Skip to content
Talk to the team

AI compliance.

We bring your AI systems into line with the AI Act, GDPR, DORA and NIS2.

Talk to the teamBook a 30-minute assessment

The AI Act, milestone by milestone.

It has applied in stages since 2024; the July 2026 Digital Omnibus postponed the high-risk obligations without removing them.

The four risk levels of the AI ActFour-level pyramid. Unacceptable risk: prohibited practices (Article 5) since 2 February 2025. High risk: Annex III (credit, employment, education, infrastructure) from 2 December 2027, Annex I on 2 August 2028. Limited risk: transparency obligations (Article 50) since 2 August 2026. Minimal risk: no specific requirement beyond AI literacy (Article 4).UnacceptableProhibited (Art. 5)since 2 Feb 2025High riskAnnex III: credit, employment,education, infrastructure2 Dec 2027; Annex I: 2 Aug 2028Limited riskTransparency required (Art. 50)since 2 Aug 2026Minimal riskNo specific requirementAI literacy (Art. 4), as everywhereThe four risk levels of the AI ActFour-level pyramid. Unacceptable risk: prohibited practices (Article 5) since 2 February 2025. High risk: Annex III (credit, employment, education, infrastructure) from 2 December 2027, Annex I on 2 August 2028. Limited risk: transparency obligations (Article 50) since 2 August 2026. Minimal risk: no specific requirement beyond AI literacy (Article 4).Unacceptableprohibited (Art. 5)since Feb 2025High riskAnnex III, e.g. creditfrom Dec 2027Limited risktransparency (Art. 50)since Aug 2026Minimal riskno specific dutybeyond Art. 4
  • In force
  • Upcoming
  • Postponed by the Digital Omnibus

  1. In force

    Regulation (EU) 2024/1689 enters into force, after publication in the Official Journal on 12 July.

  2. In force

    Prohibited practices (Art. 5) and AI literacy of staff (Art. 4).

  3. In force

    General-purpose AI models, governance and penalties.

  4. In force

    General application, including the Article 50 transparency obligations.

  5. Upcoming

    Two new prohibitions. Marking of generated content required for systems already on the market.

  6. Upcoming, postponed from 2 Aug 2026

    Annex III high-risk systems: credit, employment, education, infrastructure.

  7. Upcoming, postponed from 2 Aug 2027

    High-risk systems embedded in regulated products (Annex I).

Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026). Timeline up to date as of 1 October 2026. Read the AI Act on EUR-Lex

From audit to compliance.

Three levels, matched to your size, sector and risk level.

EUR 8,000 to 60,000, on quote

Compliance

Set up the full framework.

  • Audit of AI systems, as provider and deployer
  • Formal AI Act risk classification
  • Annex IV technical documentation
  • Tailored DPA and DPIA (GDPR, Art. 28 and 35)
  • Fundamental rights impact assessment (Art. 27)
  • DORA framework for financial entities
  • NIS2 assessment and remediation plan
  • Human oversight measures (Art. 14)
  • AI literacy programme for your teams
  • Liaison with the CSSF or CNPD if needed
Request a quote
30 minutes, free

Assessment

Understand your exposure.

Inventory of your systems, risk level, applicable rules, critical gaps. Report and recommendations within 48 hours.

Book the assessment
From EUR 1,200 per month

Monitoring

Stay compliant, month after month.

Regulatory watch, documentation kept current, quarterly or half-yearly audits, incident response plan, quarterly report to management.

Talk to the team
Fit 4 AI

50%

of the AI diagnostic, AI Act and GDPR section included, covered by Fit 4 AI for a Luxembourg SME.

Check my eligibility

Five steps, from assessment to monitoring.

Critical gaps first, structural work next.

  1. 30 minutes

    Assessment

    A no-commitment call on your systems and your exposure. Summary report within 48 hours.

  2. 3 to 6 weeks

    Audit and gap analysis

    A map of your AI systems, with gaps measured against the AI Act, GDPR, DORA and NIS2.

  3. 2 to 4 months

    Remediation plan

    A roadmap ranked by criticality, with milestones, owners, budgets and realistic deadlines.

  4. 2 to 4 months

    Implementation

    Documentation drafted, processes in place, teams trained.

  5. Every month

    Continuous monitoring

    Regulatory watch, updates, periodic audits, incident plans. Compliance stays demonstrable.

Standard programme: 2 to 4 months; 4 to 8 months for a CSSF entity subject to DORA and NIS2. The schedule is agreed together at quote stage.

12

The file your regulator will ask for.

Twelve standard documents, written for your systems by a team that reads the text and opens the code.

AI Act

  • Art. 4AI literacyTraining for operational and executive teams.
  • Art. 5Acceptable use policyProhibited practices, ruled out in writing.
  • Art. 9Risk managementFormal analysis required for high-risk systems.
  • Art. 11Technical documentationSystem file in line with Annex IV, kept current.
  • Art. 13Instructions for useWhat the deployer needs to know to use the system.
  • Art. 14Human oversightThe oversight measures required by the Act, described.
  • Art. 27Fundamental rights impactThe assessment required of certain deployers.
  • Art. 50Transparency noticeInformation for people who interact with the AI.
  • Art. 73Serious incident responseNotification within 15 days at most, 10 or 2 days depending on severity.

GDPR

  • Art. 28Processing agreementGDPR-compliant DPA.
  • Art. 30Sub-processor registerThe processing chain, end to end.

DORA

  • ICTICT frameworkThe ICT risk management framework of financial entities.
Cover of the AI Compliance brochurePage 3 of the brochure: audit, document, complyPage 4 of the brochure: three typical engagements

Our method in six pages: regulations, approach, three typical engagements.

Read the AI Compliance brochure
Max's audit log in the Easycore cockpit: intact chain, 49,572 events checked with no alteration, and a histogram of events over the last seven days

What we ask of your systems, we apply to our own. Every action of our agents is timestamped, sealed and chained to the previous one.

Discover Easycore

Frequently asked questions.

Another question? Book 30 minutes

Does the 2 August 2026 deadline still stand?

For high-risk systems, no. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved it to 2 December 2027 for Annex III and to 2 August 2028 for Annex I. The prohibitions, AI literacy, the rules on general-purpose models and the Article 50 transparency obligations already apply.

How much does it cost?

The 30-minute assessment is free, with no commitment and no sales deck: you leave with a summary and our recommendations, whether you go ahead or not. A full compliance programme costs EUR 8,000 to 60,000 depending on the number of systems and their criticality. Monthly monitoring starts at EUR 1,200 per month.

Are you approved by Luxinnovation?

Yes. Easylab AI is a Luxinnovation-approved provider for the Fit 4 AI programme. The AI diagnostic, GDPR and AI Act compliance analysis included, is then 50% covered for an SME and 30% for a large company.

Which regulations and sectors do you cover?

The AI Act (Regulation (EU) 2024/1689), GDPR (Regulation (EU) 2016/679), DORA (Regulation (EU) 2022/2554) for the financial sector, NIS2 (Directive (EU) 2022/2555), and the CSSF and CNPD expectations in Luxembourg. Sectors: regulated finance (banks, insurers, AIFMs, funds, supervised by the CSSF or CAA), healthcare (medical devices, e-health), human resources (recruitment, evaluation), B2B SaaS and software vendors. We stay away from sectors where we lack the expertise.

Do you guarantee compliance?

No one can: it is an obligation of means. We guarantee the quality of the documentation, its consistency with the texts in force and its ability to withstand an audit, with a method aligned with ISO 42001 and NIST AI RMF. When a new rule appears (delegated act, CSSF guideline, CJEU ruling), monthly monitoring folds it into your framework and updates the documentation.

Can you work with our lawyer?

Yes, it is common. We bring the technical expertise and a detailed reading of the AI Act; your lawyer keeps the contractual and litigation view.

The documents, before the meeting.

Our compliance method, our governance and our subprocessors, to read before we talk.

Talk to the teamBook 30 minutes