into is the starting point.
In force
Entry into force, 20 days after publication in the Official Journal of the EU. From here, the deadlines of each phase start running.
Prohibited practices
Social scoring, subliminal manipulation, sensitive biometric categorisation, emotion recognition in workplace/education.
GPAI
Obligations for general-purpose AI models: technical documentation, copyright policy, transparency.
High risk
Annex III: biometrics, HR, credit, education, law enforcement, critical infrastructure, essential services.
Remaining obligations
Annex I high-risk systems (products already CE-marked under existing regulations) and residual obligations.
Who's obliged. Providers (those who develop and place AI on the EU market), professional users (companies integrating it into operations), importers and distributors. It also applies outside the EU when the output of the system is used inside.
03 · How we work
Four technical phases on your code.
We work on your code, your pipelines and your logs. Legal interpretation stays with your legal advisors; we handle the technical detail where compliance is actually demonstrated.
What each system is
We inventory your AI systems and classify them: prohibited, high-risk (Annex III), limited or minimal risk. It is the starting point: it determines scope and obligations applicable to each one.
What's missing in the system
Against articles 9-15 and Annex IV: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and cybersecurity. Findings per system, each with its own sheet.
Controls in the code
We instrument automatic logging, integrate data governance into your data pipelines, build the risk management system and the effective human oversight mechanisms. On your stack.
Continuous monitoring
The AI Act mandates post-market monitoring and serious incident reporting. We leave the dashboards, alerts and operational processes so the team maintains it without depending on us.
SIXE is a technical consultant. Legal interpretation of the regulation belongs with your legal department or a specialised firm. We handle the technical side: inventorying, classifying, instrumenting, integrating. We work alongside your legal advisors.
04 · Technical obligations
What the AI Act asks of your engineers.
For high-risk systems (Annex III), articles 9-15 of the regulation are the ones that require code, not documents. Six fronts that an integrator has to leave in place.
Risk management system
Continuous identification and evaluation of foreseeable risks of the system, with mitigation measures and testing before deployment. Iterative, documented, reviewed on every release.
Data governance
Training, validation and test datasets with verifiable quality, representativeness and absence of bias. Documentation of origin, processing and statistical properties. One of the areas that requires the most traceability work.
Technical documentation and logging
Annex IV technical documentation kept current and automatic event logging throughout the operational lifecycle. Full traceability: what input, what output, when, by which model.
User transparency
Clear instructions of use, information on capabilities and limitations, expected accuracy, and runtime disclosures when the user interacts with AI (chatbots, synthetic content, deepfakes).
Effective human oversight
Operational human-in-the-loop: the human operator must be able to interpret the output, override it and stop the system. Requires real UI design and decision flow.
Accuracy, robustness, cybersecurity
Declared and monitored accuracy metrics, tolerance to errors and to AI-specific attacks (adversarial inputs, data poisoning, model evasion). AI systems have their own attack surface, which calls for specific controls.
05 · It doesn't go alone
AI Act and ISO 42001, better together.
The AI Act is law and mandatory; it tells you what you have to comply with. ISO/IEC 42001 is a voluntary certifiable standard that gives you the how: the management system that makes that compliance sustainable and auditable over time.
The risk management system required by article 9 of the AI Act maps directly to clause 6.1 of ISO 42001. Article 12 logging maps to Annex A controls. Post-market monitoring maps to continual improvement in clause 10. Doing them separately doubles the effort. Doing them together halves it.
If you're going to do the AI Act anyway, consider closing ISO 42001 certification in the same project: the controls overlap and you come out with European compliance and the international seal.
06 · Frequently asked questions
EU AI Act, in plain English.
What exactly is the EU AI Act?
When does each part apply?
Who does it apply to?
How do I know if my system is high-risk?
What technical obligations does it actually impose?
AI Act or ISO 42001? Both?
Is SIXE a law firm or a consultant?
AI in production and AI Act unresolved?
Tell us which AI systems you have and what you use them for. We come back with a preliminary Annex III classification and a proposal with the phases broken down: classification, technical gap, implementation and post-market monitoring. Price per phase, no fluff.
Blog!
Our mission
SIXE ensures that your infrastructures based on IBM®, Red Hat®, Canonical®, and SUSE® technologies remain stable, secure, and optimized for as long as you need them.
At SIXE, we are committed to sustainability. That’s why we help you design, implement, and maintain durable and efficient technological solutions.
