Mental BoundOverview
The EU AI Act is phasing in obligations through 2026 and beyond, and most teams adopting AI have no policy, no risk classification, and no audit trail. That's a gap you don't want to discover during due diligence or an incident. We build the governance layer that lets you move fast without betting the company on it — designed to slot alongside your fluency training and your agentic rollout, not bolt on as paperwork nobody reads.
What the EU AI Act asks of you
In plain terms: know which AI systems you use, classify them by risk, keep humans in the loop where it matters, document your decisions, and be able to show your work. Different uses carry different obligations. We translate the regulation into a practical checklist for your actual systems — not a legal treatise. For the full post-omnibus timeline and an SME-sized action plan, see our EU AI Act compliance guide for SMEs.
What we build
An AI inventory of every system and model in use. Risk classification against the EU AI Act's tiers. Usage policy and acceptable-use guidelines your team will actually follow. Model and vendor risk assessments for what you adopt. Human-oversight and audit trails so decisions are traceable. Staff training on responsible use, paired with the fluency program.
Not legal advice — readiness
We bring the technical and operational side of governance and work alongside your legal counsel, who owns the legal interpretation. This is readiness and engineering, not a compliance certification. We're explicit about that line because pretending otherwise would put you at risk.
How an engagement runs
01 — Inventory & classification (week 1). We interview the people who run the workflows and sweep the tooling: every AI system, model, and vendor in use gets mapped and classified against the EU AI Act's risk tiers, with the December 2027 high-risk horizon flagged wherever hiring, scoring, or evaluation uses show up.
02 — Policy & controls (weeks 2–3). Usage policy and acceptable-use guidelines, human-oversight points, and audit trails — wired into the workflows they govern, not filed next to them. Transparency surfaces get fixed here too: chatbot disclosures and synthetic-content labelling ahead of the August 2026 obligations.
03 — Handover & training (week 4). Staff training on responsible use, an evidence pack your counsel and any due-diligence process can work from, and a review cadence so the policy stays current as tools and rules change.
Fees are fixed and agreed after a short scoping call — online or in person — before any work begins. No open-ended hourly billing.
AI governance for Greek businesses
Greece is finalizing its national AI Act implementation framework: the Hellenic Data Protection Authority (ΑΠΔΠΧ) takes the central market-surveillance role and becomes the single national contact point, EETT acts as notifying authority, and a national AI regulatory sandbox is planned with priority access for startups and SMEs. Enforcement now has a local address — and due diligence a local vocabulary.
We've broken down the national framework — authorities, sandbox, penalties, deadlines — in our guide to Greece's AI Act implementation law. We're based in Athens and run governance engagements in Greek or English. That matters in practice: your AI inventory, policy, and oversight records end up mapping to both the EU regulation and the Greek supervisory reality, in the language your team and your auditors actually use.
FAQs
We're a small team — does the EU AI Act even apply to us?
Obligations scale with how you use AI, not just company size. A short assessment tells you which tiers you fall into, and most teams need far less than they fear — but they do need something.
Do you replace our lawyers?
No. We handle the technical controls, risk classification, policy, and audit mechanisms, and we partner with your counsel on legal interpretation.
Can this run alongside adoption?
Yes — that's the point. Governance works best built in from the start, alongside Cowork & Agentic Adoption and AI Fluency Training, so safe use is the default, not an afterthought.
When do EU AI Act obligations start?
The prohibited-practice rules and the AI-literacy duty have applied since February 2025, and the transparency obligations — chatbot disclosure, labelling synthetic content — start on August 2, 2026. The 2026 Digital Omnibus moved standalone high-risk obligations to December 2, 2027, and product-embedded ones to 2028. The practical move is unchanged: inventory and classify now, so the deadline that applies to you isn't a surprise.
What changed with the 2026 Digital Omnibus?
The EU's simplification package, finalized in June 2026, delayed the high-risk timelines (Annex III to December 2027, product-embedded systems to August 2028) and eased the SME side: simplified technical documentation, fines capped at the lower of the fixed amount or turnover percentage, and priority sandbox access. It did not move the August 2026 transparency obligations — those land first.
Who enforces the EU AI Act in Greece?
Greece's national implementation framework assigns the central market-surveillance role to the Hellenic Data Protection Authority (ΑΠΔΠΧ), which also becomes the single national contact point, with EETT as notifying authority and a national AI regulatory sandbox planned with priority for startups and SMEs. Practically: Greek enforcement questions will generally land at the ΑΠΔΠΧ, and your inventory and audit trail are what you'll be showing.
What's the difference between high-risk and limited-risk AI?
Risk tier follows the use, not the technology. A model drafting marketing copy is usually limited-risk; the same model feeding a hiring or creditworthiness decision can land in high-risk Annex III territory, which carries far heavier obligations. We classify each of your systems so you know which rules apply.
Do you provide documentation for audits?
Yes — an AI inventory, risk classifications, usage policy, and human-oversight and audit trails, built to show your work during due diligence or an incident. Your counsel owns the legal interpretation; we build the technical and operational record.