A productized EU AI Act readiness review
Get EU AI Act ready before the deadline. It applies 2 August 2026.
The EU AI Act applies on 2 August 2026, and that is weeks away, not years. Our readiness review inventories the AI systems your SME uses or sells, classifies each by the Act risk tiers, flags the obligations that hit you, and hands you a prioritized action plan. Fixed scope, fixed fee, finished fast. This is an operational readiness review, not legal advice.
- Built to SOC 2 controls
- GDPR compliant
- Private AI: data never leaves your servers
the date the EU AI Act applies
a productized review, one fee
prioritized, owned by your team
What the readiness review covers
A fixed-scope review that turns the EU AI Act from a vague worry into a clear, prioritized list of what your business must do, and by when.
AI system inventory
We list every AI system your business uses internally or puts in front of customers, including the tools bought off the shelf and the ones built for you.
Risk-tier classification
Each system is mapped to the Act risk tiers (unacceptable, high, limited, minimal) so you know which carry real obligations and which do not.
Obligation gap analysis
For the systems that matter, we flag the specific duties that apply, from transparency notices to human oversight and record-keeping, and where you fall short today.
Transparency and disclosure check
We check where users must be told they are dealing with AI or AI-generated content, a duty that reaches even low-risk chatbots and generated media.
Prioritized action plan
A plain-language plan ranked by urgency and effort, so your team knows the first three things to fix and what can wait.
Controls built in, not bolted on
Where a fix is technical, we can build the human-in-the-loop oversight, logging, and data controls into the workflow itself, to SOC 2 controls and GDPR.
The four risk tiers, in plain language
The EU AI Act sorts AI systems into four tiers. Most SME tools land in the lower two, but the transparency duties still reach further than teams expect.
| Risk tier | What it means | What it asks of you |
|---|---|---|
| Unacceptable | Practices the Act bans outright, such as social scoring and certain manipulative uses. | Do not deploy. These uses are prohibited, with bans already in force. |
| High risk | AI used in sensitive areas like hiring, credit, or critical infrastructure. | Heavy duties: risk management, data governance, human oversight, logging, documentation. |
| Limited risk | Systems people interact with directly, like chatbots, or that generate content. | Transparency: tell users they are dealing with AI and label AI-generated content. |
| Minimal risk | Most everyday tools, such as spam filters and basic automation. | No specific obligations, though good practice and documentation still help. |
Tiering is the heart of the review. Knowing which tier each system sits in tells you exactly how much you have to do.
What this is, and what it is not
This is an operational and technical readiness review delivered by an automation studio, not legal advice, and Code2b is not a law firm. We make your AI systems visible, classified, and defensible, and we will tell you plainly when something needs a qualified lawyer. For sensitive data, our Private AI option keeps everything on your own servers, delivered with our partner Hako Solutions.
Who needs this before 2 August 2026
If your SME uses or sells AI in the EU, or serves EU customers, the Act likely reaches you. The review tells you how far.
- You use AI tools internally or put AI in front of EU customers, even off-the-shelf ones.
- You build or resell AI features, or rely on chatbots and generated content that need disclosure.
- You want a clear inventory and action plan before the 2 August 2026 application date, not a scramble after.
- You operate entirely outside the EU and serve no EU users or customers.
- You need a binding legal opinion or courtroom defense. That is a law firm, and we will say so.
- You use no AI systems at all, in which case there is nothing here to review yet.
Done-for-you, human-in-the-loop automation that runs in production. Fixed scope, fixed fee. Built to SOC 2 controls, GDPR compliant.
- Built to SOC 2 controls
- GDPR compliant
- Private AI: data never leaves your servers
Governance is how we build by default
We do not bolt compliance on at the end. Human oversight, logging, and data controls are how every Code2b system ships.
the application date we plan backward from
weeks away, not years
built to SOC 2 controls and GDPR compliant
encryption, RBAC, audit logging
self-hosted option so data never leaves your servers
delivered with Hako Solutions
Questions, answered straight.
Know where you stand before 2 August 2026
Book a free automation audit. We will scope your AI system inventory and the readiness review, and show you the fixed fee and timeline to be ready before the EU AI Act applies. You keep the audit either way.
- Built to SOC 2 controls
- GDPR compliant
- Private AI: data never leaves your servers
Free audit · No commitment · The audit is yours to keep
Book a free automation audit