Navigating the EU AI Act: from regulatory text to operational control.
If your AI systems reach the EU market — or their outputs are used in the EU — the EU AI Act can apply to your Swiss company, wherever you are based. Compliance then rests on documented governance, verifiable outputs, and evidence across the AI lifecycle, not ethical guidelines alone.
A risk-based regime with duties that depend on your role
Extraterritorial reach
The Act can reach organisations outside the EU — including Swiss companies active internationally — where an AI system is placed on the EU market or its output is used in the Union. Whether it applies depends on your role (provider or deployer) and the specific case.
Phased timelines
GPAI model duties apply since 2 August 2025; the core high-risk requirements (Annex III) from 2 August 2026; and high-risk systems that are safety components of regulated products, such as medical devices, from 2 August 2027.
Technical duties
Depending on system category and your role, the Act requires measures such as technical documentation, record-keeping, transparency, human oversight, evaluation and monitoring. GPAI model providers and providers or deployers of high-risk systems carry different duties.
Three pillars for AI compliance and lifecycle control
Risk tiers & scope classification
The Act follows a risk-based regime — prohibited practices, high-risk, and transparency cases. We map precisely where your systems fit and what documentation and governance duties follow for your role.
Empirical output verification
RAG systems and LLMs still show notable hallucination rates in independent studies. We rely on multi-layer controls — grounding, output verification, traceability, and continuous monitoring — rather than single-layer defences.
Vendor due diligence & steering
We help deployers review available provider documentation, define pre-deployment checks appropriate to the system, and establish oversight and monitoring proportionate to the system category and your role.
A principle you cannot test is not a control
Responsible-AI principles only hold up under audit when each one is tied to a concrete technical control and the evidence it produces. That link is what we build and document.
Transparency
System logging and user-facing disclosure where people interact with the AI.
An audit trail of what the system did, when, and on what inputs.
Human oversight
Defined intervention points and an escalation path for contested outputs.
Oversight records showing who reviewed what, and the decisions taken.
Robustness & accuracy
Output verification (grounding) and continuous monitoring in production.
Test results and drift reports tracked over time, not a one-off sign-off.
AI Governance & AI Act Readiness Assessment
A structured review of your AI initiatives, system architectures, and governance gaps. You receive an executive scorecard, a prioritised roadmap, and verifiable technical baselines across the AI lifecycle. Duration is an estimate and depends on the number of systems in scope.
- Regulatory gap analysis: current AI deployments mapped against EU AI Act duties (scope, high-risk, GPAI).
- AI TRiSM stress test: source fidelity, hallucination risks, and safety guardrails.
- Governance dossier: risk registers and concrete action items for provider and deployer duties.
Note: This service provides technical evaluation and governance structuring. It does not constitute formal legal advice or an official conformity assessment.
Frequently asked questions
Does this service provide legal certification for the EU AI Act?
No. I provide practical governance support, technical architecture reviews, and output audits. This is distinct from formal legal counsel or official conformity assessments.
How does the EU AI Act apply to companies based in Switzerland?
The Act can apply to Swiss companies that operate internationally. If you place an AI system on the EU market, or its output is used in the EU, its provisions can apply even though you are based in Switzerland. The exact duties depend on your role and the system.
What are the key deadlines we need to track?
Prohibitions and AI-literacy duties already apply (since February 2025). GPAI model obligations apply since 2 August 2025. The core high-risk requirements (Annex III) apply from 2 August 2026, and high-risk systems in regulated products from 2 August 2027.
How do governance principles become technical controls?
Governance principles need operational controls to become testable and accountable. We translate each principle into a concrete control with its own evidence — transparency into logging and disclosure, human oversight into defined intervention points, robustness into output verification and monitoring.
Dates and scope reflect Regulation (EU) 2024/1689 (the AI Act) and the European Commission's published application timeline. This page is general information, not a case-specific legal assessment. Official overview: digital-strategy.ec.europa.eu — Regulatory framework for AI.
Clarify your compliance posture
Bring your current AI initiatives and governance questions. You get a direct read of your exposure and the next steps that follow from it.
Email or calendar
Write to me, or pick a 30-minute window for a confidential first conversation.
Please do not send confidential or personal data before we agree a secure channel and scope.
kevin.lancashire@lancashire-digital.ch
Pick a time in the calendar