Annex III duties moved to 2 December 2027 — 391d to prepare

Your client's procurement team will ask how you govern AI. Long before a regulator does.

The Digital Omnibus pushed the EU AI Act's high-risk deadline to December 2027. The questionnaires did not move. If your team touches ChatGPT, Copilot or AI inside your ATS, the next enterprise deal will ask for your AI register, your usage policy and your training record. ActCovered turns those into an audit-ready file in an afternoon.

No credit card 3-minute check Built for 5–200 employees
The gap in the market

Enterprise tools priced for the Fortune 500. A questionnaire you have to answer anyway. You're in between.

Enterprise compliance suites start at $25k a year. For a company your size the realistic cost of doing nothing is not a headline fine — it is a lost deal, a stalled security review and an insurer's raised eyebrow. ActCovered gives a 5–200 person team the same audit-ready file, for the price of an afternoon.

AI Register

Inventory every AI tool your team uses and auto-classify each by risk — prohibited, high-risk, transparency or minimal.

Usage Policy

Generate a company AI usage policy in plain English — automatically referencing the tools you've registered.

Training · Art. 4

Log AI-literacy training for every employee. Each completion is timestamped — the record of the measures you took.

Evidence Binder

One click assembles register, policy and training logs into a polished report — ready the moment anyone asks.

How it works

From “where do we even start” to audit-ready in three steps.

1

List your tools

Walk a short wizard. ActCovered classifies each AI system's risk level for you — no legal reading required.

2

Generate documents

Produce your usage policy and AI register automatically, pre-filled from what you entered.

3

Export your evidence

Print or download a compliance binder. When a client or regulator asks, the file already exists.

The real argument

Compliance is an insurance policy. You pay hoping never to need it.

You don't buy fire insurance because you expect a fire. You buy it so that, the day the worst happens, the paperwork is already done. ActCovered is the same — a quiet, ready file for the day someone asks how you govern AI.

And here's the part most people miss: the first person to ask is almost never a regulator. It's your client's procurement team, mid-deal, sending a vendor questionnaire. Have the answer ready and the deal keeps moving.

Check my readiness — free Read our own DPA →

We publish the documents we tell you to expect: a data processing agreement and a dated sub-processor list. If you send us a questionnaire, that is where the answers already are.

Free readiness check

Where does your company stand right now?

Five quick questions. You'll get a readiness score, a clear status, and the full breakdown by email — the same language we use inside the product.

1 / 5
Visibility
Do you know who on your team uses AI, and what for?
Inventory
Do you have a maintained list of every AI tool the company uses?
Usage policy
Is there a written policy telling staff how they may use AI?
AI literacy · Article 4
Have employees had any AI-literacy training?
Decisions about people
Do you use AI in hiring, credit, or other decisions about people?
Your report
Where should we send the breakdown?
Pricing

Less than one hour of a lawyer's time, per month.

No setup fees. Cancel anytime. Prices exclude VAT. Your file is stored in the European Union, on servers in France, and exportable at any time.

Starter
€49/mo

For a single small team getting its file in order.

  • AI Register & risk classification
  • Usage policy generator
  • Training log for up to 25 employees
  • Evidence binder export, unwatermarked
Get Starter
Done-for-you audit
€990one-off

We build your complete file with you, end to end.

  • Guided session with a specialist
  • Full register & policy built for you
  • Training rollout plan
  • Finished binder, handed over in 10 business days
Book the audit

Prefer to buy once? The Compliance Dossier is €490 one-off and keeps the same workspace — compare all four on the pricing page.

FAQ

Questions teams ask before starting.

Still unsure? Email us — a human answers.

Didn't the EU just delay the AI Act?
Partly, and it's worth being precise. The Digital Omnibus — Regulation (EU) 2026/1744, in force 27 July 2026 — moved the Annex III high-risk obligations, and the deployer duties in Articles 26, 27 and 86, from 2 August 2026 to 2 December 2027; product-embedded systems under Annex I move to 2 August 2028. What did not move: the Article 5 prohibitions, the Article 4 AI-literacy duty (now framed as taking measures to support AI literacy), and the Article 50 transparency duties that applied on 2 August 2026. And none of it moved the thing that actually costs you deals — the AI section of your client's vendor questionnaire, which is being asked today. You have 12 months of runway. Most of your competitors will spend it doing nothing.
Does it count if we only use ChatGPT?
Yes. The moment your staff uses any AI system in their work — even just ChatGPT — your company is a “deployer” under the EU AI Act. The AI-literacy duty (Article 4) has applied since 2 February 2025 — since the July 2026 Omnibus it asks you to take measures supporting your team's AI literacy, rather than guarantee a level. It is light, but it is real, and a client asking “what is your AI policy?” does not care how many tools you use.
What do we actually have to do today?
As a deployer, three things are live now. Take measures to support your team's AI literacy (Article 4, since 2 February 2025). Stay out of the Article 5 prohibited practices. And meet your own share of the Article 50 transparency duties, which since 2 August 2026 means Article 50(3) — telling people when they are exposed to emotion recognition or biometric categorisation — and Article 50(4) — labelling deepfakes and AI-generated text you publish on matters of public interest. Chatbot disclosure and machine-readable marking under 50(1) and 50(2) are the provider's job, not yours. The register and the deployer duties in Articles 26 and 27 are not binding until 2 December 2027 — we build them now because your clients ask now.
What are the penalties, really?
The Article 99 penalty regime has applied since 2 August 2025, and the headline numbers you see quoted — up to €35m or 7% of turnover — are the ceiling for the Article 5 prohibited practices, not for a missing register. For a small or medium company, Article 99(6) says the cap is the lower of the fixed amount and the percentage of turnover, so those headlines are the wrong number for a team of your size. We think the honest risk today is commercial: a stalled security review, a deal that goes quiet, a questionnaire you cannot answer.
We're not in the EU. Does this apply to us?
It can. The Act reaches non-EU companies whose AI outputs are used in the EU, or who sell to EU customers. In practice, if you have EU clients, their procurement teams will ask — and ActCovered gives you the answer on file.
Where does our data live?
In a MySQL database on our host's servers in France, inside the EU. It is not “only in your browser” — it is a real account you can sign into from anywhere, export at any time and delete in one click. The details, including every sub-processor, are on the sub-processor page and in our DPA.
Is ActCovered legal advice?
No. ActCovered is compliance tooling that helps you organise, document and evidence your AI governance. It is not a substitute for a lawyer. For high-stakes or novel situations, consult qualified counsel — ActCovered makes that conversation far shorter.

An afternoon of work. A year of peace of mind.

Start with the free check. It takes three minutes, and the report tells you exactly what to write down first.

Done-for-you audit · 4 slots a month, delivered in 10 business days
Get my free readiness score See plans →
No credit card · 3-minute check · Cancel anytime