Taking an LLM API / generative AI service to EU enterprise customers

Stages (20–34 weeks, estimate)

1. 1. Stage 1 — Role determination and scoping

   3–5 weeks

   Settle three questions once and for all: (1) whether you are a GPAI model provider, an AI system provider, or both under the AI Act; (2) whether you cross the systemic-risk threshold and thus trigger the heavier Article 55 duties; (3) whether you are controller or processor under the GDPR, per data flow. In parallel, start selecting the AI Act authorised representative and the GDPR Article 27 representative — these are different roles, cannot substitute for each other, and both must be in place before placing on the market. The output is an applicability matrix that a customer’s legal team can cite directly.

   Obligations in this stage

   • High-risk classification assessment and registration of a not-high-risk conclusionEU Artificial Intelligence Act · Art. 6, Art. 49(2), Art. 113 · Severity Critical
   • Screening for prohibited AI practices and withdrawing non-compliant featuresEU Artificial Intelligence Act · Art. 5 · Severity Critical
   • Systemic-risk classification against the compute threshold and two-week notification to the CommissionEU Artificial Intelligence Act · Art. 51, Art. 52(1)-(2), Annex XIII · Severity Critical
   • EU authorised representative for third-country GPAI model providersEU Artificial Intelligence Act · Art. 54 · Severity Critical
   • Designation of an EU representative by third-country controllers and processorsEU General Data Protection Regulation (GDPR) · Art. 27 · Severity High

   Deliverables

   Model Card

   Evidence to retain

   • · Role and applicability memorandum (decision basis and article locator for each conclusion)
   • · Training-compute estimation workpaper (method, measurement basis and retained raw measurement records)
   • · Prohibited-practices screening record (item by item against Article 5, including the two newly inserted points)
   • · Shortlist and draft mandates for the AI Act authorised representative and the GDPR Article 27 representative

   Common blockers

   • · Conflating “model provider” with “system provider”: shipping only weights and an API can still make you the provider of an end-user-facing system, and the two obligation sets must both be discharged.
   • · No audit trail behind the compute estimate: once the systemic-risk threshold is questioned, an estimate with no documented method and raw records is no determination at all.
   • · Assuming an EU distributor substitutes for the authorised representative — the representative needs a written mandate and must be able to produce documentation to authorities.

2. 2. Stage 2 — GPAI documentation pack and copyright policy

   5–8 weeks

   Produce the three Article 53 deliverables: the technical documentation for regulators (Annex XI), the documentation for downstream integrators (Annex XII), and the public “sufficiently detailed summary” of training content, filled in on the Commission’s official template. In parallel, stand up the copyright policy, including the mechanism for detecting and respecting machine-readable reservations of rights for text and data mining. EU customers will quote this material verbatim in their own compliance files, so write it to be re-stated by third parties.

   Obligations in this stage

   • GPAI model technical documentation and documentation for downstream integratorsEU Artificial Intelligence Act · Art. 53(1)(a)-(b), Annex XI, Annex XII · Severity Critical
   • Publicly available summary of GPAI training contentEU Artificial Intelligence Act · Art. 53(1)(d) · Severity Critical
   • GPAI copyright policy and identification of reserved rightsEU Artificial Intelligence Act · Art. 53(1)(c) · Severity High
   • Upstream cooperation and written agreement duties along the value chainEU Artificial Intelligence Act · Art. 25(2), Art. 25(4) · Severity High

   Deliverables

   Public Summary of Training Content for a general-purpose AI model (EU official template)Model CardData Card — datasheet for a training, validation or test dataset

   Evidence to retain

   • · Model technical documentation (Annex XI scope: training and testing process, evaluation results, compute and energy consumption)
   • · Integration documentation for downstream providers (Annex XII scope)
   • · Public training-content summary completed on the Commission’s official template (source categories and scale characterisation)
   • · Copyright policy and rights-reservation detection procedure (opt-out protocols honoured and crawl-log retention rules)
   • · Model card and data card (an external version and a full internal version)

   Common blockers

   • · Writing the training-content summary in a bespoke format: the official template has fixed sections and a required granularity, and a home-made format gets sent back.
   • · Treating “trade secret” as a reason to leave sections blank: the template asks for source categories and scale characterisation, not a dataset-by-dataset list, so blanket redaction does not hold.
   • · A copyright policy with no execution evidence: you must be able to show that the crawling stack actually read and honoured rights-reservation signals.

3. 3. Stage 3 — Article 50 transparency and synthetic-content marking

   3–5 weeks

   Land the transparency duties in the product, not in the privacy policy: disclosure when a natural person interacts directly with the system, machine-readable marking and detectability of synthetic audio/image/video/text, and deepfake and emotion-recognition disclosure. Legacy systems carry a separate deadline — synthetic-content systems placed on the EU market before 2 Aug 2026 must meet Article 50(2) by 2 Dec 2026, the same date on which the two new prohibitions (non-consensual intimate imagery and child sexual abuse material) start to apply, requiring technical safeguards on both the generation and distribution sides.

   Obligations in this stage

   • Disclosure that a natural person is interacting with an AI systemEU Artificial Intelligence Act · Art. 50(1), Art. 50(5) · Severity High
   • Machine-readable marking and detectability of synthetic contentEU Artificial Intelligence Act · Art. 50(2), Art. 111(4) · Severity Critical
   • Retrofitting marking to legacy synthetic-content systems by 2 Dec 2026AI Omnibus (Digital Omnibus on AI) · Art. 1(39)(b) inserting AI Act Art. 111(4) · Severity Critical
   • Prohibition of non-consensual intimate imagery and CSAM generation, and required safeguardsAI Omnibus (Digital Omnibus on AI) · Art. 1(7) amending AI Act Art. 5(1)(ba)-(bb), Art. 5(1a)-(1b) · Severity Critical

   Deliverables

   Model Card

   Evidence to retain

   • · Screenshots and release records of in-product AI-interaction disclosure
   • · Technical note on synthetic-content marking (provenance/watermarking scheme used, modalities covered, robustness test results)
   • · Legacy-system remediation list and completion evidence (against the 2 Dec 2026 deadline)
   • · Test report for generation-side and distribution-side blocking of non-consensual intimate imagery and child sexual abuse material

   Common blockers

   • · Marking that is only visible in your own player: Article 50(2) requires machine-readable, third-party-detectable marking that survives export.
   • · Blocking only at generation time, not at distribution and API level: enterprise customers plug the API into their own distribution chain, so safeguards must bite at the interface.
   • · Burying the disclosure in the terms of service: disclosure to natural persons must be given at interaction time in a perceivable way.

4. 4. Stage 4 — GDPR lawful basis, DPIA and international transfers

   4–7 weeks

   Determine the lawful basis flow by flow (arguing training use and inference use separately), complete the DPIA, execute processor contracts and sub-processor arrangements, and select and implement the transfer mechanism for the “inference data returns to China” leg (Standard Contractual Clauses plus a transfer impact assessment). EU enterprise procurement will almost always ask for the DPIA summary and the TIA, so this stage’s output determines how fast Stage 5 can move.

   Obligations in this stage

   • Lawful basis and transparency for training and inferenceEU General Data Protection Regulation (GDPR) · Art. 5, Art. 6, Art. 7, Art. 9, Art. 13, Art. 14 · Severity Critical
   • Data protection impact assessment and prior consultationEU General Data Protection Regulation (GDPR) · Art. 35, Art. 36 · Severity High
   • Records of processing activities (ROPA)EU General Data Protection Regulation (GDPR) · Art. 30 · Severity High
   • Processor contracts and sub-processor managementEU General Data Protection Regulation (GDPR) · Art. 28 · Severity High
   • Transfer mechanisms and assessments for sending personal data to China and other third countriesEU General Data Protection Regulation (GDPR) · Art. 44-49 · Severity Critical

   Deliverables

   GDPR Data Protection Impact Assessment (DPIA) — for AI training and inferenceTransfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses

   Evidence to retain

   • · Records of processing activities (ROPA, separating training-side and inference-side)
   • · DPIA report (necessity and proportionality analysis, residual-risk conclusion)
   • · Transfer impact assessment (TIA) report and the accompanying supplementary-measures list
   • · Executed Standard Contractual Clauses with annexes (including the description of technical and organisational measures)
   • · Processor contracts and sub-processor register (location and role of each sub-processor)

   Common blockers

   • · Using one blanket “legitimate interests” for both training and inference: the necessity and proportionality analysis differs and must be written separately.
   • · A TIA that merely says “China has a data protection law”: it must assess government-access routes point by point and land actionable supplementary measures.
   • · A sub-processor register missing GPU cloud and annotation vendors: these are the two reviewers ask about most, and omitting them stalls procurement outright.

5. 5. Stage 5 — Enterprise contracting, security answer bank and third-party assurance

   4–6 weeks

   Compress the first four stages into two reusable assets: an answer bank that lets you respond to any customer security-and-privacy questionnaire within 48 hours, and a compliance response pack that can go straight into the customer’s file. In parallel, start a management-system certification track (ISO/IEC 42001 or equivalent) — large EU buyers increasingly treat third-party assurance as an entry gate rather than a bonus. The Data Act Article 32 safeguard against unlawful third-country government access must show up in both the contract and the architecture.

   Obligations in this stage

   • Processor contracts and sub-processor managementEU General Data Protection Regulation (GDPR) · Art. 28 · Severity High
   • Security of processing and data protection by design and by defaultEU General Data Protection Regulation (GDPR) · Art. 25, Art. 32 · Severity High
   • Personal data breach notification within 72 hours and communication to data subjectsEU General Data Protection Regulation (GDPR) · Art. 33, Art. 34 · Severity Critical
   • Preventing unlawful third-country governmental access to non-personal data held in the UnionEU Data Act · Art. 32 · Severity Critical
   • Upstream cooperation and written agreement duties along the value chainEU Artificial Intelligence Act · Art. 25(2), Art. 25(4) · Severity High

   Deliverables

   Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)ISO/IEC 42001 AI management system implementation and certification readiness checklist

   Evidence to retain

   • · Customer security and privacy answer bank (grouped by topic, each answer carrying an evidence reference)
   • · Compliance response pack (DPIA summary, TIA summary, sub-processor list, data-flow diagrams)
   • · Procedure for handling third-country government access requests (refusal, notification and logging rules)
   • · ISO/IEC 42001 gap analysis and certification schedule

   Common blockers

   • · Answer-bank entries that assert “GDPR compliant” with nothing to check: every answer must resolve to a specific document or a specific configuration.
   • · Scheduling ISO/IEC 42001 certification after signature: certification-body slots and audit cycles run in quarters, and back-planning from a signed date kills the delivery commitment.
   • · Contracting for “data never leaves the EU” while observability and logging pipelines cross the border — the single most frequently exposed claim in due diligence.

6. 6. Stage 6 — Post-launch operation, incident reporting and AI literacy

   4–6 weeks

   Stand up three standing channels and run one rehearsal: AI serious-incident reporting (Article 73 sets three deadlines — 15 days, 10 days and 2 days), 72-hour personal-data breach notification, and AI literacy measures for your own staff and representatives. The range here is the time to build; afterwards it becomes business as usual. The rehearsal record is itself compliance evidence and the artefact customers most often request at annual review.

   Obligations in this stage

   • Serious incident reporting (15-day, 10-day and 2-day deadlines)EU Artificial Intelligence Act · Art. 73 · Severity Critical
   • AI literacy measures for staff and persons acting on the provider’s behalfEU Artificial Intelligence Act · Art. 4 · Severity Medium
   • Personal data breach notification within 72 hours and communication to data subjectsEU General Data Protection Regulation (GDPR) · Art. 33, Art. 34 · Severity Critical

   Deliverables

   AI incident and serious incident reporting record (register plus report drafts)

   Evidence to retain

   • · AI incident register and outbound report drafts (including the rules for classifying into the three deadlines)
   • · Personal-data breach response handbook and the rule for when the 72-hour clock starts
   • · Full record of one tabletop exercise (trigger scenario, decision chain, elapsed time)
   • · AI literacy training records and coverage statistics

   Common blockers

   • · Not fixing the incident-severity rules in advance: debating “is this a serious incident?” once it happens makes the shortest 2-day deadline unreachable.
   • · Excluding customer-reported issues from the register: upstream providers in the value chain have cooperation duties, and customer-reported incidents belong in the same register.
   • · Treating AI literacy as “circulate a slide deck”: it needs recorded coverage and role-specific content, especially for sales and support staff.