EU AI Act consultancy
- Engagements run in three phases: inventory and classify, build, then monitor.
- Price per system rather than per programme. That is how the work actually scales and it makes proposals comparable.
- Agree in writing who owns the classification decision. It is the one judgement that carries real consequence.
- Ask what happens when a system changes materially, because the technical file has to follow it.
- The monitoring phase is a standing arrangement, not an optional extra. Decide it deliberately.
How the engagement works
An EU AI Act consultancy engagement is a defined piece of professional work with phases, deliverables and terms. The difficulties in these engagements are rarely technical. They are usually about scope that was never written down per system, or a classification decision nobody agreed to own.
This guide covers how the engagement is structured. What the services consist of is in EU AI Act consultancy services.
The three phases
Phase one: inventory and classify. Usually two to six weeks. The firm builds the inventory, determines your role and the risk tier for each system, and records the reasoning. The output is a classification register you can defend. This phase should be priced separately and should be useful on its own whether or not you continue.
Phase two: build. Length depends entirely on how many high-risk systems the classification produced. Technical files written, risk management established, human oversight designed, logging configured, Article 50 disclosures put in place.
Phase three: monitor. Post-market monitoring, incident reporting readiness, and keeping the files current. This runs for the life of the systems.
Our own engagements follow the same three stages, described as scope, build and assure on the about page.
Fee models
| Model | How it works | Best when |
|---|---|---|
| Fixed fee per phase | Each phase priced separately with a decision point between | Most companies. You learn your classification before committing to a build |
| Fixed fee per system | Priced per system, with high-risk systems priced separately | A large or uneven estate, where a single programme number hides the real driver |
| Day rate | £700 to £1,600 a day against an estimate | You have an internal owner and need judgement at specific points |
| Retainer | Monthly fee covering ongoing monitoring and change | Once systems are in production and the files must stay current |
Per-phase pricing is usually the better arrangement for a first engagement, because you cannot sensibly price the build until the classification is done. A firm that quotes a single number for the whole programme before seeing your inventory is estimating blind, and that estimate will move.
Who owns the classification decision
This is the term worth settling most carefully, and it is frequently left vague.
Classification is a legal judgement with real consequence. Getting it wrong in one direction produces obligations you did not owe. In the other, it produces a gap that surfaces when a customer, an investor or an authority asks.
A well-structured engagement states the position clearly: the firm sets out the analysis, the reasoning and the recommendation; your organisation records the decision. That is how the responsibility sits in every other regulatory context, and it is defensible in a way that "our consultant said it was fine" is not.
Where the classification is genuinely uncertain, the file should record the uncertainty and the basis for the decision taken, rather than presenting a marginal call as settled.
Terms worth settling before you sign
What triggers a change of fee. New systems, a system moving into a higher tier on reassessment, expansion into an EU market you were not previously in.
What happens when a system changes materially. Retraining a model, changing its purpose or altering its outputs can require the technical file to be updated and, in some cases, a fresh conformity assessment. Ask whether that is inside the fee or a new engagement.
Who owns the documentation. Your inventory, classification register and technical files should be yours, in your systems, at the end.
Whether monitoring is included, optional or absent. The Act has no completion point. A firm whose engagement ends at the technical file leaves the standing duties with you, which may be fine, but you should choose it rather than discover it.
Independence. Ask whether the firm takes commission from any certification body, notified body or platform vendor. We take none, which is stated on our about page.
What good delivery looks like
A classification register that records reasoning, not just conclusions. A weekly written update naming what moved and what is outstanding. A named practitioner with committed hours rather than a rotating team. And a firm that tells you when a system is genuinely borderline instead of asserting a clean answer.
If your adviser has never said "this one is arguable, and here is why we are taking this position", either your estate is unusually simple or the analysis is thinner than it looks.
When the engagement should end
Two reasonable endpoints, and the choice is yours.
At the build, if your systems are stable and someone internal will own monitoring and file upkeep.
Continuing, if models are retrained regularly, new systems arrive, or nobody internal is watching for the changes that make a technical file inaccurate. That continuing work is our continuous governance and assurance service.
What to do next
Build a first-pass inventory before you approach anyone. Even a rough list makes proposals comparable, because the cost driver is system count and no firm can quote sensibly without it.
Our free AI impact assessment gives a starting view, and the EU AI Act service page sets out how our engagements are structured.
References
FAQ
How is an EU AI Act consultancy engagement structured?
Three phases: inventory and classification, build, then ongoing monitoring. Each should be priced separately with a decision point between.
Should the fee be per programme or per system?
Per system, or at least itemised by system. System count and high-risk count are the real cost drivers, and a single programme number hides both.
Who is responsible for the classification?
Your organisation records the decision. A good adviser provides the analysis, the reasoning and the recommendation, and documents any genuine uncertainty.
What happens if we change a model after the file is written?
A material change can require the technical file to be updated. Agree in advance whether that sits inside the fee or is a new engagement.
Do we need ongoing support?
If models are retrained, systems are added, or nobody internal is monitoring for change, yes. If the estate is stable and owned internally, not necessarily.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance, built on fifteen years of regulatory practice. Every engagement has a named practitioner and an agreed scope, timetable and fee, and runs to three stages: scope, build and assure. We are not a certification body and we take no commission from certification bodies or platform vendors. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on FCA authorisation and compliance since 2013.
This guide is general information and is not legal advice on your particular circumstances.