§ 1
Who it is for
This service is intended for companies already using artificial intelligence tools in their processes or products that do not yet have a clear position on what the European Regulation requires of them. If you do not know whether your systems are limited or minimal risk, what transparency obligations you owe your users, or what internal documentation you need in order, this is the right starting point. The calendar does not reward waiting: Regulation (EU) 2026/1744 (the digital AI Omnibus) entered into force on 27 July 2026 and postponed much of the high-risk regime, but kept 2 August 2026 as the date of general application and of enforceability for the transparency obligations in article 50. By the close of the engagement you will have your systems classified, your obligations documented, and the body of documentation the Regulation requires operational and presentable to any authority or investor.
§ 2
Deliverables
This engagement resolves the underlying problem: not knowing where the company stands under the AI Act, or what it must do to comply. Spain's AI supervisory authority is operational and can request documentation at any time; the difference between answering and improvising is having the file already built. The documentation produced (system classification, compliance register, contracts, digital presence, AI Statement) integrates FRIA and DPIA as a single exercise wherever personal data is involved. You end with a regulatory position that withstands an inspection.
A unilateral confidentiality agreement signed by PASSAS before the video consultation, available at no additional cost on request. It binds the firm alone — no signature is required from the client — and adds an explicit contractual layer on top of the professional secrecy obligations inherent to the practice of law.
A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.
Legal analysis of the business model that determines which rules affect the company, what legal risks exist and what documentation is mandatory before operating. Covers the sectoral regulatory framework, data protection obligations, essential contracts and any applicable authorisation or licensing requirements.
Legal analysis of the artificial intelligence systems the company operates or deploys under Regulation (EU) 2024/1689. Determines the company's regulatory role (provider, deployer or both), classifies each system according to the AI Act risk tiers and establishes the map of applicable obligations. The documentary basis on which any compliance process is built.
The documentation required for GDPR compliance and, more broadly, for any rules on data protection and on the processing and transfer of data, including international transfers, both in dealings with users and with the providers that process data on your behalf, with the legal mechanisms needed to operate without regulatory exposure.
The legal documentation required to operate online: legal notice, privacy policy, cookie policy and, where applicable, terms of sale. Drafted with legal precision and adapted to the specific activity, not carried over from another website. Complies with the GDPR and with information society services rules.
Public statement on the use of artificial intelligence in the company's products and processes: which systems are used, for what purpose and with what safeguards for the users affected. A deliverable that clients, regulators and investors will demand with increasing frequency, and that few firms are yet in a position to provide.
Contractual documentation to formalise relationships with clients and suppliers, with the terms, liabilities and scope clearly defined from the first engagement. Includes the services agreement adapted to the company's operations, with limitation of liability clauses and payment terms, ready to sign.
§ 3
Timeline
At PASSAS we work fast, and we intend to be faster than the competition without losing quality along the way. That is why we like to tell you how long you will wait for your service. It is an indicative figure, since some engagements are more complex than others. The Engagement Letter sets out a deadline tailored to your matter, one we will do everything we can to meet, or to beat. That is our commitment to quality.
§ 4
Fees
We tell you what you will pay for your service: at PASSAS we work with a transparent fee policy. That said, we are not a marketplace. Every service is tailored and the fees follow the workload borne by the lawyer in charge. Even so, we want to give you an indicative price for this service, so that deciding to instruct us and booking your virtual consultation is easier.
§ 5
Frequently asked questions
Only in part. Regulation (EU) 2026/1744 entered into force on 27 July 2026 and pushed back much of the high-risk regime, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I. It did not move 2 August 2026, which remains the date of general application and of enforceability for the transparency obligations in article 50. A company using AI today is already within scope.
The distinction decides which obligations apply, and it does not always match commercial intuition. Under article 25 a deployer becomes a provider by putting its own name or trade mark on a system, by modifying it substantially, or by changing its intended purpose. Companies that consider themselves users of third party AI frequently discover they have crossed into the provider role. Establishing your position is the first stage of the engagement.
Classification under the AI Act is a question of legal interpretation, and the answer determines exposure to fines. A consultancy can map processes and produce a report; it cannot sign a legal opinion, it carries no professional liability for the classification, and it is not bound by legal professional privilege. Everything we deliver is signed by lawyers admitted to the Bar.
From €4,900 + VAT, delivered within three weeks, at a fixed price agreed in the engagement letter. It covers classification of your systems, the compliance register, the contractual layer, your digital presence and the AI Statement, integrating the fundamental rights and data protection impact assessments as a single exercise wherever personal data is involved.
Then the work required is broader and is handled under our AI Act High-Risk engagement, which covers the documentation in Chapter III and registration of the fundamental rights impact assessment. Classification comes first in any event, and the Virtual Consultation for €90 (VAT included) is usually enough to tell which of the two routes applies to you.
Email us at hola@passas.io, no strings attached, or fill in the form below and we will reply within 24 hours:
§ 6
Related articles
We know how much it matters that the lawyer you instruct has real command of the subject you are handing over. We have written on questions related to the service you are considering.
The AI Act's high-risk duties have moved to 2027 and 2028. The 2 August 2026 date has not. Which is which, and on what legal basis.
The Digital Omnibus deferred one Article 50 obligation by four months. Companies reading it as a reprieve for the whole article have been late since August.
Points (ba) and (bb) prohibit the system, not the content. Article 5(1a) decides which providers are inside, and a general-purpose model can be.
§ 7
Your lawyers
60 minutes on Google Meet with a qualified lawyer specialising in TechLaw, litigation or international law. €90 including VAT, deducted from the first invoice if we take on your matter. You leave with legal judgement and a fixed price for whatever comes next.
