GAWEL LEGAL

EU AI Act compliance

GAWEL Legal advises providers and deployers of AI systems with EU exposure on their obligations under the EU AI Act, on a retainer. The work covers role and risk classification, high-risk-system obligations and conformity-assessment documentation, including the relationship with the MDR and IVDR for AI medical devices; GAWEL Legal provides the legal documentation and coordination, not the technical conformity assessment.

Discuss AI Act obligations View scope
Establishing the AI Act requirements
Role
Provider or deployer
Classification
Risk category and obligations
Documentation
Governance and conformity support

Legal documentation and coordination; technical conformity assessment is outside the service.

Who this is for

  • Providers and deployers of AI systems with EU market exposure
  • Life-sciences and ICT companies placing AI/ML products on the EU market
  • Manufacturers of AI medical devices subject to the AI Act and MDR/IVDR

Scope

  • Role and risk classification:
    whether the client is a provider or a deployer (Art. 3(3)–(4) AI Act) and the system's risk category, including high-risk classification for products covered by Union harmonization legislation (Art. 6(1), Annex I AI Act)
  • High-risk-system obligations:
    risk management (Art. 9 AI Act), data governance (Art. 10 AI Act), technical documentation (Art. 11 AI Act), record-keeping (Art. 12 AI Act), transparency (Art. 13 AI Act), human oversight (Art. 14 AI Act), accuracy and cybersecurity (Art. 15 AI Act), the quality-management system (Art. 17 AI Act) and post-market monitoring (Art. 72 AI Act)
  • Deployer duties:
    obligations of deployers of high-risk systems (Art. 26 AI Act) and, where applicable, the fundamental-rights impact assessment (Art. 27 AI Act)
  • General-purpose-AI duties:
    obligations for providers of general-purpose AI models (Art. 53 AI Act) and models with systemic risk (Art. 55 AI Act)
  • Transparency duties:
    the disclosure and marking duties for AI systems that interact with people or generate synthetic content, which have applied since 2 August 2026 (Art. 50 AI Act)
  • MDR/IVDR coordination:
    how the AI Act's high-risk requirements sit alongside the medical-device conformity assessment for AI/ML devices that are high-risk under Art. 6(1) AI Act, assessed within the existing notified-body route (Art. 43(3) AI Act)
  • Conformity-assessment documentation:
    legal documentation and governance support, delivered as fixed-fee modules

How the work proceeds

  1. Scoping The initial review maps each AI system and the client's role (provider / deployer / importer) for each.
  2. Classification The assessment determines the risk category and the obligations that follow.
  3. Gap assessment Current documentation and governance are compared against those obligations.
  4. Documentation Legal documentation and the governance framework are prepared as fixed-fee modules.
  5. Ongoing advisory Once the system is live, the retainer covers legal support for model-change governance and post-market monitoring.

Fees

Retainer + fixed-fee modules

Gap assessment and conformity support as fixed-fee modules

Questions

Does the EU AI Act apply to a company based outside the EU?
Yes, it can. The AI Act reaches providers and deployers established outside the Union where the output produced by the AI system is used in the Union (Art. 2(1)(c) AI Act), and it applies to providers placing an AI system on the EU market irrespective of where they are established (Art. 2(1)(a) AI Act). A Swiss or US company with no EU entity can therefore fall within scope through its EU-facing AI use. A provider established outside the Union must also appoint an authorized representative in the Union, by written mandate, before making a high-risk AI system available there or placing a general-purpose AI model on the market (Art. 22(1) and Art. 54(1) AI Act).
What is the difference between a provider and a deployer?
A provider develops an AI system (or has one developed) and places it on the market or puts it into service under its own name or trademark (Art. 3(3) AI Act). A deployer uses an AI system under its own authority in a professional capacity (Art. 3(4) AI Act). The same company can be both (for different systems), and the two roles carry different obligations, so classification is the first step in any engagement.
How does the AI Act interact with MDR/IVDR for AI medical devices?
An AI system that is a medical device, or a safety component of one, is high-risk under the AI Act where the device must undergo third-party conformity assessment under the Union harmonization legislation in Annex I, which lists the MDR (Regulation (EU) 2017/745) and the IVDR (Regulation (EU) 2017/746) in Section A (Art. 6(1), Annex I AI Act). The AI Act's high-risk requirements apply in addition to MDR/IVDR conformity assessment, and are intended to be assessed within the existing notified-body route rather than through a separate AI-only assessment (Art. 43(3) AI Act). AI medical devices are therefore dual-regulated, not exempt.
When do the AI Act's high-risk obligations take effect?
The Digital Omnibus on AI (Regulation (EU) 2026/1744) has been in force since 27 July 2026, and it moved the high-risk dates. For AI embedded in MDR/IVDR products, which reach high-risk status through Annex I AI Act, the obligations now apply from 2 August 2028; for standalone Annex III AI Act systems they apply from 2 December 2027 (Art. 113 AI Act). Before the amendment, the obligations for systems classified through Annex I AI Act were to apply from 2 August 2027. The same act streamlines the AI Act and MDR/IVDR conformity interface (Art. 43(3) AI Act) while keeping medical devices high-risk. Not everything moved: the transparency obligations under Art. 50 AI Act applied on schedule on 2 August 2026, and generative systems placed on the market before that date have until 2 December 2026 to meet the marking requirement in Art. 50(2) AI Act. GAWEL Legal scopes engagements to the timeline that governs the specific system.

Related articles

Last updated: 4 October 2026

Discuss your matter

Briefly describe the matter and the legal advice you need.

Discuss an AI Act engagement