01
Workshop and inventory
We establish objectives, processes, tools, suppliers, data and accountable people. We also record AI embedded in business applications and points where decisions are executed automatically.
AI Act audit
AI Act audit
We check where your company uses AI, what data enters the tools and who is accountable for decisions. We assess AI Act requirements alongside documentation, access and human oversight. You receive a system register, findings and an action plan for business, IT and compliance teams.
Trusted by
Companies and institutions that need stable IT.
Start with use, then obligations
The audit covers companies using ready-made tools, building their own solutions or buying services with AI features. We review sales, HR, finance, marketing, customer service, document analysis, reporting, IT and cybersecurity. The same model can summarise text or support decisions affecting people; a product name alone does not determine risk. We prioritise protected data, financial decisions and effects on individuals. Virtline's audit is an advisory and technical review, not certification or a substitute for a required conformity assessment.
Related services
An AI Act audit identifies requirements and gaps. These services can separately help assess a process or implement agreed improvements.
AI process audit
Assess use cases, data and working processes before choosing automation. Business potential does not replace a review of legal requirements.RAG knowledge bases
Answers grounded in company documents: knowledge sources, index permissions, data separation and response quality.Offline AI models
Local models and control over data flows. Running without cloud services does not automatically mean low risk or exemption from the AI Act.n8n automation
Control of classification, routing, reply generation and subsequent actions performed by a model within a workflow.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateAI Act application dates
As of 25 September 2026, the dates depend on the system and the company's role. These dates reflect the AI Act and enacted amendment 2026/1744. Our audit also checks exceptions and transition rules for existing systems; we do not assign one deadline to the whole company.
Entry into force and first obligations
The AI Act entered into force on 1 August 2024. The original prohibitions and AI-literacy provisions apply from 2 February 2025. General-purpose AI model (GPAI) rules apply from 2 August 2025; models placed on the market earlier have a transition until 2 August 2027.Changes and framework from 2026
Amended Article 4 has required measures supporting AI-literacy development since 27 July 2026. The main framework and transparency rules apply from 2 August 2026, with exceptions.New prohibitions and content marking
From 2 December 2026, prohibitions concerning specified non-consensual intimate content and child sexual abuse material apply. This is also the special Article 50(2) content-marking deadline for systems placed on the market before 2 August 2026.High-risk systems
The European Commission’s published timeline lists 2 December 2027 for high-risk systems in Annex III and 2 August 2028 for systems embedded in regulated products in Annex I. The legal basis, exceptions and transitional rules are established for the specific system.How the AI Act audit runs
We combine owner interviews, document analysis and an agreed technical review. The report states the sample scope and any unavailable data.
02
Roles and classification
We check whether the AI Act applies, the company's role, intended use, risk and relevant dates. We separate legal duties from security recommendations and questions requiring legal determination.
03
Documents and safeguards
We review policies, contracts, instructions, approvals and user literacy. We examine access, data, human oversight, monitoring and decision records, along with agreed failure and misuse scenarios.
04
Report and action review
We present findings, recommendations, owners and priorities. We agree on how to verify improvements, update documentation and, if needed, arrange separate implementation support.
Practical scope
What you receive
The report separates findings, missing information, company decisions and recommendations. It does not declare that every system meets every requirement.
Models, chatbots, agents, SaaS applications, APIs, integrations and local instances with process owners. We record suppliers, users, affected persons, training and contextual data, flows, logs and retention periods.
Reasons for the classification of use cases, prohibitions and obligations, with dates and open questions. We distinguish providers and deployers and, where relevant, product manufacturers, authorised representatives, importers and distributors.
AI usage rules, instructions, approval of new tools, risk escalation, literacy development, AI notices and content labelling. We identify who approves a decision, on what basis, where it is recorded and how to raise an objection, correct an output or stop the process.
Gaps, priorities, owners and verification criteria for access, retention, logs, testing, monitoring, suppliers, backup and continuity. The plan identifies documents and records needed by management, IT, compliance, legal teams and auditors.
AI Act legal sources
Official texts of the regulation and its amendment in EUR-Lex.
Source
Regulation (EU) 2024/1689 — AI Act
The official text of the EU Artificial Intelligence Act in EUR-Lex.
Open sourceSource
Regulation (EU) 2026/1744 — amended AI Act dates
The official Digital Omnibus on AI act of 8 July 2026, which changes, among other provisions, the application dates for high-risk AI systems.
Open sourceQuestions about an AI Act audit
Do ready-made AI tools remove our obligations?
+
Not automatically. A company using a system under its authority may be a deployer. A provider includes an entity that develops a system or model, or commissions its development, and markets it under its own name or, for a system, puts it into service. We assess roles from actual activities and record employees and affected persons separately. GPAI model-provider obligations do not automatically pass to every chatbot user. For GPAI, we separately review documentation, transparency, copyright and requirements for models with systemic risk, where applicable.
Does high risk mean AI use is prohibited?
+
No. Prohibitions include harmful manipulation and certain forms of social scoring, subject to Article 5 conditions; a company policy or human approval does not make them lawful. High risk entails specific requirements, depending on the use and applicable date. We separately review transparency, such as notices about AI interaction or labelling certain content. Lower risk does not remove data-protection requirements. Classification concerns the particular use, not only the model, industry or offline deployment.
What do you check in RAG, offline AI and automation?
+
Knowledge sources, index permissions, data separation, access, retention, logs, API integrations and response quality. The review covers agreed solutions, including n8n, Open WebUI, Microsoft 365 and agents. We examine attempts to inject unwanted instructions, disclosure of personal data or trade secrets, biased outputs, fallback arrangements and process stops. In HR, scoring and alert analysis, we also review decision oversight, manual correction and control of response actions. Local models and RAG do not ensure security by themselves.
Can you implement recommendations and confirm compliance?
+
We can separately agree on policies, access, logging, monitoring, supplier requirements and approval of new use cases. Neither an audit nor implementation guarantees compliance. Your company remains accountable for decisions; any legal review or formal conformity assessment needed is determined separately. We align overlapping work on GDPR, NIS2, DORA and ISO 27001 without treating them as equivalent to the AI Act. Virtline's certificate covers its own management system, not the audited AI.
Define your audit scope
Describe how you use AI, whether you build your own system, what data it processes and who uses its outputs. Identify critical processes, RAG or local models. Do not send passwords or confidential input data.
Discuss your AI use cases