8 Companies That Can Help Implement the EU AI Act

This comparison covers eight firms that help implement the EU AI Act:

1. PrivaLex
2. Atoro
3. PwC
4. KPMG
5. EY
6. Deloitte
7. Capgemini Invent
8. ECIJA

Implementing the EU AI Act means turning legal requirements into decisions that product, engineering, procurement, security and management teams can apply.

That work usually starts with a few practical questions. Which AI systems does the organisation develop or use? What do they do? Who could be affected? Which suppliers are involved? And who has the authority to approve, restrict or stop their use?

Companies that help implement the EU AI Act approach these questions from different directions. Some concentrate on legal interpretation and contracts. Others focus on technical controls, management systems or governance across large organisations.

The right choice depends on the work your organisation needs to complete, the systems involved and the resources available to maintain the programme afterwards.

8 Companies That Can Help Implement the EU AI Act

1. PrivaLex

PrivaLex helps organisations connect AI governance with the privacy, security and compliance processes they already operate. This is particularly relevant when a company needs to manage the AI Act alongside GDPR, ISO 27001, ISO 42001, NIS2, DORA or customer assurance requirements.

The starting point is understanding what the organisation develops, buys and uses. AI may appear in a customer-facing product, an employee assistant, a recruitment platform, a fraud detection service or an external API. Each use needs enough context to support a reasoned decision about responsibilities and requirements.

PrivaLex can help build that picture and translate it into a practical AI regulatory compliance programme. The work can include:

• Creating an inventory of AI systems, models, agents and suppliers.
• Recording intended purposes, data flows and affected individuals.
• Assessing provider, deployer and other relevant roles.
• Documenting risk classifications and unresolved questions.
• Establishing approval and escalation procedures.
• Reviewing supplier contracts and evidence.
• Defining human oversight, transparency and change controls.
• Connecting obligations with owners and supporting records.
• Preparing information for management, customers and auditors.

For example, a SaaS company introducing an AI feature may need product to document its purpose, engineering to explain its limitations, privacy to assess the data involved and procurement to review the model provider. PrivaLex can help establish the process that brings those decisions together before release.

The approach can also support organisations building an ISO 42001 AI management system. Policies, objectives, assessments, reviews and corrective actions can then operate within a consistent management structure.

PrivaLex’s role is to help design and implement the programme. Where an independent conformity assessment or certification is required, that evaluation must be arranged through the appropriate process and provider.

2. Atoro

Atoro approaches AI governance through security, compliance and management system implementation. Its offering centres on helping companies establish an AI management system, connect it with development practices and prepare for ISO 42001 certification.

That makes the engineering side of the engagement important. A policy on human oversight needs to become a usable review process. A requirement to track model changes needs to appear in version records, release approvals and monitoring.

Atoro describes support covering:

• AI inventories and initial scoping.
• AI Act obligation mapping.
• Risk and impact assessments.
• Responsible AI policies.
• Data governance and human oversight.
• Model development and deployment processes.
• Evidence collection and certification preparation.
• Ongoing reviews and incident handling.

ISO/IEC 42001 provides a management framework for governing AI. Companies considering this route should also confirm how the engagement will address the specific legal obligations associated with their systems.

During discussions, ask how the team will work with your existing development environment. Will it use current tickets and repositories? How will model, dataset and supplier changes trigger reassessment? Who will approve the resulting decisions?

These questions help establish whether the project will produce processes that engineers can maintain as the product changes.

3. PwC

PwC’s AI Act services combine legal, risk, governance and technical model assessment capabilities. This breadth can be useful when implementation spans several business units, countries or regulated activities.

A large organisation may already have privacy, procurement, internal audit and model risk functions. The challenge is often agreeing how AI enters those processes and who makes decisions when responsibilities overlap.

PwC’s described work includes:

• Compliance strategy and readiness assessments.
• AI governance frameworks.
• Policies and procedures.
• Alignment with other regulatory requirements.
• Algorithm and model validation.
• Data quality and performance assessment.
• Explainability, monitoring and risk mitigation.

Technical assessment is a relevant part of this proposition. A governance policy may require suitable performance or robustness, but the organisation also needs tests, criteria and records that support that conclusion.

Before appointing a multidisciplinary firm, define the workstreams you need. Legal classification, model testing, governance design and implementation may involve different specialists.

Ask which people will deliver each part, how findings will become corrective actions and what the internal team must contribute. A clear scope makes it easier to manage budget and avoid receiving recommendations without the support needed to apply them.

4. KPMG

KPMG’s Trusted AI services connect AI governance with enterprise risk, controls, readiness and implementation. Its approach can be relevant where the organisation wants AI to operate within an established risk and assurance structure.

The practical challenge may be adapting existing controls. A business already reviewing third parties, software releases and operational incidents needs to decide how those processes should handle AI-specific issues.

These can include:

• Changes in model behaviour.
• New training or evaluation data.
• Different affected populations.
• Supplier model updates.
• Limits on explainability.
• Increased autonomy.
• Performance deterioration.

KPMG’s described services include AI readiness, governance, inventories, risk transformation and control tooling.

When reviewing a proposal, ask how the project will connect the AI inventory to existing GRC records, risk owners and internal reporting. Also check how teams will record exceptions and escalate decisions that require additional legal or technical review.

The engagement should clarify the relationship between advisory work and any later independent assurance. The required separation depends on the service, applicable rules and assessment arrangements.

5. EY

EY’s Responsible AI services include a readiness assessment followed by a maturity report and implementation roadmap.

This approach can be useful when management knows AI adoption is growing but lacks a reliable view of the current governance position. Departments may have different policies, suppliers may have added AI features and approval decisions may exist only in emails.

EY’s assessment covers areas such as:

• AI strategy.
• Policies and procedures.
• Governance and accountability.
• Training and awareness.
• Ethical AI foundations.
• Third-party risk.

A baseline can help the organisation decide which gaps need immediate action and which can be addressed through a longer programme.

The main question is what follows the assessment. Ask whether the engagement includes implementation workshops, control design, supplier remediation, evidence requirements and support for internal owners.

For each finding, the roadmap should explain what needs to change, who owns the action, what resources are required and how completion will be verified. That detail makes the assessment useful when management needs to approve funding or assign responsibilities.

6. Deloitte

Deloitte combines regulatory, legal, risk, data and technology capabilities in its responsible AI services.

Its approach can support organisations implementing governance across several layers: board oversight, product approval, data management, model testing, cybersecurity, monitoring and internal assurance.

The work may involve:

• AI governance frameworks.
• Policies, procedures and control standards.
• Regulatory readiness.
• Risk assessments.
• Technical and algorithm assessments.
• Stakeholder responsibilities.
• Reporting and assurance arrangements.

This breadth can matter when AI forms part of a larger transformation. A business deploying AI across operations, customer services and products may need different controls for each environment while maintaining consistent oversight.

When comparing proposals, distinguish assessment, governance design, technical implementation and independent assurance. Confirm which activities are included and which require a separate team or engagement.

It is also worth asking how the programme will reach everyday work. Procurement should know when to escalate a vendor. Product should know what evidence is needed before launch. Operations should know when a performance issue requires intervention.

7. Capgemini Invent

Capgemini Invent combines consulting with a technology-oriented AI governance and compliance approach. Its public offering includes AI mapping, risk assessment, documentation, remediation planning and audit support, supported by tools and platform capabilities.

This can be useful where AI is distributed across a complicated technology environment. The organisation may need to identify systems, connect records and implement controls within existing data and application platforms.

Areas to explore include:

• Discovery and mapping of AI systems.
• Governance frameworks.
• Risk assessment.
• Technical implementation.
• Documentation workflows.
• Remediation tracking.
• Integration with existing platforms.

The key is connecting legal decisions with system configuration. If a use case requires restricted access, approval before a change or documented human review, the engagement should explain how those requirements will operate.

Ask how legal interpretation will be provided or coordinated, which tools the project depends on and whether the organisation can export its records. Also confirm who will maintain integrations and workflows after the implementation team leaves.

These details determine whether the technology remains useful as systems and suppliers change.

8. ECIJA

ECIJA approaches AI implementation through technology law, regulatory interpretation, contracts and governance.

Its legal focus can be relevant when the difficult questions concern responsibility, intended purpose, employment, privacy, intellectual property or the allocation of obligations between suppliers and customers.

For example, a company using an AI recruitment service may need to examine how the system influences decisions, what information is provided to candidates, which data is processed and what the contract requires from the supplier.

Questions to explore with a legal implementation partner include:

• Which role does the organisation perform?
• Does the intended use fall within a regulated category?
• What documentation must suppliers provide?
• How should contracts allocate responsibilities?
• What limits apply to employee or customer data?
• Which changes require renewed legal review?
• Who approves uncertain cases?

The scope should also explain how legal conclusions reach operational teams. A contractual requirement to monitor performance needs an owner, an appropriate test or reporting process and a record of the review.

Where technical testing or platform configuration is necessary, confirm how that work will be delivered alongside the legal advice.

Comparison of EU AI Act Implementation Companies

Service availability and delivery teams vary by country and engagement. Compare the proposed scope, assigned people and implementation responsibilities before choosing.

PrivaLex and the Decisions Behind an AI Compliance Programme

An AI governance project becomes easier to operate when each decision has an owner and a clear place in the business process.

PrivaLex helps organisations establish that structure. The work can begin with discovery workshops across product, IT, procurement, HR and other departments to identify AI that may be missing from an existing register.

Each system then needs an intended purpose, a business owner, a technical contact, relevant supplier information and a documented route for classification and review. Uncertain cases should include the missing facts, the person responsible for resolving them and a target date.

Privacy requires particular attention. The EDPB’s opinion on AI models addresses issues including anonymity, legitimate interests and the implications of unlawfully processed training data. These questions need to be considered alongside the system’s purpose and deployment context.

PrivaLex can also connect the programme with AI Act and ISO 42001 requirements. This can bring together governance, risks, impact assessments, monitoring and management review while preserving the legal analysis required for each relevant system.

The implementation should leave the organisation with usable records and routines:

• A maintained inventory.
• Documented classifications and decisions.
• Assigned control owners.
• Approval and escalation procedures.
• Supplier review requirements.
• An evidence repository.
• Training for relevant teams.
• A schedule for monitoring and reassessment.

The scope can be adjusted as the organisation grows, introduces new systems or receives more demanding customer requirements.

What Should an EU AI Act Implementation Project Deliver?

An AI inventory that reflects actual use

The inventory should include internally developed systems and AI purchased through software, APIs and managed services.

Each record should identify the purpose, users, affected people, data, supplier, owners, deployment context and lifecycle stage. It should also link to assessments and supporting documentation.

Supplier-enabled AI deserves attention because functionality can change without a new procurement project. The privacy risks SaaS companies often overlook can also appear when providers change data use, subprocessors or product features.

Documented roles and classifications

For each relevant system, the organisation needs a reasoned conclusion about its role and applicable obligations.

A classification should include the facts supporting it, assumptions, limitations, reviewer and conditions that trigger reassessment.

An internal business risk score serves a different purpose from legal classification. A 5×5 risk assessment matrix can help prioritise scenarios, but the AI Act classification must be assessed against the relevant legal criteria.

A map of obligations, controls and evidence

The project should connect each applicable requirement with:

• A control or process.
• A responsible owner.
• A point or frequency of operation.
• Supporting evidence.
• An escalation route.

The NIST AI Risk Management Framework can support the wider process of governing and assessing AI risks. Its voluntary framework complements the organisation’s legal analysis.

For example, a control for reviewing model changes should identify which changes trigger review, who assesses them and how the decision is recorded.

Evidence standards the team can follow

Decide early what each control needs to demonstrate.

Useful records may include approved purposes, assessment results, test reports, review decisions, supplier responses, incident records and corrective actions.

The discipline used in documenting ISO 27001 controls also applies here: connect the requirement with what the team does and the records it retains.

Evidence should identify the relevant system, version, date, reviewer and result where these details are necessary to understand the decision.

Connected privacy processes

Where personal data is involved, the project should address GDPR responsibilities alongside AI governance.

This may include lawful bases, transparency, processing records, DPIAs where required, retention, processor relationships and international transfers.

The organisation’s GDPR operational readiness affects how reliably those decisions are maintained. An AI inventory should connect with existing privacy records when they concern the same activity.

Lifecycle and change procedures

Governance should cover purchase, development, testing, approval, deployment, monitoring and retirement.

Review triggers may include a new purpose, model, dataset, supplier, affected population, level of autonomy or significant performance issue.

The procedure should explain who can restrict or suspend use while a concern is assessed and how the final decision is communicated.

Training and a usable handover

Teams need guidance on the tasks they perform.

Procurement needs supplier assessment criteria. Product needs launch requirements. Operations needs monitoring and escalation instructions. Management needs information for approving priorities and resources.

The involvement of legal teams and DPOs in AI governance should be defined so they receive the information needed for decisions at the right stage.

A documented corporate training plan can organise these responsibilities by role and record whether the relevant teams have completed the training.

How to Compare Implementation Proposals

Ask who will perform the work

Review the proposed team’s experience with your systems, sector and regulatory questions.

Establish who will attend workshops, review classifications, assess technical evidence and remain available during implementation.

Define deliverables and acceptance criteria

Terms such as “governance framework” or “readiness review” need detail.

The proposal should explain the records, procedures and tools delivered, who approves them and how their usefulness will be checked.

For example, an inventory deliverable should specify required fields, included departments, validation and the process for future updates.

Confirm what the internal team must contribute

Implementation requires access to business and technical knowledge.

Clarify the expected time from product, engineering, procurement, privacy and management. Identify which decisions need internal approval and how delays will be handled.

Check whether technical testing is included

Some engagements provide policy and assessment support. Others include technical evaluation.

If testing is needed, establish the systems covered, methods, criteria, records and responsibility for resolving findings.

Establish the handover and maintenance plan

Ask what happens after delivery.

The organisation should know who maintains the inventory, schedules reviews, approves changes, follows up actions and produces management reports.

Any ongoing support should have a defined scope and response process.

Do You Need Consulting, Software or Both?

Consulting helps establish the scope, requirements, classifications and operating procedures. Software can help manage those procedures as the portfolio grows.

If the organisation lacks a reliable inventory or clear owners, first establish what the programme must manage. That foundation determines the information, workflows and evidence an EU AI Act compliance platform needs to support.

Once processes are defined, software may reduce recurring administration through task assignment, review reminders, evidence collection and reporting.

When comparing AI Act compliance software, test it against actual cases. Check how it handles supplier updates, uncertain classifications, overdue actions and changes to an approved system.

Consulting and software can work together: the implementation team defines the process, the platform supports its operation and internal owners retain responsibility for decisions.

EU AI Act Dates to Use in Your Implementation Plan

The AI Act applies in stages, and the timetable changed in 2026. The European Commission’s current application timeline distinguishes several milestones:

• 2 February 2025: Prohibited AI practices began applying.
• 2 August 2025: Governance rules and obligations for general-purpose AI models began applying, subject to relevant transitional provisions.
• 2 August 2026: Most provisions became applicable, including transparency requirements, with specific exceptions and transitions.
• 2 December 2027: The main requirements for Annex III high-risk systems apply.
• 2 August 2028: The corresponding requirements for high-risk AI embedded in regulated products under Annex I apply.

Build the roadmap around the obligations relevant to each system. GDPR, employment, consumer protection, cybersecurity and contractual requirements may already apply.

Allow time for supplier responses, technical changes, testing and any required assessment. These activities depend on first identifying the systems and their intended uses.

A Practical First 90 Days

Days 1–30: Establish the baseline

Identify systems across departments, assign initial owners and record purposes, suppliers and data.

Review existing policies, contracts and evidence. An AI Act readiness assessment can help organise the initial questions and priorities.

Days 31–60: Design and apply the priority controls

Complete the first classifications, resolve urgent uncertainties and define approval, supplier review, evidence and escalation processes.

Pilot them using several different cases, such as an employee assistant, a customer-facing feature and a system processing personal data.

Days 61–90: Test operation and prepare the handover

Check whether owners can follow the procedures and whether the records support their decisions.

Test a change review and an incident scenario. Where a personal data breach could occur, connect the AI process with the organisation’s GDPR breach response procedure.

Use the results to adjust the process, assign remaining actions and establish the ongoing review schedule. More complex systems may require additional implementation and assessment work beyond this initial period.

Conclusion

Choosing a company to help implement the EU AI Act starts with understanding the work your organisation needs to complete.

PrivaLex brings together governance, privacy, security and implementation. Atoro centres its approach on AI management systems. PwC, KPMG, EY and Deloitte offer multidisciplinary capabilities, while Capgemini Invent connects governance with technology and ECIJA contributes legal expertise.

Compare the proposed people, scope and deliverables. A useful engagement should leave the organisation with documented decisions, operating controls, evidence, trained owners and a process for reviewing changes.

That foundation allows the programme to develop as AI use, suppliers and business requirements evolve.

Frequently Asked Questions (FAQs)