Legal advice alone
Sound legal judgement, but no stack changes or technical evidence
AI in production now has a deadline. The next cut-off is 2 December 2026.
Technical study for companies already running AI: what the EU AI Act requires and when, what can be resolved in the stack and what needs legal validation. Globodain inventories systems, implements controls and produces auditable evidence; it does not certify compliance or replace legal advice.
Technical case study
The thesis
The EU AI Act is not solved with a policy PDF: it is solved in the stack, with inventory, controls and evidence. Whatever cannot be adjusted is withdrawn in time.
Globodain | technical study
Act calendar
The clock is already running, and the next deadline is 2 December.
Official dates. 2 Dec 2026 closes transparency and new bans; Annex III high-risk arrives on 2 Dec 2027.
1 Aug 2024
Entry into force
The regulatory clock starts; obligations switch on in stages.
AI Act Service Desk
2 Feb 2025
Literacy and bans
AI literacy (Art. 4) and prohibited practices become enforceable.
AI Act Service Desk
2 Aug 2026
Most rules + Art. 50
Transparency, penalties regime and rules for general-purpose models.
AI Act Service Desk
2 Dec 2026
Art. 50(2) and new bans
Marking of in-market synthetic content and bans on non-consensual sexual deepfakes / CSAM.
AI Act Service Desk
2 Dec 2027
Annex III high-risk
High-risk systems in employment, credit, biometrics and essential services.
EU Council
2 Aug 2028
High-risk in products
Systems embedded in Annex I regulated products.
AI Act Service Desk
The challenge
AI is already in production and the inventory is not.
Where this profile is exposed today
- 01No reliable inventory of what counts as an AI system
- 02Chatbots and synthetic content without transparency notices
- 03Training data and logs without auditable traceability
- 04Undetected high-risk use in HR, credit or scoring
- 05Several model vendors and no single technical owner
- 06Product absorbs compliance at the expense of the roadmap
What they ask
Clients, auditors and procurement already ask the same things.
The question that comes up in every due diligence, its legal basis and the technical deliverable Globodain prepares.
What they ask
Legal basis
What we deliver
01Do you disclose AI or synthetic content?
Art. 50 | transparency
What we deliver |Notices, marking and detection built into the product
02Who owns each system?
Inventory + provider/deployer roles
What we deliver |Map of systems, vendors and internal owners
03Is there minimum AI literacy?
Art. 4 | literacy
What we deliver |Matrix of who operates each system and what they must know
04Could it be high-risk?
Annex III | 2027 deadlines
What we deliver |Preliminary classification and a dated evidence plan
05Is data governed?
GDPR + AI Act technical duties
What we deliver |Traceability, access and minimisation in the stack
The market
The risk has a price tag and most approaches cover half of it.
Maximum fines under Art. 99 (the higher amount applies; for SMEs, the lower) and the approaches competing for the same budget today.
7 %
of global turnover or €35M for prohibited practices
EUR-Lex | AI Act Art. 99
3 %
or €15M for breaching other duties, transparency included
EUR-Lex | AI Act Art. 99
1 %
or €7.5M for supplying incorrect information to authorities
EUR-Lex | AI Act Art. 99
Common approaches and their blind spot
Generic GRC suite
Questionnaires and policies with little link to code and models
Big Four compliance pack
Long project, many teams, little continuous delivery
Governance SaaS
Model registry; implementation still falls on the internal team
Hyperscaler + checklist
Platform controls that do not cover your inventory or Art. 50 duties
Ad hoc internal team
Engineering absorbs compliance between sprints, with no method or calendar
Documenting without touching systems builds regulatory debt. The edge goes to teams that inventory, adapt and evidence in the same cycle.
What we propose
One technology partner from inventory to evidence.
Globodain turns the Act into concrete stack changes and evidence that legal, clients and auditors can read.
Leadership
Priority by risk and deadline
Which systems to tackle before 2 Dec 2026 and which to plan for 2027.
Product
Comply without stalling
Notices, logging and governance built into the development cycle.
Legal / compliance
Auditable evidence
Traceable material that supports legal judgement without replacing it.
Scope and limits
What we solve in technology and what stays with legal.
What we do
- Technical inventory of AI systems with prioritised, dated gaps
- Stack implementation: transparency, logging, access and governance
- Auditable evidence so legal or audit can close their work
Where technical adjustment ends
- We do not certify that a system meets the EU AI Act
- We do not issue seals, legal opinions or legal advice
- Not every existing system can be adapted without redesign or withdrawal
Adapting systems to the EU AI Act is technical work with limits. Prohibited uses are not «fixed»: they are withdrawn. High-risk duties may require redesign. Globodain delivers the engineering; legal conformity is validated by authorised counsel.
Methodology
A continuous cycle, synced with the Act milestones.
Each iteration delivers an updated inventory, closed gaps and priorities for the next deadline.
Phase 01
Diagnosis
Real AI use, vendors, data, notices and possible high-risk cases.
Phase 02
Inventory and risk
Risk-level classification and a gap backlog with owners and dates.
Phase 03
Implementation
Transparency, logging, access and controls, alongside your team.
Phase 04
Watch
Ongoing follow-through to Annex III (2027) and regulated products (2028).
Expected impact
More systems under control with the same team.
When inventory, transparency and watch stop competing with the product roadmap.
×1.9
systems with evidence by period end, versus running without a partner
−28 pts
of engineering capacity returned to product
6 → 1
technical fronts, one owner
Illustrative scenario, not a forecast. Index 100 = systems with minimum evidence at start. Assumption: freed time returns to product.
Benefits
What this profile gains before each deadline.
Three ways to tackle it
| Internal team only | Several vendors | Globodain as partner | |
|---|---|---|---|
| Time to start | When there is slack | Weeks per area | From diagnosis |
| Stack changes | If time allows | Out of scope | Included |
| Owners | One, overloaded | One per front | One for everything |
| Deadline view | Partial | Fragmented | One calendar |
| Evidence | Loose folders | Disconnected reports | One report |
Why Globodain
Applied engineering for teams already running AI.
Scope note: we describe applicable capabilities, not a certification or an accredited track record as an AI Act auditor.
- 01
Orbit diagnosis
Art. 4, Art. 50 and Annex III mapped onto real use.
- 02
Technical audit
Stack, data, integrations and model surface.
- 03
Implementation
Notices, logging, access and governance, without replacing your team.
- 04
Cybersecurity
Controls on systems that already handle sensitive data.
- 05
Data and GDPR
Traceability aligned with privacy and the AI Act.
- 06
Watch
Early warning when a regulatory milestone moves the roadmap.
Does your case look like this profile? Let's review it before 2 December.
Rubén Ayuso reviews with you which AI systems are exposed, which deadline applies and what can be resolved in the stack. Technical adjustment does not replace legal advice.
Technical study by Globodain built from public sources on the sector. It does not certify EU AI Act compliance, does not describe a specific company and was not prepared with one. Figures and scenarios are indicative.
