PRACTICE AREA
EU AI Act Compliance and Legal Advice
Are you developing, deploying or investing in AI? The core question is the same: how can you move forward quickly while complying with regulatory requirements and avoiding unnecessary regulatory risk?
We advise companies and organisations on the applicability of the EU AI Act, the classification of AI systems, risk levels and the specific obligations arising under the Regulation.
Our AI Act practice is led by lawyer Emil Vasilev
The AI Act practice at Slavchev & Vasilev is led by Emil Vasilev, a partner at the law firm and a legal expert with the AI Act Service Desk.
The AI Act Service Desk supports the practical implementation of the Regulation by enabling stakeholders to obtain guidance on questions concerning its interpretation and application.
Emil Vasilev’s experience in this field enables us to assess the requirements of the AI Act not only in theory, but also in the context of our clients’ specific business models, AI systems and use cases.
Learn more about Emil Vasilev’s work with the AI Act Service Desk →
The AI Act may apply to you even if you are not an “AI company”
The AI Act does not apply only to companies that develop AI systems or products incorporating such systems.
Your obligations depend both on the specific AI system and its intended purpose, and on the role you perform – for example, provider, deployer, importer or distributor.
The Regulation may also apply to companies established outside the European Union where the conditions for its territorial scope are met.
One of the first practical steps is therefore to determine:
- whether the solution falls within the definition of an “AI system”;
- the role of your organisation;
- the risk category of the system or specific use case;
- which requirements of the AI Act actually apply.
From there, we can assist you from the initial classification and analysis of the applicable obligations through to the necessary internal policies, documentation and contractual arrangements with customers and suppliers.
How we can assist you
Classification and risk assessment
The first step is to determine where you stand under the Regulation: whether your product or solution qualifies as an “AI system”, what role you perform and which category applies to the specific use case.
The objective is to provide you with a clear picture of which obligations apply to you, which do not, and what practical steps are required to achieve regulatory compliance.
High-risk AI systems
For high-risk AI systems, we can assist you in preparing for the applicable AI Act requirements, including risk management, data governance, technical documentation, record-keeping, human oversight, accuracy, robustness and cybersecurity.
Where relevant, we also advise on the applicable conformity assessment procedure.
Transparency and AI-generated content
Article 50 of the AI Act introduces transparency requirements for certain AI systems and content, including systems that interact directly with individuals, certain types of generated or manipulated content, and deepfakes.
We can help you determine which obligations apply to your system and how to implement them in practice.
GPAI, governance and contracts
We advise providers and other participants in the value chain on general-purpose AI (GPAI) models, including documentation requirements, information to downstream providers, copyright compliance and other applicable obligations.
We also assist with internal AI policies, allocation of responsibilities and AI literacy, as well as agreements for the development, licensing and deployment of AI systems, AI as a Service and other AI-related contractual arrangements.
High-risk AI systems and regulatory compliance
The AI Act follows a risk-based approach. For certain use cases that may pose significant risks to health, safety or fundamental rights, the Regulation establishes a specific regime for high-risk AI systems.
For providers of such systems, the applicable requirements may include:
- a risk management system;
- data quality and data governance;
- technical documentation;
- automatic record-keeping (logs);
- information and instructions for deployers;
- human oversight;
- accuracy, robustness and cybersecurity;
- registration and conformity assessment where applicable.
Our work begins by determining whether the specific system or use case actually falls within the high-risk category, after which we identify the applicable requirements and necessary actions.
Transparency obligations under Article 50 of the AI Act
The transparency requirements under Article 50 of the AI Act apply from 2 August 2026.
They cover a range of situations, including AI systems that interact directly with individuals, certain types of generated or manipulated content, and deepfakes.
Depending on the system and the organisation’s role, individuals may need to be informed that they are interacting with AI, or generated and manipulated content may need to be labelled or technically detectable as such.
We can analyse the specific use case, determine which transparency requirements apply and advise on how they should be implemented.
GPAI, internal governance and contractual arrangements
The AI Act establishes specific rules for providers of general-purpose AI (GPAI) models.
Depending on the particular model and the organisation’s role, these may include requirements relating to technical documentation, information provided downstream, copyright compliance and publication of a sufficiently detailed summary of the content used to train the model.
For organisations deploying or using AI, we also assist in establishing an internal governance framework, including rules for the use of AI, allocation of responsibilities, AI literacy, and procedures for risk assessment and control.
We prepare and review agreements for the development, licensing, deployment and provision of AI solutions, including AI as a Service, as well as contractual arrangements with customers, suppliers and other participants in the value chain.
From start-ups to the public sector
We advise a range of participants in the AI ecosystem, including:
- AI system providers and developers – start-ups and companies developing their own models, systems or AI-based products;
- deployers – companies and organisations using AI systems in the course of their professional activities;
- the public sector – administrative authorities and other public organisations developing or deploying AI systems;
- investors and funds – in connection with legal and regulatory due diligence of companies developing or using AI;
- companies established outside the EU where their activities or the use of outputs from their AI systems falls within the territorial scope of the Regulation.
Key AI Act dates
2 February 2025
The rules on prohibited AI practices and AI literacy, together with the related provisions on definitions, became applicable.
2 August 2025
The governance rules and obligations for general-purpose AI (GPAI) models became applicable.
2 August 2026
Most provisions of the AI Act became applicable. The transparency requirements under Article 50 also took effect, and the AI Office and national competent authorities began exercising their respective enforcement and supervisory powers.
2 December 2027
The rules for high-risk AI systems in the areas listed in Annex III become applicable.
2 August 2028
The rules for high-risk AI systems integrated into regulated products under Annex I become applicable.
The AI Act – key questions
What is the AI Act?
The AI Act is the European Union’s Artificial Intelligence Regulation – Regulation (EU) 2024/1689. It establishes a common legal framework for the development, placing on the market, deployment and use of certain AI systems and models in the EU.
The AI Act follows a risk-based approach: the higher the risk that a particular system or use case may pose to safety or fundamental rights, the more stringent the applicable requirements.
The AI Act is sometimes described as the EU’s “AI law”, but legally it is an EU Regulation that is directly applicable across the European Union.
When does the AI Act apply?
The AI Act applies in stages.
The first rules became applicable in February 2025, the rules for GPAI models in August 2025, and most provisions of the Regulation, including the transparency requirements, from 2 August 2026.
Later dates apply to certain high-risk AI systems – 2 December 2027 for the cases listed in Annex III and 2 August 2028 for high-risk AI systems integrated into regulated products.
Which AI systems are covered by the Regulation?
The first step is to determine whether the particular solution falls within the definition of an “AI system” under the AI Act.
The intended purpose of the system, the specific use case, the level of risk and the organisation’s role – for example provider, deployer, importer or distributor – are then relevant in determining the applicable obligations.
The mere presence of AI technology is therefore not sufficient by itself to determine which obligations apply.
What does the risk-based approach mean?
The AI Act establishes different regulatory regimes depending on the risk and intended purpose of an AI system.
Certain practices are prohibited. High-risk AI systems are subject to detailed requirements. Certain systems and generated or manipulated content are subject to specific transparency obligations.
For other AI systems, the AI Act may not impose specific obligations, although all other relevant provisions of EU and national law continue to apply.
What are the main obligations for high-risk AI systems?
Depending on the organisation’s role and the particular system, the requirements may include risk management, data governance and quality, technical documentation, logging, information for deployers, human oversight, accuracy, robustness and cybersecurity.
Registration and conformity assessment obligations may also apply.
The precise set of requirements should be determined after classifying the system and analysing the organisation’s role.
Start with a conversation
If you develop, deploy or use AI and would like to understand how the AI Act applies to your organisation, we can start with a discussion about the specific system, your role and the next steps required.