AI Act: compliance audit for SMBs in 3 weeks

Context

The European AI regulation (AI Act) has required a minimum level of AI literacy for affected staff since February 2025. National sanctions apply from 2 August 2026, up to 7% of global turnover for prohibited practices.

Most SMBs I meet already have AI systems in production without knowing it: Copilot in Microsoft 365, Bedrock agents in a customer application, ChatGPT as shadow IT in marketing teams, RAG on internal databases, Zapier automations with OpenAI behind them.

No inventory. No classification. No documentation. That’s the gap this audit fills.

Who it’s for

• One or more AI systems in production (chatbot, RAG, agent, classification, scoring)
• Unmapped AI shadow IT (ChatGPT, Claude, Copilot, Gemini)
• Bedrock, SageMaker, Azure OpenAI or a self-hosted LLM
• An upcoming ISO 27001, SOC2 or DORA audit with an AI component
• Customers or investors asking for proof of AI Act compliance

What’s delivered

Week 1 — Inventory

• Inventory of AI systems in production (internal and third-party SaaS)
• AI shadow IT detection via IAM review, invocation logs, cloud and SaaS invoices, and interviews
• Mapping of data flows in and out of the models
• Identification of sensitive data (PII, health, HR, financial) processed by AI

Week 2 — Classification and risks

• Classification of each system against the 4 AI Act levels (prohibited, high risk, limited risk, minimal risk)
• AI platform security review: IAM, Guardrails, private endpoints, encryption, logging
• Audit of prompts, fine-tuning and training data sources
• Gap identification against Articles 4, 9, 10, 13, 14 and 50

Week 3 — Documentation and action plan

• Article 4-compliant AI Act register (audit-ready formats)
• Technical documentation of high-risk systems
• Costed and prioritised 30/60/90-day action plan
• Recommendations on team training (Article 4)
• Optional scoping of a switch to sovereign Mistral or self-hosted

What’s not included

• The team training itself (referral to a partner training organisation)
• Implementation follow-up (covered by the security retainer)
• Legal advice on system qualification (to be settled with your tech lawyer or DPO)
• In-depth technical security audit of the AI platform (prompt injection, RAG, agents), covered by the AI & Bedrock Security Audit

Format and timeline

Fixed price set after a 15-minute scoping call, 3 weeks from kick-off to deliverable. The regulatory risk is documented regardless, even if the audit reveals no significant gap.

Why Distribuée

6 AWS certifications including 3 Professional/Specialty (Solutions Architect Pro, DevOps Pro, Security Specialty), Generative AI Developer Professional in progress. Senior DevSecOps. Distribuée brings CAC40-grade expertise on sensitive cloud and AI topics, without the overhead of a large consultancy.