An overview of your AI systems, a prepared risk classification and clear agreements on responsibilities.
Trusted by leading organisations
The AI Act, also known as the AI Regulation, sets requirements for organisations that develop or use AI. Which requirements apply to you depends on your role and the risk level of each application. Data Science Lab helps you inventory your AI systems, prepare their risk classification and establish governance; legal interpretation remains with your legal counsel or compliance department.
Ask a mid-sized organisation which AI systems it uses, and each department will give you a different answer. IT points to the data team’s predictive model, communications uses Microsoft Copilot to write, and HR is testing a tool that screens job applications. HR bought it independently, without ever involving IT. There is no complete overview, so nobody knows which rules apply.
That HR tool deserves particular attention. Systems that analyse and filter job applications are listed in Annex III and are generally considered high-risk. If you deploy a general-purpose AI system for that purpose yourself, Article 25 may even classify you as a provider, subject to the most demanding obligations.
Outdated timelines are also still circulating. An overview from 2024 or 2025 may still give 2 August 2026 as the deadline for high-risk systems under Annex III and 2 August 2027 for AI in products. Since the Digital Omnibus on AI, those deadlines have moved back for most systems, while other obligations are already in force.
Since 2 February 2025, practices including social scoring, harmful manipulation and emotion recognition in workplaces and educational settings have been prohibited, with a few exceptions. From 2 December 2026, AI that creates intimate images of real people without their consent will also be prohibited.
Annex III covers areas including recruitment and selection, education, creditworthiness, access to benefits and critical infrastructure. From 2 December 2027, requirements for risk management, data, logging, documentation and human oversight will apply to these systems; for AI in products covered by Annex I, they will apply from 2 August 2028.
Since 2 August 2026, chatbots have had to make clear that people are interacting with AI. Providers of generative AI must mark output in a machine-readable format, by 2 December 2026 at the latest for existing systems. If you create deepfakes using AI, you must disclose that the content is artificial.
Most applications, such as spam filters, fall into this group: the regulation sets no specific requirements for them. But the people working with any AI system you provide or use must have AI literacy.
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses the system under its own responsibility. If you build a system and use it yourself, you are both.
Since 2 August 2025, providers of models such as the language models behind ChatGPT have had to meet requirements covering documentation and copyright, among other things. If you integrate such a model into your own application, the model provider must give you information about its capabilities and limitations.
We help you get an initial overview and identify the questions your lawyer needs to answer.
Working with IT, procurement and other departments, we map out AI applications built in-house, purchased or used separately, including AI features in software you already have.
For each application, we record whether you are the provider, the deployer or both, and where a new intended purpose changes your role.
We gather the facts for each system: its purpose, the people involved, the data used and the potentially relevant area under Annex III. Your legal counsel or compliance department makes the decision.
We assign ownership and human oversight, and link the overview to procurement, the record of processing activities and the DPIA, so new applications do not go unnoticed.
People working with AI gain knowledge suited to their role and the risks involved. Read how we approach this in AI literacy training.
The overview and classification stay up to date as new systems are introduced, purposes change and the European Commission or the regulator issues new guidance.
You need someone responsible for keeping an overview, often from compliance, privacy or information management, and access to contracts, the register of processing activities and existing DPIAs. This work connects with AI governance and data governance: the same questions about ownership and quality, now for each AI system. For municipalities, the Responsible AI workshop for municipalities is a good first step because it focuses on frameworks and agreements.
Monitoring and management after go-live are not new territory for us. At LUMC, we work on AI applications that continue to perform well after go-live, are managed securely and can be improved. You need that same discipline to keep track of what a system does and who oversees it.
We do not provide legal advice. We gather the facts, prepare the classification and put governance in place; your legal counsel or compliance department decides whether a system falls under an exception and exactly which obligations apply. Our approach to Responsible AI also covers decisions that go beyond legal requirements.
Any organisation can start an AI pilot. The challenge is what comes next: making AI part of the organisation. That’s where Data Science Lab makes a difference.
Read more about us
10+
8.7
200+
The AI Act, officially Regulation (EU) 2024/1689 or the AI Regulation, is the European law governing the development and use of AI systems. The greater the risk, the stricter the rules: they range from prohibited practices and requirements for high-risk systems to transparency obligations and applications with no specific requirements. The regulation applies directly in all member states.
The AI Act entered into force on 1 August 2024, and its rules apply in stages. The rules on prohibited practices and AI literacy have applied since 2 February 2025, those for general-purpose AI models since 2 August 2025, and transparency obligations and supervision since 2 August 2026. The rules for high-risk systems under Annex III apply from 2 December 2027; those for AI in products under Annex I apply from 2 August 2028.
Partly. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted and has applied since 27 July 2026. It postponed the high-risk rules and added prohibitions that apply from 2 December 2026. Prohibited practices and the rules for general-purpose models were not postponed; only existing generative systems have until 2 December 2026 to label their output. The separate omnibus proposal that would, among other things, amend the GDPR had not yet been adopted as of October 2026.
That has not yet been settled. The draft AI Act Implementation Act, put out for consultation in April 2026, provides for ten market surveillance authorities. The Autoriteit Persoonsgegevens would oversee prohibited AI, transparency and a large share of high-risk applications, and coordinate with the RDI. In October 2026, the AP stated that it was the proposed supervisory authority but had not yet been appointed.
The GDPR still applies; the AI Act expressly leaves privacy law unaffected. If you use a high-risk system and need a DPIA, you use information from the provider to carry it out. From December 2027, public authorities, public service providers and users of systems for assessing creditworthiness or determining risk and premiums for life and health insurance must also carry out a fundamental rights impact assessment, which may refer to the DPIA. A DPIA from your supplier does not replace your own, the AP stressed to municipalities.
Without an overview, you cannot know which obligations apply. In its guidance on AI literacy, the AP identifies an inventory of all AI systems as a first step, using the GDPR register of processing activities as a starting point. The regulation also provides for an EU database: providers register high-risk systems under Annex III, and public authorities register their use of them. A provider that considers a system under Annex III not to be high-risk must document that assessment and register the system too.
If you only use AI features in standard software and no applications under Annex III, an extensive process is usually excessive. A brief overview, agreements on use and attention to AI literacy are a reasonable starting point. If your question is purely about legal matters such as liability or contracts, a lawyer is better placed to help.
E-mail info@datasciencelab.nl
Phone +31 (0)20 3636 724
We start with an overview of your AI systems and the questions your legal adviser needs to answer. That way, you know where you stand and what needs attention first.
Message sent
Thanks for your message. We’ll be in touch as soon as possible.
