AI readiness and compliance
AI readiness: the legal footing before you scale.
The assessment records your administration's AI applications, maps them to the duties under the EU AI Act and the GDPR and provides the basis for leadership and council deliberations.
Arrange a first meetingThe AI readiness assessment records every AI application in a local administration, maps each one per unit to its duties under the EU AI Act and the GDPR and delivers a prioritized action plan. The result is documented proof of which applications run permissibly and where action is needed, prepared for adoption into a decision paper.
Inventory, not fault-finding
The assessment records which tools are in use today and where AI already runs in daily work, including where it emerged without a formal introduction. Usage that has grown over time becomes an orderly, documented inventory; running applications do not have to be stopped for the assessment.
The legal framework per application
The EU AI Act applies in stages: the AI literacy duty has been in force since February 2025, further obligations follow through 2027. Every application is assigned to a risk class; the resulting duties under the EU AI Act and the GDPR are named. NIS2 is included only where your organization actually falls under it.
Readiness per unit
HR works with employee data, citizen services with registration and social data, finance reports across the whole organization. The assessment evaluates per unit which applications are permissible and under which conditions. Every unit starts with clear guardrails instead of blanket bans.
Paid, and credited later
The assessment is a paid service with a defined result, not a sales event. If you commission further modules from us afterwards, the assessment fee is credited. You decide on every follow-up step individually; the assessment commits you to nothing further.
Ready for your decision-making bodies
The report is drafted so that its findings can be adopted into a paper for the management board or the council. Whether council involvement is required depends on the value thresholds of your main statute; the lead time from submission deadlines and notice periods is factored into the action plan.
Mandatory annexes prepared
The assessment provides the groundwork for the annexes that accompany an AI decision paper in practice: the data protection impact assessment under Art. 35 GDPR where required, input for the IT security concept and a stand-alone value-for-money analysis.
A basis for funding applications
The documented inventory and the action plan are the basis on which funding applications build. Capital, time-limited introduction and pilot projects are eligible depending on the program; the recurring operating costs of regular operation usually are not. Eligibility must always be checked per program; a blanket promise would be unserious.
Citizen and social data stay protected
Not every application needs the same operating model. The assessment evaluates per application which data flows: public cloud for uncritical work, EU cloud or operation in your own data center where citizen or social data is involved. Governance and approvals are aligned with ISO 42001.
Follow-on: strategy and use-case portfolio
Two separate modules build on the assessment, each commissioned individually: the AI strategy with an update logic (which use cases in which order, what each stage requires) and the use-case portfolio with a value-for-money analysis per case as a decision basis for your bodies.
How we start.
- 1
Preparation
You answer a questionnaire in advance. Each unit gets one short session; no extended release from duties is needed and daily business continues.
- 2
Review
AI applications are recorded per unit, assigned to a risk class and mapped to the duties under the EU AI Act and the GDPR. Existing policies and approval paths are updated along the way.
- 3
Result
You receive the documented report: duties per application, registers, governance aligned with ISO 42001, a prioritized action plan. The findings are prepared for adoption into your decision paper.
- Now
A first meeting to take stock
Send us your request via the form on this page. We reply within one business day; scope and date are settled in the first meeting.
Frequent questions.
Does the EU AI Act apply to municipalities?
Yes. The AI literacy duty under Article 4 has applied since February 2025 to every organization using AI, regardless of size or legal form. Further obligations follow in stages through 2027. The assessment shows which of them affect your applications.
How much effort lands on the units?
Little. A questionnaire in advance, one short session per unit; no extended release from duties is required. Participation starts with the units that are ready; commitment grows through involvement, not through decree.
What does "credited" mean in practice?
The assessment is a paid service. If you then commission further modules from us, such as the strategy or a delivery, the fee you paid is credited against that service. If you decide against follow-up steps, it stays with the assessment; the result is yours either way.
Do running AI applications have to be stopped?
No. The assessment records today's usage and puts it on a legal footing. The goal is an orderly framework for everyone involved, not a fault-finding exercise.
Is the assessment an ISO 42001 certification?
No. Policies, approvals and documentation are aligned with ISO 42001; certification is a separate, later step, for which the right structures will then be in place.
Further services
Let us take the next step together.
Book an initial assessment meeting.