Most firms under fifty people need all three at different moments: a tool to track obligations, a consultant to interpret the law for their case, and an AI workforce to do the recurring document work the Act creates. The mistake is buying one and expecting it to do the other two jobs.
Three different jobs. Read down a column to see what one option can and cannot carry on its own.
| Compliance software | Consultant | AI workforce | |
|---|---|---|---|
| What it is for | Recording obligations, deadlines and evidence in one register you can keep current. | Interpreting the Act for your specific case, your specific systems and your clients. | Doing the recurring document work: reading the files, cross-checking evidence, producing the registers, analyses and deliverables the process needs. |
| Buy it when | From day one, so the register is not assembled under pressure later. | When a classification decision or a client audit needs a defensible legal position. | When the work itself is the bottleneck, not the knowledge of what to do. |
| What it cannot do | Interpret a grey area, or decide what applies to your firm and your tools. | Execute. A report is not a register, and a recommendation is not a process. | Take a legal position. That stays with your qualified people. |
| What you pay for | A licence, usually per user. | Their time, ending in a document. | A plan for executed work rather than advice about it. Plans and credit-based usage are on the pricing page. |
| Failure mode | Bought, then never filled in. | Report delivered, nothing changes day to day. | Agents run without a methodology your firm defined, so the output is generic. |
| Time to value | Days. | Weeks, on their calendar rather than yours. | Short if your templates and methodology already exist, longer if they do not. |
The Act applies in phases, and the high-risk phase was deferred after the AI Omnibus entered into force on 27 July 2026. These are the dates as they stand now.
2 February 2025
Prohibited practices and the AI literacy duty (Article 4) began to apply. Literacy is the obligation most small firms already carry today.
2 August 2025
Obligations for providers of general-purpose AI models, together with the governance structure of the Act.
2 August 2026
Transparency duties for certain AI systems (Article 50), including telling people when they are interacting with an AI system and marking synthetic content. This date did not move.
2 December 2027
High-risk obligations for the sensitive areas listed in Annex III: biometrics, critical infrastructure, education, employment, and migration, asylum and border control. The AI Omnibus moved this from 2 August 2026.
2 August 2028
High-risk obligations for AI embedded in products already covered by EU product-safety law (Annex I).
For a consulting or advisory firm, the practical exposure today is the literacy duty, the transparency duty wherever AI touches client-facing work, and the evidence clients now ask for. The high-risk chapter is the one that creates sustained documentation work, and it now starts on 2 December 2027, which is either a breathing space or a year of preparation, depending on whether the register already exists.
A register of obligations that nobody fills in is not compliance. Tools organise the work; they do not do it.
The high-risk deadline has already moved once. A point-in-time report describes the law as it was on the day it was written, which is exactly why the recurring work of keeping evidence current matters more than the report itself.
Agents execute a methodology: they read your documents, run multi-step analysis and produce the registers, analyses and deliverables the process demands, with the source of every statement shown and gaps marked instead of filled in. They do not give legal opinions. When you need one, you need a lawyer.
you need a deadline tracker and one shared register, and you have someone who will actually keep it current.
you face a high-risk classification decision or a client audit and need a defensible legal interpretation. Do not improvise that one.
the work itself eats the hours your team does not have: reading files, cross-checking evidence, drafting the outputs.
Iedera is a multiagent platform that automates and delegates work. For AI Act work specifically, associates ingest your policies, evidence and vendor documents, work through a methodology your firm defines, and produce the tracking spreadsheets, analyses and deliverables the process requires.
You define the methodology and own the judgment. The workforce does the recurring work that keeps the register and its evidence current between reviews.
Yes, for high-risk systems. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred the Annex III high-risk obligations to 2 December 2027 and the Annex I obligations, for AI embedded in regulated products, to 2 August 2028. The prohibitions, the AI literacy duty, the obligations for general-purpose model providers and the Article 50 transparency duties kept their original dates.
In practice: the AI literacy duty, the transparency duties where AI touches client-facing work, and the evidence your clients now ask for about how their work was produced. The high-risk chapter applies from 2 December 2027, and it is the part that creates real documentation work, so the firms that start their evidence and registers now are the ones the deadline will not surprise.
The AI Act does not itself require a data protection officer; that obligation comes from the GDPR and depends on your processing. Counsel is worth the money for a high-risk classification call. What every firm needs regardless is an inventory of the AI systems it uses and the recurring work of keeping that inventory and its evidence current.
For tracking obligations, often yes. Software organises the work; it does not do it. The inventory, the evidence file and the vendor documentation still have to be read, cross-checked and written, and in a small firm that work lands on the same people who are already delivering client work.
It can do the execution: reading the documents, cross-referencing them, drafting the register and the analyses, and marking what the source material does not answer instead of guessing. It cannot take the legal position. The division that holds is that your firm owns the judgment and the system does the recurring work.
Ten questions, about three minutes, and a result you can read without giving an email address.
Run the free 10-point AI Act self-checkSources
Last reviewed: 17 October 2026. Every date above is taken from the Regulation and from the European Commission's own application timeline. This page carries no client data and no invented figures.
Pricing for the platform itself lives on the pricing page.