Check the amended timeline
The July 2026 AI Omnibus is now in force. The Commission identifies 2 December 2027 for the Annex III high-risk rules and 2 August 2028 for high-risk systems embedded in Annex I products. Do not use the original August 2026 high-risk timetable without checking the amendment.
Keep a dated record of the system, obligation, source provision, and applicable transition. A web page’s update date is not a substitute for the date a provision begins to apply.
Determine the firm’s role and scope
Assess territorial scope, the actual system, and its intended use. A firm using a system under its authority may be a deployer; different activities can engage different roles and obligations.
Do not describe every high-risk deployer duty as an obligation of every firm using drafting assistance. Record the legal basis for the duties selected for the particular deployment.
Separate provider and deployer questions
Buying a service, developing a client-facing tool, and changing a system’s intended purpose raise different questions. Obtain the vendor’s intended-purpose documentation and explain what the firm actually plans to do.
If a team builds or substantially modifies a tool, have the role analysis reviewed before launch. A contractual label alone does not establish the regulatory role.
Use the amended AI literacy provision
The Omnibus simplified the earlier AI literacy requirement and strengthened the supporting role of the Commission and member states. Use the amended Article 4 text when updating a policy.
Practical exercises on source checking, approved uploads, and escalation can support responsible use. Our suggested training records are governance recommendations, not a claim that the Act prescribes a particular course, certificate, or guaranteed individual literacy level.
Assess the actual use before assigning a risk tier
Review the intended purpose and relevant Annex entry. Ordinary lawyer-facing research and drafting assistance should not be equated automatically with systems used by or on behalf of judicial authorities in administering justice.
A law firm may also use AI in employment or other activities. Assess those uses separately rather than giving the whole organisation one risk label.
Keep the privacy assessment distinct
The AI Act does not replace GDPR analysis. Identify the documents and personal data, processing roles, purposes, applicable basis, transfers, retention, and safeguards for the proposed service.
Connect the legal assessment to the purchased configuration and contractual commitments. EU hosting alone does not establish compliance, and a vendor’s assurance report does not decide whether the firm’s processing is lawful.
Prepare a reproducible advisory record
Give another lawyer enough information to reproduce the assessment: the use description, sources, versions, reasoning, and unresolved facts. Distinguish adopted rules from guidance, consultations, and proposed measures.
If a source or deployment changes, identify which conclusions require review. Reusing an inventory format can save administration, but the legal analysis must fit the client and its actual use.
Apply a practical review checklist
Inventory the tools; define intended uses; assess scope, role, and risk tier; identify applicable obligations; review the vendor evidence; and assign owners for approval and ongoing changes.
For a pilot, specify the permitted data and tasks, review criteria, escalation path, and stopping conditions. A polished demonstration should not be treated as proof that the control works on every matter.
Evaluate Judicio against the same criteria
Use Judicio’s research, document review, and shared workspace to test source verification and professional review. Check the methodology and security pages, request the relevant evidence, and confirm the configuration and availability needed for the proposed use.
Judicio does not certify the firm’s AI Act or GDPR compliance. Keep the approval decision with the responsible legal, privacy, and technical reviewers.
Primary sources: Regulation (EU) 2026/1744; Commission announcement; GDPR. Continue with the Article 4 guide, EU coverage page, and security evidence.