Question 1

Can’t I just use ChatGPT or Claude to write my own compliance documents for free?

Accepted Answer

You can, just as you could represent yourself in court. But that approach has limits. AI tools like ChatGPT and Claude don’t know your specific business, your AI use cases, your data flows or which risk category the EU AI Act places you in. They may produce something that looks like a compliance document, but whether it covers your circumstances is another question.

Clausely starts with a structured risk assessment to establish your obligations. Your documents are generated against that specific profile, not a generic template. They reference the relevant articles of the EU AI Act, reflect your business’s risk level and follow the structure regulators expect. If you are ever investigated, “I asked ChatGPT” is not a defence. A tailored, dated and signed document demonstrates genuine compliance awareness.

Question 2

Does the EU AI Act apply to my UK business?

Accepted Answer

Yes: if your AI use affects anyone in the EU, whether customers, staff, or partners, you are in scope regardless of where your business is registered. The Act applies based on where your AI’s impact lands, not where your company is incorporated.

Question 3

What happens if we are not compliant?

Accepted Answer

Once the relevant provisions apply, regulators can investigate non-compliant businesses and issue fines of up to €15 million or 3% of global annual turnover, whichever is higher for large companies. For SMEs and startups, Article 99(6) of the Act caps this at whichever figure is lower instead, which in practice usually means the percentage of turnover. There is no grace period once enforcement begins.

Question 4

How long does it take to receive my documents?

Accepted Answer

Your compliance pack is generated and delivered to your inbox usually within 24 hours of completing the intake form after payment.

Question 5

Are these documents tailored to my business?

Accepted Answer

Yes. After payment you complete a short intake form specific to your business. Your documents are generated against that profile, not a generic template. They reflect your AI use cases, risk level, and obligations under the Act.

Question 6

Do these documents constitute legal advice?

Accepted Answer

No. Clausely’s documents provide a structured compliance framework based on the requirements of the EU AI Act. For complex or high-stakes scenarios we recommend reviewing documents with a qualified legal professional.

Question 7

What format are the documents delivered in?

Accepted Answer

All documents are delivered as Word (.docx) files so you can add your branding, make amendments, and convert to PDF as needed.

Question 8

What did the Digital Omnibus political agreement (May 2026) actually change?

Accepted Answer

The Digital Omnibus political agreement narrowed and clarified scope in several places, eased some technical compliance burdens for general-purpose AI providers, and pushed the substantive obligations for most Annex III high-risk AI systems to December 2027. What it did not change: the Article 4 AI literacy obligations, the Article 50 transparency obligations, the prohibited-use rules, and the governance and documentation expectations placed on deployers. For UK businesses deploying AI tools, the baseline policy framework you need is essentially unchanged, and only the timetable for high-risk system technical conformity has moved.

Question 9

Has the high-risk AI deadline really moved to December 2027? What still applies now?

Accepted Answer

Yes. The agreement pushes the substantive technical and conformity obligations for most Annex III high-risk AI systems to December 2027, giving providers more time to complete conformity assessments and CE marking. Transparency obligations (Article 50), AI literacy obligations (Article 4), prohibited-use rules, governance structures, and the documentation expected of deployers (businesses using an AI system, even one you did not build) sit outside that extension and already apply. In practice the policy framework, Acceptable Use, AI Literacy, Article 50 disclosures, oversight SOPs and vendor registers, needs to be in place now, even if you are also a high-risk system provider working to a 2027 conformity deadline.

Question 10

Does the Digital Omnibus mean we can wait until 2027 to act?

Accepted Answer

No. The Omnibus extended one specific timetable, substantive conformity for most Annex III high-risk systems, to December 2027. It did not defer the transparency, literacy, governance, or deployer documentation obligations. If your business uses AI tools (ChatGPT, Copilot, an internal copilot, an AI chatbot, AI-assisted recruitment or marketing), those obligations already apply to you rather than waiting until 2027. Waiting risks both regulatory exposure and PI questionnaire failure at renewal.

Question 11

What actually counts as a “high-risk” AI system under Annex III?

Accepted Answer

Annex III lists categories of AI systems treated as high-risk because of where they are used, not because of the underlying technology. These include AI used in: biometric identification and categorisation; critical infrastructure (water, gas, electricity, transport); education and vocational training (admissions, grading, proctoring); employment (recruitment, CV screening, performance evaluation, task allocation, termination); access to essential private and public services (credit scoring, insurance pricing, benefits eligibility, emergency dispatch); law enforcement, migration and border control; and administration of justice and democratic processes. If your AI sits in any of these workflows, even if it only assists a human decision, you are likely a high-risk deployer.

Question 12

Does the EU AI Act still apply to UK businesses post-Brexit?

Accepted Answer

Yes. The Act applies extraterritorially. A UK business is in scope if it places an AI system on the EU market, if the output of its AI system is used in the EU, or if it employs or serves people in the EU or EEA. Brexit did not remove EU regulatory reach over UK businesses whose AI touches EU users, staff, or customers, much as UK GDPR continues to interact with EU data protection law for cross-border processing.

Question 13

What happens if our business is not compliant?

Accepted Answer

Enforcement of the EU AI Act is phased and already under way, and there is no grace period once an obligation applies to you. National regulators (in the UK, the ICO and sector regulators acting in cooperation with EU authorities) can investigate, request your documentation, and refer matters for fines. Penalties reach €15 million or 3% of global annual turnover for breaches of deployer and transparency obligations, and €35 million or 7% of global turnover for the most serious prohibited-use breaches, whichever of the fixed amount or percentage is higher for large companies. For SMEs and startups, Article 99(6) caps each of these at whichever figure is lower instead, so in practice the percentage of turnover is usually what applies. PI insurers are already asking for documented AI policies at renewal, so undocumented AI use can affect cover as well as expose you to enforcement.

UK GDPR & DPIA Pack

What’s included

Documents

Your questions answered

Other compliance packs and resources