EU AI Act readiness assessment
Find out what the Act actually requires of you.
This site tells you what the Regulation says. A readiness assessment tells you what it means for the systems you operate: which ones fall in scope, which tier each sits in, what is missing against the obligations that attach, and the order to fix it in.
It is assessed against the Act as amended by the Digital Omnibus, Regulation (EU) 2026/1744 — the deferred high-risk dates, the two prohibitions that bite on 2 December 2026 and the six inserted articles. Most readiness material still describes the 2024 text.
- A written classification for every system assessed, with the deciding provision cited
- A gap register mapped to the specific articles that create each obligation
- A sequenced remediation plan against the amended application dates
- Evidence you can put in front of a market surveillance authority or a customer's due-diligence team
Request an assessment
Tell us where you are. The Holistic AI team will come back with the version that fits your estate and your deadlines.
We use your details to answer this enquiry. See the privacy policy, or email hello@holisticai.com instead.
What the assessment covers
- Scope
What you actually operate
An inventory of the AI systems and general-purpose models in use, including the ones bought rather than built, and the role you hold for each — provider, deployer, importer or distributor. Most scoping errors start here, because one organisation is routinely several roles at once.
- Classify
Which tier each system falls in
Each system tested against the prohibitions in Article 5, the two high-risk routes in Article 6, the transparency duties in Article 50 and the general-purpose model thresholds in Article 51 — with the provision that decides each answer recorded against it.
- Gap
What the Act requires that you do not yet have
Risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, assessed against Chapter III Section 2 rather than against a generic control framework.
- Sequence
What has to be true, and by when
Obligations ordered against the dates as amended by the Digital Omnibus — including the deferred high-risk deadlines and the two prohibitions that bite on 2 December 2026 — so the plan matches the law in force rather than the 2024 text.
Who runs it
euaiact.com is built and maintained by Holistic AI, an AI governance platform. The legal library on this site is deliberately independent — it reproduces the Regulation verbatim and takes no position on it. The assessment is the commercial service behind it, and it is the same team.
Analyst recognition
- Gartner®Cool VendorNamed a Cool Vendor for AI Security by Gartner®
- Gartner®VendorVendor in the 2024 Gartner® Innovation Guide for Generative AI in Trust, Risk and Security Management
- Gartner®Hype Cycle™Vendor in the Gartner® Hype Cycle™ for Digital Government Services, 2024
- IDCProductScapeIDC ProductScape for Worldwide Generative AI Governance Platforms, 2025
- AvasantLeaderLeader in Avasant's 2025 Responsible AI Platforms RadarView
- Business Intelligence GroupWinnerRecognized among the AI Breakthroughs of 2025
Organisations using the platform
- AON
- Allegis
- eBay
- GE Healthcare
- GSK
- Johnson Controls
- ManpowerGroup
- MAPFRE
- MindBridge
- PMI
- Siemens
- SLB
- Starling Bank
- UKG
- Unilever
- Publicis
SOC 2 Type 2 · ISO/IEC 27001 certified
Before you book
Some of this you can do yourself, for free, today. Screen a single system with the risk classifier, walk the obligations with the compliance checklist, or read what the Digital Omnibus changed. If that answers your question, it has done its job and you do not need us.
An assessment is worth it when the estate is larger than one system, when the provider-versus-deployer line is unclear, or when you need evidence a third party will accept.