The EU AI Act is the world’s first comprehensive law governing artificial intelligence, and it applies far beyond Europe: if your AI system is used in the EU, you are likely in scope — whether you build it, integrate it, or deploy it. VoltLegal helps technology companies understand where they sit under the AI Act and build the governance to match, without grinding product development to a halt.
The Act takes a risk-based approach. The obligations on you depend entirely on what your system does and how it’s used — and getting that classification right is the difference between a light-touch compliance exercise and a substantial one.
Risk classification — where do you sit?
The AI Act sorts systems into tiers, and the first job is always to work out which one applies to you:
- Prohibited practices — a narrow set of uses that are banned outright.
- High-risk systems — AI used in sensitive contexts, carrying the heaviest obligations around risk management, data governance, documentation, human oversight, and conformity assessment.
- Limited-risk systems — mainly transparency duties, such as telling people they are interacting with AI or that content is AI-generated.
- Minimal-risk systems — the majority of AI uses, with few specific obligations.
- General-purpose AI (GPAI) — foundation and general-purpose models carry their own layer of obligations, with additional requirements for the most capable models.
Misclassifying a system in either direction is costly: assume high-risk when you aren’t and you burn resources you didn’t need to; assume you’re out of scope when you aren’t and you carry real exposure. We give you a defensible classification you can build on.
What we do
- Scoping and classification — mapping your systems and use cases against the Act and documenting why each one falls where it does.
- Provider and deployer obligations — clarifying which role you play (often you are both) and what each requires of you.
- Conformity and documentation — technical documentation, risk-management processes, logging, and the records you need to demonstrate compliance.
- GPAI obligations — transparency, copyright, and documentation duties for general-purpose model providers and those integrating them.
- Contracts up and down the chain — allocating AI Act responsibilities between you, your model providers, and your customers.
- AI governance frameworks — internal policies, roles, and review processes that keep you compliant as you ship new features.
Providers and deployers
The Act draws a key distinction between those who develop AI systems (providers) and those who put them into use (deployers) — and the obligations differ. Many companies are surprised to learn they count as a provider, for example by substantially modifying a third-party system or putting their own name on it. We help you understand which hat you’re wearing for each system, because that determines what you actually have to do.
Building a governance framework that scales
One-off compliance doesn’t survive contact with a fast-moving product team. We help you put lightweight governance in place — a clear inventory of AI systems, an owner for AI risk, a short review step before high-impact features ship, and documentation that’s generated as you go rather than reconstructed under pressure. The goal is a process your engineers can live with.
Where the AI Act meets data protection
AI systems run on data, which means the AI Act rarely travels alone. Training data, automated decision-making, and transparency obligations all intersect with the GDPR, and the two regimes have to be handled together. We advise on both, so your AI governance and your data-privacy programme are built as one, not bolted together afterwards.
Common questions
Does the AI Act apply to companies outside the EU?
Often, yes. If your AI system’s output is used in the EU, you can be in scope regardless of where your company is based. We help non-EU companies work out their exposure and what to do about it.
We just use a third-party model — are we really affected?
Possibly. Deployers of AI systems have their own obligations, and integrating, fine-tuning, or rebranding a model can make you a provider with heavier duties. The starting point is always classification.
When do we need to act?
The AI Act’s obligations are phasing in, and different requirements apply at different times. The practical answer is that classification and governance are worth doing early — they shape product decisions you’re making now.
Not sure where your AI sits under the Act? Book a free consultation or get in touch for a straight answer on your classification and next steps.
Related services: GDPR & Data Privacy · Commercial & Corporate Counsel · MiCA Licensing & CASP