Readiness framework for the EU AI Act. In force since Aug 2024: prohibited practices and AI literacy applied Feb 2025; general-purpose AI obligations applied Aug 2025; transparency obligations (chatbot disclosure, AI-content labeling) apply from Aug 2026 (content labeling deferred to Dec 2026).
Readiness framework for the EU AI Act. In force since Aug 2024: prohibited practices and AI literacy applied Feb 2025; general-purpose AI obligations applied Aug 2025; transparency obligations (chatbot disclosure, AI-content labeling) apply from Aug 2026 (content labeling deferred to Dec 2026).
Under the 2026 Digital Omnibus agreement, high-risk system deadlines are expected to move to Dec 2027 (Annex III stand-alone systems) and Aug 2028 (Annex I embedded systems) - verify current dates before committing to a compliance calendar. Select the roles that apply: Deployer (you use AI), Provider (you place AI systems on the EU market), and/or GPAI Provider.
Official source: https://artificialintelligenceact.eu/
ThreeShield's CISSP- and CISA-certified assessors run the EU Artificial Intelligence Act - Readiness engagement, and Lavawall® collects the technical evidence continuously, so your posture is current the day an auditor, insurer, or client asks for it, not just at renewal.
| Level | What it covers | Builds on the level below |
|---|---|---|
| Deployer | You use AI systems under your authority in the course of business (Art. 26 obligations, AI literacy, transparency when interacting with people). | — |
| Provider | You develop AI systems or have them developed and place them on the EU market under your name (Art. 8-17 high-risk requirements, conformity assessment, registration). | — |
| GPAI Model Provider | You provide general-purpose AI models (Art. 53-55: technical documentation, copyright policy, training-content summary; systemic-risk duties above 10^25 FLOPs). | — |
| EU Artificial Intelligence Act - Readiness requirement | Lavawall® collects | ThreeShield delivers |
|---|---|---|
| Multi-factor authentication status | ✓ Continuously | — |
| Patch and vulnerability posture | ✓ Continuously | — |
| Encryption at rest and in transit | ✓ Continuously | — |
| Access and audit-log review | ✓ Continuously | — |
| Risk assessment and scoping | ⚑ Platform data | CISSP/CISA-led |
| Policies, procedures, and evidence package | — | Written by ThreeShield |
If your organization operates in scope for EU or in the regional sector, EU Artificial Intelligence Act - Readiness likely applies. Readiness framework for the EU AI Act. We confirm scope in the first call, at no charge.
It depends on your starting point. A gap assessment against EU Artificial Intelligence Act - Readiness is usually a few weeks; closing the gaps and standing up the evidence takes longer and is where most of the work sits. Because Lavawall® is already collecting the technical evidence while we work, you do not restart from zero at reassessment.
Yes. Many clients begin self-serve on Lavawall®, then bring in ThreeShield for the assessment, the policies, and the sign-off once they know where the gaps are. The three engagement models below are meant to be moved between.
ThreeShield meets you at your current security maturity. Every level includes Lavawall®.
For lean IT teams and cost-conscious organizations with internal security capacity
Expert guidance alongside your team, ideal for MSPs and organizations with some internal IT capacity
Full compliance delivery, managed end to end by ThreeShield
Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring, so you stay compliant between audits.
Book a Scoping CallDIY · Supported · Done-for-You