Forward-deployed AI consulting in Europe
The EU AI Act is the most detailed AI law in force. It classifies AI systems by risk and sets duties for each role in the supply chain. An agent that a company builds and runs internally is usually a deployer under the Act, even when someone else built the model. The duties depend on what the agent is used for, not on the technology behind it, so the first task for a European team is to say what the agent decides or influences.
I am Mayur Patil, based in Nashik, India. I have worked with clients in Italy and Switzerland. For Whirlpool in Italy and Zeiss in Switzerland, the work covered predictive AI and machine-learning models and virtual-reality applications. The Europe pillar sets out the Act's duties with their sources.
What the Act asks of an agent deployer
AI literacy (Article 4). Providers and deployers must support a sufficient level of AI literacy among the staff and others who work with their AI systems. The duty takes account of technical knowledge, experience and training, and of the context in which the system is used. The amended wording does not require a specific level for any one person. For a builder, the practical meaning is a training record for the people who operate or oversee the agent, and a short explanation of what it does and does not do.
High-risk uses (Article 26). A deployer of a high-risk system must use it according to its instructions for use. Human oversight must be assigned to people with the necessary competence, training and authority, and they must have the support they need to carry it out. This is a design requirement. The approval step, the stop control and the review screen have to be built into the system, not promised in a policy.
Transparency. Some interactions with AI, and some generated content, must be disclosed to the people affected. Sources have reported the timing differently, so the consolidated text of Article 50 is the reference for the date that applies to a given system.
Automated decisions (GDPR Article 22). Where a decision about a person is made solely by automated means and has a legal or similarly significant effect, the person has rights. These include an explanation, human intervention and the right to contest the decision. An agent that decides, rather than recommends, needs a route for those rights, and the route must work in practice.
The dates
Regulation (EU) 2026/1744 moved the high-risk dates. According to commentary, the Annex III high-risk duties now apply from 2 December 2027, and the Annex I duties from 2 August 2028. Several law firms reported that most transparency duties apply from August 2026, with some point in Article 50 later. That is one place where the sources disagree. The EUR-Lex text should decide it for each system.
Where the sources disagree
The clearest disagreement is over the transparency dates, which is why this page points to the consolidated text rather than to any one summary. The high-risk dates are reported consistently in commentary, but the amending regulation is the reference for the exact wording. A team that plans its launch around a date should check the regulation itself before committing.
How an agent is built to meet these duties
Each duty maps to something that must exist in the system.
The approval step. Any action that changes a record, sends a message to a customer or makes a decision about a person has a named approver. The approval is logged with the reviewer's name and the time.
The stop control. A named person can pause the agent in one step, and the team has tested that the pause works.
The record. Each run keeps its inputs, the tools it called, the outputs and the approval. This is what a regulator, an auditor or a works council will ask for first.
The notice. Where a disclosure duty applies, the notice is part of the interface, and its wording is agreed with the owner and, where needed, counsel.
The evaluation. An evaluation set of real cases, with expected outcomes agreed by the business owner, shows that the controls work. It is re-run after every change.
One example use case
The example below is an illustration of the work, not a client engagement.
Example: a service-reply agent for a manufacturer's customer team. A customer team receives service requests by email in several languages. The proposed agent drafts a reply in the customer's language, cites the product manual, and leaves the reply in a queue for a service agent. The readiness review settled three points. The agent sees the request and the manual, not the customer's full account. Every reply is approved by a service agent before it is sent, so the disclosure and the approval are both in the flow. And the evaluation uses past requests whose correct replies the team has already confirmed.
How an engagement runs
An engagement starts with the two-week AI Delivery Readiness Review on one workflow. The review names the agent's use and its risk category, lists the personal data each step reads, and sets the approval and disclosure points. It ends with a written recommendation to proceed, reframe or pause. If the work proceeds, an architecture sprint or a forward-deployed delivery engagement follows, with a named owner at handover.
Three ways to start
AI Delivery Readiness Review. Two weeks on one workflow, with a written readout.
Architecture Sprint. Two to four weeks on one use case, with the architecture, recorded decisions and a backlog.
Forward-deployed AI delivery. One bounded use case, built inside your systems, with a runbook and a named owner.
Each is quoted on its scope. The engagements page describes what each includes. I do not publish prices.
Relevant work
The organisations I have worked with and can name are listed on the about page. In Europe, the named clients are Whirlpool in Italy and Zeiss in Switzerland.
Where to go next
The FDE consulting hub covers the three ways to engage. For the rules, the Europe pillar is the reference, and the FDE training hub covers the team programmes.
Common questions
Does the EU AI Act apply to an agent that only my own staff use?
Often, yes. A company that builds and runs an agent internally is usually a deployer under the Act, even when someone else built the model. The duties depend on what the agent is used for. The readiness review records the use, the risk category and the duties that follow.
What does AI literacy mean in practice under Article 4?
The Act asks providers and deployers to support a sufficient level of AI literacy among the people who work with their systems. It does not set one level for everyone. In practice, the team keeps a training record and a short written description of what the agent does and does not do.
When do the high-risk duties start?
Regulation (EU) 2026/1744 moved the high-risk dates. Commentary reports that the Annex III duties now apply from 2 December 2027 and the Annex I duties from 2 August 2028. The EUR-Lex text is the reference for the date that applies to a given system.
Can you work on site in Europe?
I have worked with clients in Italy and Switzerland. Discovery and handover can be on site where the engagement calls for it, and the build can run from India with a fixed overlap for decisions. Overlap hours are agreed per project.
Sources
- Official: EUR-Lex, Regulation (EU) 2024/1689, consolidated text (27 July 2026)
- Official: EUR-Lex, Regulation (EU) 2026/1744 (amending Regulation 2024/1689)
- Official: EUR-Lex, Regulation (EU) 2016/679 (GDPR), including Article 22
- Commentary: Gibson Dunn, the AI Act omnibus agreement and postponed high-risk deadlines
- Commentary: Regulation-AI, Article 4 (AI literacy)