EU AI Act Compliance Audit

Know exactly where your AI systems stand against the EU AI Act's high-risk AI obligations

A structured inventory, risk assessment, and governance gap analysis aligned with EU AI Act requirements.

Free Download

EU AI Act High-Risk Deployer Checklist

If your organisation is deploying or planning to deploy AI, this checklist maps the governance controls that responsible deployment requires. Each item is linked to the relevant EU AI Act Article so you can see exactly what the regulation expects and what your governance needs to include.

The Problem

Why this matters

The EU AI Act is in phased enforcement. Following the political agreement of 7 May 2026, Annex III high-risk AI system obligations now apply from 2 December 2027. Most regulated SMEs in Ireland do not yet know which of their AI tools trigger those obligations, what documentation is required, or what governance architecture needs to be in place.

Shadow AI makes this harder. Staff adopt AI tools informally, outside procurement and IT. The systems management knows about are rarely all the systems actually in use. An inventory built on what management thinks is in use will miss the tools that carry the most compliance risk.

Non-compliance carries fines of up to €35 million or 7% of global annual turnover. This engagement produces a complete, evidenced picture of your AI systems and a governance architecture designed to close the gaps before the deadline.

What Is Included

A structured five-phase engagement covering inventory, classification, gap analysis, governance design, and handover:

  • AI system inventory across all departments, including shadow AI discovery
  • Risk tier classification for every system against EU AI Act criteria, with Article-referenced rationale
  • Compliance gap analysis mapped against your deployer obligations for each high-risk system
  • Governance architecture blueprint: controls, named owners, procedures, and monitoring plan
  • Prioritised implementation roadmap with timelines and dependencies
  • Executive briefing and final report package suitable for board and regulatory review

The audit produces a complete, evidenced picture of where your organisation stands and what needs to change. If you want to move to implementation, that can be scoped as a next step. If you need the audit output first to make that decision internally, that is a complete engagement on its own.

Deliverables

What you receive

  • AI System Register: every system identified, with use case, risk classification, named owner, and governance status
  • AI Risk Classification Register: tier assignment for every system with full regulatory rationale
  • Compliance Gap Matrix: each high-risk system mapped against each applicable obligation, with severity and complexity ratings
  • Governance Architecture Blueprint: controls, policies, procedures, monitoring plan, and improvement process
  • Prioritised implementation roadmap with named owners and milestone dates
  • Board-readable executive summary (two pages)
  • Final compliance architecture report: all of the above in a single dated, version-controlled document

Enterprise Ireland

If your organisation is Enterprise Ireland-supported, you may be able to recover up to 80% of project costs via the Digital Discovery Grant. Book a discovery call and we will confirm your eligibility as part of the conversation.

Insights

Related insights

AI Gone Rogue, or AI Governance Gone Missing? | AI Agent Governance for SMEs

AI Gone Rogue, or AI Governance Gone Missing? | AI Agent Governance for SMEs

Most AI incidents are not evidence of rogue machine behaviour. They are governance failures: capability connected to live systems without adequate permissions, approval gates, or oversight. Here is what Irish SME owners and directors need to understand before connecting AI to their business systems.

by Eileen Weadick, PhD10 min read

Founder, Clear Gate Systems

Does Your Financial Services Firm Have an AI Register? Here Is What the Law Requires.

Does Your Financial Services Firm Have an AI Register? Here Is What the Law Requires.

Irish financial services firms using AI for credit scoring, insurance pricing, or fraud detection have compliance obligations under the EU AI Act's Annex III high-risk framework. The deadline moved to 2nd December 2027 on 7 May 2026. This article explains what the law requires, what the Central Bank will look for, and how to build an AI register.

by Eileen Weadick, PhD12 min read

Founder, Clear Gate Systems

Scope and boundaries

What we are

We have received comprehensive training and are knowledgeable across the full scope of EU AI Act obligations: risk classification, provider and deployer requirements, governance architecture, post-market monitoring, and fundamental rights assessments. Clear Gate Systems applies this knowledge to design and implement technical governance architecture for clients.

What we are not

Clear Gate Systems does not provide legal advice, legal interpretation of specific obligations, or regulatory representation. Where your organisation requires a formal legal opinion, on the classification of a specific system, on contractual obligations with an AI vendor, or on regulatory exposure, a qualified solicitor or barrister must be engaged. Our role is to build the technical governance infrastructure that qualified legal counsel can stand behind.

Want to discuss your requirements?

Book a discovery call to discuss your requirements. We will recommend an approach based on what you are actually trying to solve.