New AI Act: Checklist for Consultants and Consulting Firms

On February 2, 2025, the first parts of the EU AI Act began to apply across the EU. The legislation focuses on regulating the responsible and safe management of AI systems throughout their entire lifecycle. Will it impact how consultants work, which tools are used, and the risk exposure in client projects?

What does the AI Act entail?

The AI Act is fundamentally a product safety legislation aimed at protecting the lives, health, and fundamental rights of EU citizens. Just as we require certification for vehicles and pharmaceuticals, extensive documentation requirements and CE marking are being introduced for AI systems classified as high-risk. Some AI systems have even been completely banned as of February 2, 2025.

For chatbots and deepfakes, rules will gradually be implemented requiring transparency about AI interaction. However, many applications will fall under the lowest risk level, where the only requirement is ensuring that users have sufficient knowledge for safe usage. The regulation is part of the EU’s efforts to regulate and promote digitalization in the long term.

How does the AI Act impact the consulting industry?

• New requirements for advice and regulatory compliance

For consulting firms working with advisory services, it is important to acquire knowledge about the AI Act and ensure that regulatory compliance is part of the agenda for client projects. Applications and uses classified as high-risk according to the AI Act will face extensive documentation requirements and even CE marking. Examples of areas where the issue of high risk is relevant include recruitment, credit assessments, critical infrastructure, and decisions within public administration.

As a consultant, you must have sufficient expertise to identify and highlight legal issues that need further investigation. It is also crucial to help clients understand which decisions could shift a proposed solution from low-risk to high-risk, so they can make informed choices. There are significant opportunities to truly make a difference for the client!

Regarding the development of AI systems classified as high-risk, the AI Act includes a long list of requirements for risk management, data handling, transparency, cybersecurity, etc. All measures need to be documented, and certain information must be provided to the user. Additionally, established procedures for monitoring throughout the entire lifecycle of the AI system are required.

It will take time before clear best practices emerge in all these areas, and the EU will complement with certain guidelines in the coming years. Proactive consultants have the opportunity to leverage their experience from many businesses with similar challenges, thus helping the client avoid unnecessary mistakes.

• Establishing an AI policy

All organizations should have an AI policy to protect business secrets and foster a culture of responsible and ethical use of artificial intelligence. For consulting firms, which often handle client data, this becomes even more crucial. How do you ensure that client data is not used to train the system’s algorithms, potentially revealing sensitive information in violation of confidentiality agreements? And how do you ensure that results that are fully or partially AI-generated are not, in practice, copies of another organization’s work?

The policy should include clear guidelines for users. This makes it easier to do the right thing. Such clarity also gives users confidence and can actually encourage the use of AI and accelerate innovation. To create business-tailored guidelines and account for the rapid development of AI, our recommendation is to establish an AI council or equivalent, which approves which AI tools are used and continuously updates the guidelines. A well-crafted AI policy helps manage risks such as liability claims from clients or sanctions under the AI Act, while also building trust among both employees and clients. Additionally, keep in mind that your clients may have their own AI usage policies that apply to the work you do as consultants.

• Educate yourself and your organization

Training is a central part of working with the AI Act. Ensure that consultants and teams have a sufficient understanding of how the regulation affects both client projects and internal processes. A good level of AI knowledge – or “AI literacy” – means that employees not only understand the technology, but also can identify its potential, limitations, and ethical challenges.

Clear guidelines for users ensure that everyone handles the technology in a responsible manner. Practical initiatives such as regular training sessions, workshops, hands-on exercises, and internal forums for knowledge exchange are important tools. Remember to document the training efforts conducted to demonstrate compliance with the AI Act’s rules on AI Literacy, which have been in effect since February 2nd of this year.

• Involve multiple competencies

A success factor for effective change management is involving a variety of different competencies and functions. This is also true in the challenging task of combining AI implementation or the development of a new product with effective management of the requirements set by the AI Act. Therefore, the recommendation is to assemble cross-functional teams that unite business expertise, technical expertise, and legal knowledge to create the best conditions for success.

Business experts contribute deep knowledge of business processes and market needs, ensuring that technical solutions are adapted to practical requirements. Technical experts are responsible for developing and implementing robust systems that are at the forefront of the latest technology. Legal specialists ensure that all solutions comply with relevant regulations and ethical guidelines, guaranteeing that the product can actually be used when it is brought to market. Consulting firms play an important role in evaluating and sharing best practices regarding how a successful collaboration can work and at what stages different competencies should be involved.

If you want to learn more about how your company can prepare for the AI Act or if you are seeking advice on AI and compliance, contact us at Wisepoint to schedule a consultation with our experts! We also offer courses in AI law.

Feel free to sign up for our half-day training on the AI Act on April 3rd, AI Act – A General Introduction Course – Wisepoint, or join our webinar on AI policy on March 14th, AI Policy – How to Create Effective Guidelines that Promote Innovation! – Wisepoint.