Service · Wolff Applied AI
A focused risk classification of your AI applications with a prioritised action list — time-critical under the EU AI Act.
A focused, time-critical check of your AI applications actually in use and planned. Within 1–2 weeks we classify every application into the EU AI Act risk categories and check which transparency obligations under Article 50 (deadline 02.08.2026) apply. You receive a prioritised action list — what needs to be done by when and by whom — together with pointers to the GDPR touchpoints.
The EU AI Act has been in force since August 2024 and applies in stages: the prohibitions and the AI competence obligation have already applied since February 2025, and the transparency obligations under Article 50 are scheduled for 02.08.2026 — the pressure to act is concrete and dated. Many companies already use AI operationally (chatbots, generative AI, Microsoft 365 Copilot) but have no overview of which application falls into which risk category and which obligations follow from it. A large governance initiative would be oversized for a quick deadline check; what is needed first is a focused classification of the applications actually in use. Without a structured risk classification it remains unclear what is a priority — effort is spread over secondary matters while deadline-relevant obligations remain undiscovered.
5 phases, 4 gates — you decide at every transition.
We clarify scope, contacts and existing documentation and check the current legal status with a reference date (reservation "Digital Omnibus"). For more than around eight applications or a suspected high-risk case, we align the scope in advance.
In a structured interview (remote, approx. 90–120 min) we capture, for each application, purpose, provider/model, data types, user groups, external effect and context of use — including actively asked-about "shadow AI". This produces a structured inventory list.
We classify each application into the four EU AI Act categories (prohibited practices, high risk, limited risk with transparency obligation, minimal risk), check the transparency obligations under Article 50 and identify the relevant GDPR touchpoints.
We derive a prioritised, dated action list (what, by when, by whom) and condense the results into a short report (4–6 pages) with transparency and GDPR pointers.
In a compact discussion (remote, approx. 60 min) we go through the inventory list, the classification and the top actions, name grey areas and recommend the next step.
Structured overview of the AI applications in use and planned, with purpose, provider/model, data types, user groups and context of use.
Classification of every application into the four EU AI Act risk categories, with justification, a transparency obligation note (Article 50) and an uncertainty flag.
Assignment of which applications are affected by the transparency obligations with the 02.08.2026 deadline.
Overview of the relevant data protection touchpoints (legal basis, transparency, data subject rights, data processing agreements).
Concrete actions with priority, target date and responsibility — immediately usable up to the relevant deadlines.
Condensed presentation of results with a legal-status reference date and a clear note: structured professional orientation, not legal advice.
The base package stands on its own. Optional modules dock on now or later — you decide how far you go.
The quick check is designed for a standard scope of around eight AI applications; this module extends the inventory list and risk classification by every further application. You only pay for the applications actually additionally reviewed — the methodological framework stays the same.
In addition to the short report, we prepare a compact briefing for your employees — on transparency obligations, labelling and reporting channels. The module makes the results accessible within the team but does not replace a complete training or governance package.
If deadlines or obligations of the EU AI Act change — for example through ongoing EU legislation — we review the affected points again and update the classification. The module builds on the existing inventory list and only assesses what has newly changed.
Credit: If you directly commission the AI Governance Starter Package, we credit the quick check proportionally.
Note: not legal advice. Content with a legal dimension (e.g. EU AI Act, GDPR, ISO/IEC 42001) is professional orientation, not legal counsel.
You receive a clear, individual proposal before any engagement. Under § 19 UStG no VAT is charged; any ancillary costs (e.g. model/hosting/API fees, travel) are not included.
Next step
Let us clarify in a free intro call whether this offer fits your situation — honestly and without sales pressure.As a follow-up we then recommend AI Governance Starter.
Non-binding · online or on site · reply < 24 h
