AI governance · Current to the Act as amended, June 2026
EU AI Act Readiness Assessment
The Digital Omnibus moved half the deadlines, and everyone heard delayed. The half that did not move lands on 2 August 2026: transparency duties for anyone whose chatbots, synthetic content or deepfakes touch the EU market. In four to six weeks we inventory every AI system you build, buy or embed, classify each against the Act as amended, and hand you a plan showing where each fix sits in your systems, in the order the dates require. From £18,000 + VAT, fixed after a scoping call.
The dates that stand
Definition
What is an EU AI Act readiness assessment?
An EU AI Act readiness assessment inventories every AI system an organisation builds, buys or embeds, classifies each against the risk tiers of the Act as amended by the June 2026 Digital Omnibus, determines your role for each system, because providers, deployers, importers and distributors carry different obligations, and maps each system to the dates that stand. It ends in a plan showing where each fix sits in your architecture, in the order the deadlines require.
Intelance delivers it in four to six weeks from £18,000 + VAT, fixed by how many AI systems you run after a scoping call, with a board readout included. It is run by architects who place controls in real systems rather than in policy binders, and who reuse what GDPR already built rather than rebuilding it.
The Omnibus, adopted in June 2026, moved Annex III high-risk obligations to 2 December 2027 and embedded high-risk systems to 2 August 2028. It did not move Article 50: transparency duties land on 2 August 2026 and AI content marking follows on 2 December 2026. Our guide to the EU AI Act and ISO 42001 shows how they fit together, and the wider practice is described under AI governance consulting.
The real deadlines and what they mean
What moved to 2027 and 2028, and what still lands on 2 August 2026.
Your role for each system
Provider, deployer, importer or distributor: obligations change with the answer.
Controls in architecture
Logging, oversight and documentation placed in real systems, GDPR work reused.
A dated and priced plan
Each fix located in your systems, in the order the dates require.
The questions
Six questions the assessment answers about every AI system you touch
The Act attaches obligations to systems, roles and dates. These six questions cover all three, and each card shows what you hold at the end.
What AI do we run?
Built, bought and embedded in the SaaS you already use: the inventory that includes what nobody registered when it arrived.
You getA register of every AI system you touch, owned and dated.What tier is each system?
Prohibited, high-risk, transparency tier or minimal, against the Act as amended, including the new Article 5 prohibitions.
You getA defensible risk classification per system.What role do we play?
Provider, deployer, importer or distributor, decided per system, because your obligations change with the answer.
You getRole determination that survives a regulator’s first question.Which dates apply to us?
The post-Omnibus map: transparency on 2 August 2026, marking on 2 December 2026, Annex III on 2 December 2027, embedded on 2 August 2028.
You getYour systems against the dates that stand, never the headlines.Where do controls sit?
Logging, human oversight, data governance and technical documentation placed in real systems, reusing what GDPR already built.
You getAn architecture view, so fixes land in systems rather than in binders.What do we do first?
Transparency before marking before Annex III, sequenced against procurement cycles that quietly spend the time you think you have.
You getA priced roadmap in deadline order, ready for the board.How it works
Four to six weeks to a dated and priced position
The assessment runs to a published rhythm and ends in front of your board.
The inventory
Every AI system found: built, bought and embedded, from logs, licences and contracts rather than a survey.
Classification and roles
Each system tiered against the Act as amended, and your role determined per system, because obligations follow the role.
The obligation map
Every system mapped to the obligations and dates that apply to it, with the 2 August 2026 duties flagged first.
Architecture and roadmap
Controls placed in real systems, GDPR work reused, and the fixes priced and sequenced in deadline order, with a board readout.
The standing function
The register handed to whoever keeps it alive: your team, the AI Governance Office or Risk-as-a-Service, only if the roadmap says so.
December 2027 sounds distant and is one procurement cycle away for any system needing architecture change. Waiting spends that cycle, which is why the roadmap is sequenced backwards from each date that stands.
Published fees
The services around the assessment
Each service stands alone with a published fee, and each is taken only if the roadmap says so.
AI Governance QuickScan
The governance-wide sibling: every use case found including shadow AI, controls tested and a board plan, beyond the Act alone.Best whenThe board wants AI governance overall, with the Act as one thread. FeeFrom £15,000 + VAT2 weeks 02
ISO/IEC 42001 Implementation
The AI management system standard, implemented on the same register, for customers and regulators who want certified proof.Best whenThe ask has moved from readiness to certification. FeeAIMS implementationPriced by scope 03
AI Governance Office
The standing function that keeps the register, tiers new systems and owns the compliance clock after the assessment lands.Best whenThe roadmap shows the gap is structural. FeeProgrammes from £30,000 + VAT 04AI Risk-as-a-Service
The register kept alive month by month, with regulatory tracking as the Act and its guidance keep moving.Best whenNobody has diary space to own the clock. FeeFrom £8,000 + VAT / monthThe alternatives
This route against the alternatives
Three responses to the Act since the Omnibus. The difference is what happens on 2 August 2026.
Relax until the Annex III date gets close, because everyone said delayed
The 2 August 2026 transparency duties that never moved
December 2027 is one procurement cycle away for anything needing architecture change
Organisations with genuinely no EU exposure
Principles, policy and training, with nobody looking at the estate
Which systems the obligations attach to
Runs on workshop time while the dates run on legal time
Culture change alongside an assessment, never instead of one
Every system inventoried, classified and mapped to the dates that stand, from £18,000 + VAT
Built to miss nothing: the Act attaches to systems, and the work starts there
Sequenced backwards from each date that stands
Anyone who builds, buys or embeds AI touching the EU market
Scope
What is covered and what is not
You get
The full inventory: every AI system built, bought or embedded, owned and dated.
A defensible classification and role per system, against the Act as amended.
The post-Omnibus obligation map: your systems against the dates that stand.
Controls placed in architecture, reusing what GDPR already built.
A priced roadmap in deadline order, with a board readout included.
This is not
A legal opinion. We map systems, roles, controls and dates. Where formal legal advice is needed, we say so and work beside your counsel.
A policy programme. The Act attaches obligations to systems, and an assessment that never opens the estate cannot find them.
A panic purchase. If your exposure is genuinely minimal, the report says so and the spend stops.
Frozen in time. The report is current to the Act as amended in June 2026, and re-tiering after future changes is what the standing function is for.
Where to start
Typical starting positions
Four situations we are usually called into. If none of them fit, book the call and we will sort your urgent from your important.
Why Intelance
The standards we hold ourselves to
Current to the Act as amended
The June 2026 Omnibus changed half the map. The assessment runs against what stands, and we say plainly which half moved and which did not.
Controls placed in architecture
Run by architects who put logging, oversight and documentation into real systems, and reuse what GDPR already built rather than rebuilding it.
Fixed after a scoping call
From £18,000 + VAT by how many AI systems you run, agreed in writing before day one.
The dates drive the sequence
The roadmap is ordered by deadline, because December 2027 is one procurement cycle away for anything needing architecture change.
Honest about exposure
If the Act barely touches you, the report says so. An assessment that can only ever find urgent work is a sales document.
Who delivers this
Every assessment is led by a senior architect and AI governance lead, end to end. Nothing is offshored and nothing is templated.
AI governance guides
All insights
AI GovernanceEU AI Act ISO 42001: how they fit together in your architecture
The EU AI Act sets the legal obligations. ISO 42001 builds the machinery that meets them. How to wire both into your architecture, with the June 2026 omnibus deadlines.
7 December 2025 · 10 min read Read the guide
AI GovernanceWhat is AI governance? The seven questions boards should ask
9 July 2026 · 9 min read
AI GovernanceEnterprise AI governance in 2026: a practical blueprint for CIOs and boards
9 July 2026 · 8 min read
AI GovernanceAI governance vs AI assurance: what is the difference?
9 July 2026 · 6 min readReady to talk?
Tell us what AI you build, buy or embed
Thirty minutes to sort your urgent from your important: what you run, where it touches the EU market and which of the dates that stand apply to you. If chatbots or synthetic content face customers, say so first. That clock reads 2 August 2026.
FAQs
The questions everyone is asking since the Omnibus
Did the EU AI Act get delayed?
Partially. The Digital Omnibus, adopted in June 2026, moved high-risk obligations for stand-alone Annex III systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. It did not move the rest: prohibitions and AI literacy have applied since February 2025, general-purpose AI obligations since August 2025, Article 50 transparency duties land on 2 August 2026, and AI content marking follows on 2 December 2026.
What still applies on 2 August 2026?
Article 50 transparency: people must be told when they interact with an AI system, synthetic content must be identifiable, and deepfakes must be disclosed. If you run chatbots that talk to customers, generate content or publish AI media into the EU market, this date is yours regardless of what moved.
What is an EU AI Act readiness assessment?
A structured review that inventories every AI system you build, buy or embed, classifies each against the risk tiers of the Act as amended, determines your role per system, maps each to the obligations and dates that apply, and produces a priced plan showing where each fix sits in your architecture, in deadline order.
How much does an EU AI Act readiness assessment cost?
From £18,000 + VAT with Intelance, fixed by how many AI systems you run after a scoping call, over four to six weeks with a board readout included.
Does the EU AI Act apply to UK companies?
Frequently, yes. The Act applies where AI systems are placed on the EU market or their outputs are used in the EU, so UK organisations serving EU customers are commonly in scope regardless of where they are based. The assessment maps which of your systems that touches.
What is a high-risk AI system?
Broadly, systems in the Act’s Annex III categories, including recruitment and worker management, credit and insurance decisions, biometric identification, critical infrastructure, education and access to essential services, plus AI embedded in regulated products under Annex I. Since the Omnibus, stand-alone Annex III obligations apply from 2 December 2027 and embedded systems from 2 August 2028.
What roles does the Act define, and why do they matter?
Provider, deployer, importer and distributor, and the obligations differ sharply between them. Most organisations are deployers for most systems and providers for a few, sometimes accidentally, by fine-tuning or white-labelling. The assessment determines your role per system, because getting it wrong means preparing for the wrong duties.
What changed in the Act besides the dates?
The Omnibus made targeted amendments rather than a rewrite, including a new Article 5 prohibition covering AI-generated non-consensual intimate imagery and child sexual abuse material. Prohibited practices carry the highest penalties, up to €35 million or 7% of global turnover, and they have applied since February 2025.
What happens after the assessment?
The roadmap is executed in deadline order: your team, any supplier, or ours. The register needs an owner as the Act and its guidance keep moving, and that is the AI Governance Office or AI Risk-as-a-Service, taken only if the roadmap says so.