§ 1
Who it is for
This service is for companies that develop, commission the development of, or supply artificial intelligence systems under their own brand, and for those that have crossed into that position without deciding to. The accidental provider under article 25 of the AI Act takes on the obligations of a provider through rebranding, substantial modification or a change in the intended purpose of the system. The provider role concentrates the heaviest regulatory burden in the Regulation: technical documentation under Annex IV, conformity assessment, EU declaration and registration in the European database. By the close of the engagement you will hold the complete technical file, a settled conformity strategy, and contracts and digital presence aligned with your position as a provider.
§ 2
Deliverables
The provider carries the heaviest obligations in the AI Act, and since 2 August 2026 falling short of them is no longer an irregularity but a sanctionable infringement. This engagement builds the provider's complete file: system classification, Annex IV technical documentation, conformity assessment and registration, with contracts and digital presence aligned. A legal opinion signed by qualified lawyers, which no technical consultancy is in a position to offer.
A unilateral confidentiality agreement signed by PASSAS before the video consultation, available at no additional cost on request. It binds the firm alone — no signature is required from the client — and adds an explicit contractual layer on top of the professional secrecy obligations inherent to the practice of law.
A 60-minute working session by video call in which we analyse your situation, your specific needs and our ability to help you. We assess whether we can take on the matter and give you the fixed price in advance. You can book it directly through the Google Calendar link on our website and pay €90 by Stripe.
Legal analysis of the artificial intelligence systems the company operates or deploys under Regulation (EU) 2024/1689. Determines the company's regulatory role (provider, deployer or both), classifies each system according to the AI Act risk tiers and establishes the map of applicable obligations. The documentary basis on which any compliance process is built.
Technical documentation of the AI system in accordance with Annex IV of the AI Act: general description of the system, development process, training data, performance metrics, risk management and human oversight measures. It is the core of the file the provider must keep available to the authorities, and the basis on which the conformity assessment is built.
Strategy and execution of the conformity assessment applicable to the system, drafting of the EU declaration of conformity and registration in the European database where required. Closes the formal cycle that allows the provider to place the system on the Union market with a documented regulatory position, defensible before any authority.
The documentation required for GDPR compliance and, more broadly, for any rules on data protection and on the processing and transfer of data, including international transfers, both in dealings with users and with the providers that process data on your behalf, with the legal mechanisms needed to operate without regulatory exposure.
Contractual documentation to formalise relationships with clients and suppliers, with the terms, liabilities and scope clearly defined from the first engagement. Includes the services agreement adapted to the company's operations, with limitation of liability clauses and payment terms, ready to sign.
Public statement on the use of artificial intelligence in the company's products and processes: which systems are used, for what purpose and with what safeguards for the users affected. A deliverable that clients, regulators and investors will demand with increasing frequency, and that few firms are yet in a position to provide.
§ 3
Timeline
At PASSAS we work fast, and we intend to be faster than the competition without losing quality along the way. That is why we like to tell you how long you will wait for your service. It is an indicative figure, since some engagements are more complex than others. The Engagement Letter sets out a deadline tailored to your matter, one we will do everything we can to meet, or to beat. That is our commitment to quality.
§ 4
Fees
We tell you what you will pay for your service: at PASSAS we work with a transparent fee policy. That said, we are not a marketplace. Every service is tailored and the fees follow the workload borne by the lawyer in charge. Even so, we want to give you an indicative price for this service, so that deciding to instruct us and booking your virtual consultation is easier.
§ 5
Frequently asked questions
Quite possibly. Article 25 of the AI Act moves a distributor, importer or deployer into the provider role in three situations: putting your own name or trade mark on a high-risk system already on the market, making a substantial modification to it, or changing its intended purpose so that it becomes high risk. Companies that build a product on top of a third party model routinely occupy that position without having identified it, and the original provider is then released from its obligations in respect of that system.
A structured file describing the system, its design, its development process, the data used to train and test it, the risk management system, performance metrics and post-market monitoring. It has to be kept up to date and available to the market surveillance authority for ten years. It is engineering documentation with legal consequences, which is why it is drafted with your technical team rather than for them.
Providers of high-risk systems must register themselves and their systems in the EU database before placing the system on the market or putting it into service, along with the EU declaration of conformity and the CE marking. Registration is a public act with reputational consequences, and it is not the stage at which to discover that the classification underpinning it does not hold.
From €12,000 + VAT, delivered within six weeks, at a fixed price agreed in the engagement letter before we begin. The figure reflects the weight of the provider obligations, which are the heaviest in the Regulation. The exact price depends on the number of systems and on how mature your existing technical documentation is.
It can help you assemble parts of the file, and many do it competently. What it cannot do is decide, with professional liability attached, whether you are a provider under article 25 and whether the system is high risk. Those two determinations govern everything else in the file, they are questions of legal interpretation, and a consultancy is in no position to sign them. If you want that question answered before committing, a 60 minute Virtual Consultation costs €90 (VAT included) and is deductible from the first invoice.
Email us at hola@passas.io, no strings attached, or fill in the form below and we will reply within 24 hours:
§ 6
Related articles
We know how much it matters that the lawyer you instruct has real command of the subject you are handing over. We have written on questions related to the service you are considering.
The AI Act's high-risk duties have moved to 2027 and 2028. The 2 August 2026 date has not. Which is which, and on what legal basis.
Points (ba) and (bb) prohibit the system, not the content. Article 5(1a) decides which providers are inside, and a general-purpose model can be.
The Digital Omnibus deferred one Article 50 obligation by four months. Companies reading it as a reprieve for the whole article have been late since August.
§ 7
Your lawyers
60 minutes on Google Meet with a qualified lawyer specialising in TechLaw, litigation or international law. €90 including VAT, deducted from the first invoice if we take on your matter. You leave with legal judgement and a fixed price for whatever comes next.
