For 20 years in B2B, I listened to what businesses actually need. Now I help them keep up with change.

What I can help with

1. Gap analysis — A structured look at where you stand against the law that applies to you, based on a questionnaire and evidence review (M365/Google Admin exports, backup reports) — summed up in a gap matrix for your management team.
2. Technical implementation — MFA, encryption, access management, tested backups and monitoring — built with the same automation stack (n8n and friends) I already use for client integrations.
3. Documentation — Security policies, business continuity plan and incident response procedures, written so your team can actually follow them.
4. Training — Sessions for management (this is where personal liability sits) and staff, in plain language.

Who this actually affects

• Directly in scope: companies with 50+ employees or €10M+ in annual turnover / balance sheet.
• Always in scope regardless of size: telecom network operators, trust service providers, DNS/TLD registries and critical infrastructure operators.

Under 50 people and under €10M? You're not directly covered — but if your clients are, they'll increasingly ask their IT, AI and logistics suppliers to prove compliance as part of the contract. Getting ahead of that is worth it.

What I can help with

1. AI usage mapping — A structured inventory of which AI tools are actually in use across your company, by whom, for what, and what data flows through them — the starting point before any policy makes sense.
2. AI usage policy — A written policy scoped to your actual usage: what's allowed in public AI tools, who checks outputs before they go out, what to do when the AI gets it wrong — documented so it holds up, not filed away and forgotten.
3. Training — Sessions for staff and management on safe, practical AI use — the core of what Article 4 actually requires, in plain language, not a generic certificate course.
4. Ongoing monitoring — AI usage changes fast — new tools, new use cases. I help keep the policy and the inventory current as it grows, so it doesn't quietly go stale.

Who this actually affects

• Every company using AI tools — ChatGPT, Claude, AI-powered marketing or support automations — not just the companies that build them. If someone at your company uses one, you're a "deployer" under the Act.
• Higher-risk AI (recruitment screening, credit scoring, biometric systems) carries extra obligations under Article 26 onward — human oversight, monitoring, incident reporting. Most everyday business tools don't fall into this category.

The Article 4 obligation already applies, since February 2025 — it doesn't wait for a national law to be finished.