“EU AI Act-Ready” — Claim or Proof?

The pattern is already visible

Product comparisons now include “EU AI Act-ready” as a feature line. AI vendors and model providers use it as a quality signal. But there is no public standard that defines what “AI Act-ready” means. No certification. No registry. No verifiable artifact behind the claim.

The phrase appears in pitch decks, landing pages, and procurement checklists — always as a statement, never with a reference to a specific article, annex, or obligation. It functions as marketing language, not as a compliance position.

The GDPR precedent

After May 2018, every company claimed “GDPR-compliant.” Most were not. Regulators started asking for proof — processing records, DPIAs, DPAs with subprocessors. The claims without documentation behind them became liabilities, not assets.

The AI Act is following the exact same cycle, with an 8-year delay. Organizations that invested in documented compliance positions after GDPR were protected. Those that relied on self-declared claims faced enforcement actions, fines, and reputational damage.

The lesson is simple: a claim without a dated, verifiable artifact behind it is worse than no claim at all — because it creates the appearance of awareness without the substance of compliance.

What a claim looks like vs what proof looks like

A claim:

• “We are AI Act-ready.”
• Undated. Unverifiable.
• No article mapping. No audit trail.
• Self-assessed.

A proof:

• Gate-by-gate classification.
• Dated and versioned.
• Article-mapped to EU AI Act 2024/1689.
• Independently verifiable.
• Audit trail included.

The difference matters because regulators do not assess intentions. They assess documentation. A claim without an artifact behind it is indistinguishable from no compliance effort at all.

What regulators will look for

Under the AI Act, national market surveillance authorities will assess whether organizations have fulfilled their obligations — not whether they claimed to.

None of these are satisfied by a marketing claim. Each requires a documented, traceable process with outputs that can be reviewed by a third party.

The classification question nobody asks

“AI Act-ready” without specifying the use case is meaningless. The same model can be minimal risk for creative writing, limited risk as a chatbot (Art. 50), or high-risk under Annex III if deployed in HR or credit scoring.

Classification depends on intended purpose, not technical capability. A large language model is not inherently high-risk or low-risk. Its classification is determined by how it is deployed, in which domain, and for what decision.

Any organization claiming “AI Act-ready” without specifying which use case, which risk tier, and which articles apply has not completed a classification — they have made a marketing statement.

From claim to proof: what a documented position looks like

A Sprinkling Act assessment evaluates your system through 6 regulatory gates mapped to Art. 5, 6, 50, 51, 53. The output is a dated, versioned artifact — not a checkbox.

It can be verified by any third party, attached to a data room, or presented to a regulator. It includes the classification rationale, the article mapping, and the obligations triggered by your specific use case.

The goal is not to declare readiness. It is to document a defensible position — one that holds up when a market surveillance authority asks the only question that matters: “Show me your documentation.”