EU AI Act readiness assessment
Inventory, classify, and test your AI systems' controls (logging, human oversight, and robustness). Hacken helps you prove you use AI responsibly, securely, and in line with EU regulations.
AI system inventory, role, and risk-tier classification in ~1 to 2 weeks- Controls reviewed and tested against Articles 8 to 15
- An "AI Trust Profile" evidence pack in just 3 weeks
- 26,095
- vulnerabilities identified
- 60+
- security engineers in-house
- 2,080
- security assessments delivered
- $180B+
- in client value secured
Certified: ISO 27001:2022. Selected for the European Blockchain Sandbox (2025)
Are you in scope?
The EU AI Act applies to you if you develop, deploy, import, distribute, or place AI systems and general-purpose AI models onto the EU market directly or indirectly, regardless of your headquarters.
Should you comply with the EU AI Act? Answer the questionnaire and find out:
What's your relationship to AI?
What is EU AI Act readiness?
An EU AI Act readiness assessment inventories your AI systems, classifies your role and each system's risk tier, tests the controls the Regulation requires, and produces evidence you can hand to a buyer or an auditor. The AI Act (Regulation 2024/1689) entered into force on 1 August 2024 and phases in through 2026 to 2028.
EU AI Act timeline: Some requirements are already in force
EU AI Act (Regulation 2024/1689) enters into force
Prohibited practices and AI literacy obligations apply
GPAI obligations apply (Articles 51-55)
Commission publishes the Digital Omnibus on AI
Council gives final approval to the Omnibus
Final act signed
Publication in the Official Journal; entry into force 3 days after
Article 50 transparency obligations apply (unchanged by the Omnibus)
Watermarking/labelling deadline for legacy systems; new Article 5 prohibition on nudifiers and CSAM-generating systems takes effect
Member states' deadline to establish national regulatory sandboxes (deferred from 2 Aug 2026)
High-risk Annex III obligations apply (standalone systems), deferred from 2 Aug 2026
High-risk Annex I obligations apply (embedded systems), deferred from 2 Aug 2027
EU AI Act vs ISO 42001
The EU AI Act is a law, and you can't certify against it; instead, you have to be ready to present controls to the regulator when they ask for evidence. Therefore we prepare a conformity assessment for your high-risk systems.
ISO 42001 is the only certifiable standard, but it covers AI governance, not legal compliance, so one doesn't prove the other.
EU AI Act
Legally binding regulation- Applies only within the EU market
- Risk-tiered: prohibited, high-risk, limited, minimal
- Enforced with fines up to €35M or 7% of turnover
- Conformity assessed by notified bodies or self-assessment
- Covers product/system risk to safety and rights
ISO 42001
Visit ISO 42001 →- Voluntary international standard
- Applies globally at any jurisdiction
- Certifiable through accredited audit
- No legal penalty for skipping it
- Applies regardless of AI risk level
- Covers organizational AI governance processes
Get AI Act Ready with Hacken
We document and test controls
An offensive security team produces the technical proof behind Art. 12 & 15: adversarial testing, logging, and robustness.
Legal advisory in-house
Qualified counsel interpret applicability and enforcement alongside the technical work, evidence, and interpretation from one team.
AI-governance credentialed
Certified for AI risk governance under ISO/IEC 42001 and NIST standards
Regulatory track record
Hacken also offers DORA, MiCA, and VARA readiness; contributor to EU standards bodies (EBSI, ADGM, BMA).
Certified & insured
ISO 27001-certified ISMS; professional-liability and cyber insurance; independence statement on request.
Reusable, buyer-accepted output
After engagement, you keep the evidence pack, plus an answer library that cuts the cost of the next questionnaire.
From AI inventory to an evidence pack
Five phases, scoped to how far you need to go
Scope and kickoff
We determine which requirements of the EU AI Act apply to your entity/service.
You get: an agreed scope of required evidence.
Inventory and classify
We build the AI inventory, map your role (provider, deployer, importer, distributor), and classify each system's risk tier.
You get: an AI system inventory and a role and risk matrix.
Control and evidence
We test logging, human oversight, and robustness, run a light AI-security check, and gather vendor and model evidence.
You get: a controls and evidence map against Articles 8 to 15.
Gap and roadmap
We write the gap report, the AI risk register, and a prioritized 30/60/90 plan.
You get: an AI risk register and remediation roadmap.
Evidence pack
We assemble the "AI Trust Profile" a buyer's risk team accepts.
You get: the AI Trust Profile and a completed buyer questionnaire.
Ongoing Support for AI Governance
After the assessment, obligations keep moving as you ship new models. Many teams keep us on through a virtual CISO or AI governance retainer.
FAQ
Ready to prove conformity with the EU AI Act?
Get first, deal-ready deliverable in ~3 weeks
