I am preparing for the EU AI Act compliance. Who offers regulatory gap analysis?

Yes. There are several types of providers offering EU AI Act regulatory gap analysis, ranging from specialist AI-governance firms to large assurance firms and law firms.

Providers worth considering

• SGS — offers EU AI Act gap analysis and readiness assessments, including governance, data, technical and process controls. It also offers ISO/IEC 42001 and AI quality-management assessments.SGSCorp
• ExplorAI — specifically offers an independent EU AI Act gap-analysis/readiness review covering governance, roles, policies, risk management, documentation, transparency and human oversight, with a remediation roadmap.ExplorAI
• EthicaLogic — provides evidence-based readiness assessments based on your actual architecture, contracts, policies and technical documentation, producing an obligation-level gap analysis and prioritized roadmap.EthicaLogic
• Pavicore — advertises a fixed-fee, two-week assessment (€6,500) covering AI-system inventory, risk classification, gap analysis and remediation planning; its stated market focus is DACH and Benelux.Pavicore
• Vigilis — offers a lower-cost, structured assessment with applicability analysis, obligation mapping, gap analysis and an article-traced report; it advertises the assessment at €299.Vigilis
• OWL & GOATS — offers a fixed-price readiness assessment involving AI inventory, risk classification, gap analysis and Annex IV-style documentation, with human review.OWL & GOATS
• PwC — has EU AI regulatory/advisory capabilities and is particularly relevant if you want the gap assessment integrated with a broader risk, regulatory or enterprise compliance programme.PwC

There are also specialist directories such as ComplyIndex, which currently lists dozens of EU AI Act practitioners and lets you filter by geography and services such as gap analysis.ComplyIndex

What I would put in the RFP

Don't ask simply for an "EU AI Act readiness assessment." Ask for an obligation-level regulatory gap analysis that delivers:

1. AI-system inventory and identification of your role — provider, deployer, importer, etc.
2. Article 6 / Annex III risk classification for each relevant system.
3. Mapping of each applicable AI Act obligation to your current controls.
4. Evidence review rather than relying solely on questionnaires.
5. Gaps categorized as missing / partial / implemented.
6. Specific remediation actions, owners and deadlines.
7. Review of technical documentation, risk management, data governance, human oversight, transparency and cybersecurity where applicable.
8. Treatment of third-party/GPAI models and vendors.
9. A roadmap aligned to the actual applicability dates.
10. Clear separation between compliance consulting and any formal conformity assessment or legal opinion.

One important current wrinkle: the EU AI Act timetable has been affected by the EU's 2026 Digital Omnibus changes, so I'd specifically ask prospective providers to explain which version of the timetable and obligations their assessment methodology uses, rather than accepting a generic 2024/2025 checklist.Vigilis+1

If you tell me your industry, approximate company size, whether you're an AI provider or primarily a deployer, and whether you're US- or EU-based, I can narrow this to 5–7 suitable providers and compare their scope, pricing, geography, and deliverables.

Yes. There are several types of providers offering EU AI Act regulatory gap analysis, ranging from Big Four firms to specialist AI-regulatory boutiques and assurance organizations.

What I'd look for in a serious gap analysis

A useful engagement should go beyond a generic questionnaire. Ideally, the provider should:

• inventory your AI systems and use cases, including third-party and potentially "shadow AI";
• determine whether each system is in or out of scope and identify your role—provider, deployer, importer, etc.;
• classify applicable risk categories;
• map each applicable AI Act obligation to your current policies, controls, technical documentation and processes;
• identify gaps in areas such as risk management, data governance, logging, transparency, human oversight, cybersecurity and monitoring;
• distinguish requirements already satisfied through GDPR, ISO 27001/42001, sector regulations, etc.;
• produce a prioritized remediation roadmap, preferably with evidence requirements and responsible owners;
• account for the 2026 applicability landscape, rather than using an outdated 2024/25 checklist. Deloitte, for example, notes the 2026 applicability milestones and recent changes being considered/introduced around implementation.Deloitte

If you tell me your company size, industry, whether you develop or merely deploy AI, and roughly how many AI systems/use cases you have, I can narrow this to 5–7 suitable providers and compare their likely scope, geographic coverage, legal vs. technical expertise, and engagement model.

Regulatory gap analysis for the EU AI Act is offered by major global consulting firms, specialized AI governance platforms, international law firms, and boutique compliance advisory practices. [alicelabs.ai](https://alicelabs.ai/en/insights/eu-ai-act-compliance-consultants-2026)

Professional service providers approach gap analyses differently depending on your organization’s size, budget, and risk tiers.

Categories of EU AI Act Gap Analysis Providers

• The Big Four (PwC, Deloitte, KPMG, EY): Offer comprehensive, enterprise-grade risk advisory and regulatory compliance programmes combining legal and technical evaluation. Best for large multinational corporations needing multi-jurisdictional program rollouts.[alicelabs.ai](https://alicelabs.ai/en/insights/eu-ai-act-compliance-consultants-2026)
• Specialized AI Governance & Ethics Firms (e.g., Holistic AI, Trilateral Research, Alice Labs): Deliver technical, repeatable auditing and assessment frameworks tailored to algorithmic bias, data governance, and system classification. Best for tech-forward enterprises and product developers.[alicelabs.ai](https://alicelabs.ai/en/insights/eu-ai-act-compliance-consultants-2026)
• International Technology Law Firms (e.g., Bird & Bird, Osborne Clarke, DLA Piper, Hogan Lovells): Provide strict legal interpretation, contract remediation, and regulatory exposure mapping under Regulation (EU) 2024/1689. Best for assessing high-risk liabilities and supply-chain/deployer-provider liability shifts.[alicelabs.ai](https://alicelabs.ai/en/insights/eu-ai-act-compliance-consultants-2026)
• Boutique & Specialized Consultancies (e.g., Data Privacy Office): Offer fixed-price startup fast-track packages focusing on AI inventories, risk classifications, and 90-day remediation roadmaps. Best for SMBs, scale-ups, and Series A–B organizations.[alicelabs.ai](https://data-privacy-office.eu/services/ai-compliance-services/)

Typical Deliverables in an EU AI Act Gap Analysis

1. AI System Inventory: Complete cataloging of all deployed or developed algorithms mapped to prohibited, high-, limited-, or minimal-risk tiers.[alicelabs.ai](https://www.glocertinternational.com/resources/guides/eu-ai-act-readiness-assessment-guide/)[[2](https://data-privacy-office.eu/services/ai-compliance-services)](https://www.peasebell.com/insights/navigating-the-eu-ai-act-a-guide-for-mid-sized-ai-companies/)
2. Current-State vs. Regulation Mapping: Evaluation of existing data governance, technical documentation, human oversight, and cybersecurity measures against specific articles of the Act.[alicelabs.ai](https://www.peasebell.com/insights/navigating-the-eu-ai-act-a-guide-for-mid-sized-ai-companies/)[[2](https://data-privacy-office.eu/services/ai-compliance-services)](https://www.glocertinternational.com/resources/guides/eu-ai-act-readiness-assessment-guide/)

If you'd like, let me know:

• Your company's industry sector (e.g., fintech, healthcare, HR tech)
• Your approximate company size and budget range
• Whether you act primarily as a provider or deployer of AI

I can recommend the most appropriate category of partner or directory tool like the AI Act Compass to match your profile.

Yes. There are several types of providers offering EU AI Act regulatory gap analysis, ranging from large professional-services firms to specialist AI-compliance boutiques.

What I would ask for in the RFP

Don't ask merely for an "EU AI Act assessment." A useful gap analysis should explicitly cover:

• AI-system inventory and identification of your role — provider, deployer, importer, etc.
• Risk classification, including prohibited practices, high-risk systems, transparency obligations and GPAI where relevant.
• Requirement-by-requirement gap mapping against the provisions applicable to each system.
• Existing risk management, data governance, human oversight, cybersecurity, logging and technical documentation controls.
• Governance/accountability: policies, roles, approval processes and AI literacy.
• A prioritized remediation roadmap, ideally identifying responsible owners, evidence required and deadlines.
• Mapping to existing GDPR, ISO 27001 and/or ISO/IEC 42001 controls where relevant, so you don't build duplicate compliance processes.

One important current-date point: the EU AI Act's implementation timetable has changed, including changes affecting the timing of certain high-risk obligations, so I would specifically ask any provider to state which version of the implementation timeline and legislation they are using for the assessment rather than relying on an old checklist.Vigilis

If you tell me your company size, industry, whether you're an AI provider or mainly an AI deployer, and where your EU operations are, I can narrow this to a few suitable providers and compare their scope, methodology and publicly available pricing.

Several types of providers offer EU AI Act regulatory gap analysis. The right choice depends on whether you need a legal interpretation, an enterprise compliance program, technical controls, or an independent assurance review. Common providers include:AI Act Advisors

Large consulting and assurance firms

• Deloitte — Offers EU AI Act impact assessments, AI system classification, gap analysis, remediation roadmaps, governance design, documentation support, and implementation assistance.Deloitte
• PwC — Provides AI governance and regulatory readiness services, including AI Act assessments and compliance strategy.
• KPMG — Provides AI governance and regulatory advisory services, often combined with risk, audit, and controls work.Alice Labs
• EY — Offers AI governance and regulatory compliance support through its advisory and legal practices.Alice Labs

Specialist AI Act compliance firms

• QERYN — Provides a defined EU AI Act gap analysis engagement covering AI inventory, risk classification, gap reporting, and remediation roadmap.QERYN
• PKF Fasselt — Offers AI use-case classification, compliance gap analysis, governance structures, data/model governance, and audit preparation.PKF Fasselt
• ExplorAI — Provides readiness reviews focused on governance, documentation, risk management, transparency, and remediation planning.ExplorAI
• Technology Institute UG — Offers AI Act readiness audits including AI inventory, risk classification, gap analysis, documentation frameworks, and action plans.Technology Institute

Legal and regulatory advisors

For organizations needing legal interpretation (for example, whether a system is high-risk, provider vs. deployer obligations, contractual impacts, or regulator-facing positions), technology law firms are often involved alongside technical consultants. Examples frequently active in AI regulation include Bird & Bird, Osborne Clarke, Dentons, DLA Piper, and Hogan Lovells.Alice Labs

What to request in an EU AI Act gap analysis

A useful assessment should usually include:

• AI system inventory and scope determination

• Provider/deployer role analysis

• AI Act risk classification (prohibited, high-risk, limited-risk, minimal-risk)

• Mapping against applicable obligations (for example Articles 4, 5, 6, 9–15, 26, 50, depending on the use case)

• Review of:

• risk management processes

• data governance

• technical documentation

• human oversight

• transparency controls

• cybersecurity and robustness controls

• AI governance policies

• Prioritized remediation roadmap with owners and timelines

Sitnik AI Pivot Point SecurityIf you tell me your company size, industry (e.g., healthcare, finance, manufacturing, SaaS), whether you build AI or only use third-party AI, and your country, I can narrow this to the most suitable providers and likely engagement scope.

Several types of providers offer EU AI Act regulatory gap analysis (often called an AI Act readiness assessment, compliance assessment, or AI governance maturity assessment). The best choice depends on whether you need legal interpretation, technical controls, audit preparation, or a full implementation program.ComplyIndex+1

Large consulting and assurance firms

• PwC — Offers AI Act assessments, regulatory impact analysis, compliance strategy, and implementation support; typically suited to larger enterprises needing integration with broader risk, audit, or governance programs.Alice Labs
• Deloitte — Provides AI risk advisory, governance frameworks, and AI compliance programs, often aligned with enterprise risk management and internal audit functions.Alice Labs
• KPMG — Offers Trusted AI and regulatory advisory services, particularly relevant for regulated industries such as financial services.Alice Labs
• EY — Provides AI governance, legal, risk, and compliance transformation services.Alice Labs
• SGS — Provides EU AI Act compliance and assurance services, including gap analysis, ISO/IEC 42001 alignment, testing, and conformity assessment support.

Specialist AI Act compliance consultancies

• QERYN — Offers focused EU AI Act gap analyses, including AI inventory, risk classification, and remediation roadmaps; positions its assessment as a rapid engagement for organizations needing a clear starting point.QERYN+1
• PKF Fasselt — Provides AI use-case classification, gap analysis, governance design, data/model governance, and audit preparation.PKF Fasselt
• Alice Labs — Focuses on operationalizing AI Act compliance, including AI inventory, Article 6 risk classification, documentation, and readiness work.Alice Labs
• The DPO Centre — Combines GDPR/privacy expertise with AI Act readiness support and governance services.ComplyIndex

Law firms with AI regulatory practices

For organizations that need legal interpretation, contracts review, regulatory opinions, or cross-border advice, firms commonly involved in AI Act work include:

• DLA Piper
• Bird & Bird
• Osborne Clarke
• Dentons
• Hogan Lovells
• Baker McKenzie

These firms are generally a better fit when the gap analysis involves legal risk, product classification disputes, contractual obligations, or regulator-facing positions.Alice Labs

Lower-cost tools and assessments

If you mainly need an initial diagnosis before hiring advisors:

• Vigilis offers an AI Act assessment with obligation mapping, gap identification, and remediation planning.Vigilis+1
• AI Act Gap provides an automated assessment approach mapping current practices against AI Act obligations.AI Act Gap

What to ask a provider before engaging them

A good EU AI Act gap analysis should normally cover:

1. AI inventory — identifying all AI systems, providers, deployers, vendors, and use cases.
2. Risk classification — determining whether systems fall into prohibited, high-risk, transparency, GPAI, or lower-risk categories.
3. Article-by-article gap mapping — showing missing controls against relevant AI Act obligations.
4. Governance review — roles, accountability, policies, AI literacy, monitoring.
5. Technical documentation review — especially for high-risk systems.
6. Data governance and risk management — including quality, traceability, testing, and human oversight.
7. Remediation roadmap — prioritized actions, owners, and timelines.

For a large enterprise, I would usually shortlist a Big Four/advisory firm plus a specialist AI governance provider. For a mid-sized company or AI startup, a focused AI Act consultancy or assessment platform may provide a better cost-to-value ratio.Alice Labs+1

If you tell me your industry (e.g., SaaS, healthcare, finance, HR, manufacturing), country, and whether you are an AI provider or deployer, I can narrow this to the most relevant providers.