An EU client or EU-origin data does not by itself settle the AI Act assessment. Check the operator’s location, the relevant market or service activity, and whether a third-country provider’s or deployer’s system output is used in the EU. Then assess the system’s intended purpose and the applicable category.
Private-practice research, drafting and contract review are not automatically high-risk under Annex III 8(a). That category addresses assistance to judicial authorities or work on their behalf, and similar alternative dispute resolution. Recruitment and other listed uses require their own assessment.
Assess scope before classification
Article 2 covers providers bringing systems or general-purpose models to the EU market, deployers established or located in the EU, and third-country providers or deployers whose system output is used in the EU. London is outside the EU. The nationality of a data subject or a contract’s governing law does not alone answer the territorial question. Data-protection duties need a separate assessment.
Private practice and the justice category
Private-practice research, drafting and contract review are not automatically high-risk under Annex III 8(a). That category addresses assistance to judicial authorities or work on their behalf, and similar alternative dispute resolution. Recruitment and other listed uses require their own assessment. This is an application of the category’s wording, not a blanket law-firm exemption. Check the exact system and intended use against Article 6 and every relevant Annex III category. Human review alone is not a universal high-risk exception.
Use the amended dates
Under amended Article 113, Chapter III sections 1–3, except Article 6(5), apply from 2 December 2027 for Article 6(2)/Annex III high-risk systems and 2 August 2028 for the Article 6(1)/Annex I route. Applicable initial prohibitions and general provisions, GPAI duties and Article 50 transparency rules have separate earlier dates and transitions.
Article 111 also gives a 2 August 2027 transition for GPAI models marketed before 2 August 2025 and a 2 December 2026 transition for Article 50(2) marking duties for qualifying synthetic-content systems marketed before 2 August 2026. Existing high-risk systems have further transition rules involving significant design changes. Record the relevant system dates instead of applying one firm-wide deadline.
Provider and deployer duties differ
A high-risk provider’s system documentation and conformity duties differ from a high-risk deployer’s duties. Article 26 addresses use according to instructions, competent oversight, monitoring and available logs, among other requirements. Buying software does not transfer every developer duty to the firm. Assess the role, system and applicable rule before asking for evidence; a general vendor compliance badge does not settle the assessment.
A practical assessment sequence
Inventory the workflow and deploying entity. Record where the output is used. Document the scope and classification rationale, operator role, relevant dates, evidence and an owner. Ask vendors for instructions, oversight and logging information that match the applicable duties.
Plan any gap work from that assessment. No fixed implementation duration or NIST-completion percentage is established here. Maintain approved-use, input, review and incident-escalation records, and obtain qualified legal review where the scope or classification is uncertain.
Penalties and proportionality
Article 99 sets ceilings of €35 million/7% for prohibited practices, €15 million/3% for specified other breaches and €7.5 million/1% for specified incorrect, incomplete or misleading information. Turnover uses the preceding financial year’s worldwide annual total. The higher ceiling normally applies; SMEs receive lower-of treatment for paragraphs 3–5, while qualifying small mid-cap enterprises receive it only for paragraphs 4–5. Actual fines require a proportionate, case-specific assessment.
What to do with the assessment
Use the updated law-firm scope and deadlines guide and governance policy guide to organise the work. Staff AI-literacy measures remain contextual under amended Article 4; organisations need not guarantee a particular literacy level for every individual. Professional duties, court directions, client commitments and data-protection obligations require their own analysis.
Primary sources: Article 2: scope; Annex III; Article 113: revised dates; Article 111: transitions; Article 26: high-risk deployers; Article 99: penalties. Checked October 3, 2026. Educational planning information, not advice on a particular matter.
AI-Assisted Research. This update uses AI-assisted research and editing. It is published under the byline of Manu Ayala. For deeper takes and the perspective behind the research, follow me on LinkedIn or email me directly.