Services · AI regulatory compliance
Technical and organisational consultancy on Regulation (EU) 2024/1689: we inventory the AI systems your organisation uses, classify them by risk and set up the documentation, internal policies and training the law requires. It is not legal advice and does not replace a lawyer: it is the engineering and procedural work a law firm does not build.
What we cover
We have been building and running AI software in production from day one. We know what is inside each tool, which model drives it, what data it touches and what records it leaves. Compliance rests on that, not on filling in a template.
Every engagement starts with the inventory, because nothing can be classified without knowing which systems exist. It ends with material your team can maintain without us.
We locate every AI system in the organisation, including those that arrived without going through IT. For each one we record the model provider, its purpose, the data it handles, your company's role (provider or deployer) and a preliminary risk level.
A short, readable rulebook on what may and may not be done with AI: approved tools, data that never gets pasted into a chat, when human review is mandatory and who answers for each decision. Written to be read by everyone, not to be filed away.
We put in writing what you have to be able to show: architecture, providers, purpose, input data, known limits, tests carried out and a version log. In a living format, updated whenever the system changes.
Your staff take our ALF-01 course on GestCampus: 8 hours, 8 units and a final test, with the record of who, how long and with what score that the European Commission considers sufficient for Article 4. Each person receives a verifiable certificate; the company, the group report for its file.
We review the interfaces, wording and outputs of each system so that people know they are talking to an AI or reading AI-generated content: on-screen notices, content marking and API response fields.
How far we go. Our work is technical and procedural. Binding legal opinions and representation before the AESIA are signed by a lawyer, not by us: we hand over the inventory, the technical documentation and the evidence. They build their view from there. If you do not have a firm yet, look for one with a practice in data protection and digital law.
How we do it
Every engagement starts with the inventory and ends with a dated file your team can maintain without us.
One hour with whoever is in charge and with the people who use the tools. We ask about tools, not about “artificial intelligence”: that is how the ones nobody knew were in use come to light.
We draw up the table of AI systems: provider, what it is used for, what data it touches, your company's role and preliminary risk. Whatever cannot be confirmed is marked “pending”, never guessed.
Two or three pages your staff read and sign: approved tools, data that goes into none of them, when a person reviews, who is accountable and how an incident is reported.
We review chatbots, generated documents and APIs. Wherever the Article 50 notice is missing it gets added; the file records whose obligation it was for each system.
Your staff take the ALF-01 course on GestCampus: 8 hours, 8 units and a final test. The platform records who, how long and with what score; each person receives their certificate.
We hand over the dated folder with everything above and a scheduled review, yearly or whenever a tool changes. This is the part that repeats: an AI inventory ages in months.
What you keep
Documents you can show, not a consultancy report that gets filed away. Here are three of them, with fictitious data; you will see the rest at the interview.
A living table with every system: provider, use, data it touches, your company's role and preliminary risk. It is the basis for everything else and the first thing an authority would ask for.
The short, readable internal rulebook your staff sign. Approved tools, data that goes into none of them, mandatory human review, decisions about people and incidents.
One certificate per person, with a code verifiable online and signed by Pedro Mulero as course tutor. For the company, the group report with hours, scores and codes: the evidence for Article 4.
Also: the review of transparency notices (Article 50), technical documentation for the systems you run under your own brand and the complete file, dated. The documents in the images are examples in Spanish with fictitious data.
Quote
There is no flat rate, on purpose: a micro-business with three tools does not cost the same as a 200-person company with a recruitment system. What drives the price is how many systems need inventorying, how many interviews are needed, whether there is any high-risk use, whether you also sell something with AI inside under your own brand, how many people need training and whether you want the periodic review. After the first conversation we have enough to send you a fixed-price proposal.
Contact
Tell us in your message which AI tools you use and what for. With that we can tell you whether the engagement makes sense, what would be needed and how much work it is. A person from the team replies, with no obligation.
This service is operational and technical consultancy on AI compliance. It does not constitute legal advice and does not replace the intervention of a qualified lawyer.
The regulatory references on this page are to Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence. Its text and its application timetable prevail over any summary published here.
