§ 1
Who it is for
This service is intended for companies that operate or deploy artificial intelligence systems falling under Annex III of the AI Act: recruitment tools, credit scoring systems, insurance risk assessment solutions, or platforms whose decisions directly affect individuals. If you have already identified high-risk systems, or the initial virtual consultation has established that you have them, this is where complete compliance is built. By the close of the engagement you will hold all the documentation required by Chapter III of the Regulation, the fundamental rights impact assessment properly registered, and your contracts and digital presence updated.
§ 2
Deliverables
High-risk compliance covers a set of interdependent obligations that have to be resolved in a coordinated way. Regulation (EU) 2026/1744 postponed enforceability to 2 December 2027 for Annex III and 2 August 2028 for Annex I: there is room, but classification and technical documentation are not improvised. By the close of this engagement that coordination is done: technical documentation, contracts and digital presence updated, and the FRIA registered before deployment. Compliance built in advance, not under pressure.
A unilateral confidentiality agreement signed by PASSAS before the video consultation, available at no additional cost on request. It binds the firm alone — no signature is required from the client — and adds an explicit contractual layer on top of the professional secrecy obligations inherent to the practice of law.
A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.
Legal analysis of the business model that determines which rules affect the company, what legal risks exist and what documentation is mandatory before operating. Covers the sectoral regulatory framework, data protection obligations, essential contracts and any applicable authorisation or licensing requirements.
Legal analysis of the artificial intelligence systems the company operates or deploys under Regulation (EU) 2024/1689. Determines the company's regulatory role (provider, deployer or both), classifies each system according to the AI Act risk tiers and establishes the map of applicable obligations. The documentary basis on which any compliance process is built.
The documentation required for GDPR compliance and, more broadly, for any rules on data protection and on the processing and transfer of data, including international transfers, both in dealings with users and with the providers that process data on your behalf, with the legal mechanisms needed to operate without regulatory exposure.
The legal documentation required to operate online: legal notice, privacy policy, cookie policy and, where applicable, terms of sale. Drafted with legal precision and adapted to the specific activity, not carried over from another website. Complies with the GDPR and with information society services rules.
Public statement on the use of artificial intelligence in the company's products and processes: which systems are used, for what purpose and with what safeguards for the users affected. A deliverable that clients, regulators and investors will demand with increasing frequency, and that few firms are yet in a position to provide.
Contractual documentation to formalise relationships with clients and suppliers, with the terms, liabilities and scope clearly defined from the first engagement. Includes the services agreement adapted to the company's operations, with limitation of liability clauses and payment terms, ready to sign.
The Fundamental Rights Impact Assessment required by article 27 of the AI Act from certain deployers of high-risk AI systems. Identifies the effects of the system on the rights recognised in the EU Charter, documents the mitigation measures and must be registered in the European database before deployment.
§ 3
Timeline
At PASSAS we work fast, and we intend to be faster than the competition without losing quality along the way. That is why we like to tell you how long you will wait for your service. It is an indicative figure, since some engagements are more complex than others. The Engagement Letter sets out a deadline tailored to your matter, one we will do everything we can to meet, or to beat. That is our commitment to quality.
§ 4
Fees
We tell you what you will pay for your service: at PASSAS we work with a transparent fee policy. That said, we are not a marketplace. Every service is tailored and the fees follow the workload borne by the lawyer in charge. Even so, we want to give you an indicative price for this service, so that deciding to instruct us and booking your virtual consultation is easier.
§ 5
Frequently asked questions
Those listed in Annex III, among them tools used in recruitment and worker management, credit scoring, risk assessment and pricing in life and health insurance, access to essential services, education and certain public sector uses. Annex I covers AI embedded as a safety component in products already subject to Union harmonisation legislation. Classification turns on the intended purpose of the system rather than on the technology behind it.
Regulation (EU) 2026/1744 moved the dates to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I. That is room to work with, not room to wait: classification, technical documentation and the fundamental rights impact assessment take months to assemble properly, and the assessment has to be registered before the system is put into service.
The fundamental rights impact assessment required by article 27 examines the effect of a high-risk system on the rights of the people subject to it, which is a different question from the one a data protection impact assessment answers under article 35 GDPR. Neither replaces the other. Where personal data is involved we build both as a single coordinated exercise, which is where the overlap between the AI Act and the GDPR is resolved rather than duplicated.
From €9,000 + VAT, delivered within four weeks, at a fixed price agreed in the engagement letter before we begin. The exact figure depends on the number of systems and on whether you act as provider or deployer of each one.
Then this is not the right starting point. Classification is resolved first, either in the AI Act Compliance engagement or in a 60 minute Virtual Consultation for €90 (VAT included), deductible from the first invoice if an engagement follows. Assuming high risk when the system is not, and building documentation accordingly, is an expensive mistake in the opposite direction.
Email us at hola@passas.io, no strings attached, or fill in the form below and we will reply within 24 hours:
§ 6
Related articles
We know how much it matters that the lawyer you instruct has real command of the subject you are handing over. We have written on questions related to the service you are considering.
The AI Act's high-risk duties have moved to 2027 and 2028. The 2 August 2026 date has not. Which is which, and on what legal basis.
The Digital Omnibus deferred one Article 50 obligation by four months. Companies reading it as a reprieve for the whole article have been late since August.
Points (ba) and (bb) prohibit the system, not the content. Article 5(1a) decides which providers are inside, and a general-purpose model can be.
§ 7
Your lawyers
60 minutes on Google Meet with a qualified lawyer specialising in TechLaw, litigation or international law. €90 including VAT, deducted from the first invoice if we take on your matter. You leave with legal judgement and a fixed price for whatever comes next.
