Background
The client is an AI company whose core product targets the EU, serving both enterprise and individual users. It involves automated decision-making and content generation, facing both the EU AI Act and GDPR, and must provide compliance proof within customer procurement.
Key Challenges
- AI Act risk classification: Determine whether the product is prohibited, high-risk, limited-risk, or minimal-risk—classification drives obligation intensity.
- High-risk obligations: If high-risk, a risk-management system, data governance, human oversight, and technical documentation are required.
- GDPR overlay: Automated decision-making and personal-data processing trigger a DPIA and a lawful-basis argument.
- Procurement proof: EU enterprise customers require an AI Act + GDPR dual compliance statement.
Geason’s Approach
- Classification first: Classified the product’s AI Act risk from function and use, clarifying the quadrant and its obligations.
- High-risk mapping: If high-risk, delivered an obligation list (risk management, data governance, technical docs, registration) mapped to the development process.
- DPIA & lawful basis: Completed the DPIA and argued the lawful basis and redress for automated decisions.
- Dual-compliance pack: Delivered an AI Act + GDPR compliance statement and appendices for customer procurement.
The Non-Obvious Judgment
Most firms place AI Act compliance at “pre-launch patch,” but risk classification should intervene at design: once classified high-risk, retrofitting governance costs far more than embedding it. We treat classification as part of product definition so data governance and human oversight become built-in development items, not external pre-launch fixes—the maturity signal EU customer legal teams weigh most.
Key Outcomes
- The product completed AI Act risk classification, clarifying obligation boundaries and avoiding gaps from over- or under-estimation.
- High-risk obligations (if applicable) were mapped into the development process with deliverable technical documentation and governance records.
- The DPIA and dual-compliance pack were accepted by EU enterprise customers and entered their supplier compliance flow.
Client names and commercial data are anonymized. The rules, regulatory procedures and deliverable types described are as they occurred, not simplified.