EU AI Act testing services
AIAssuranceLabs offers twelve services, each bounded by the limits set out at /what-we-cannot-do/. Each service tests a system, its data or its documentation against named articles of Regulation (EU) 2024/1689, runs a versioned protocol published on /methodology/, and produces itemised deliverables specified on /deliverables/. The services cover classification, Article 50 marking, robustness, bias, logging and oversight, technical documentation, mock assessment, GPAI evaluation, FRIA, data governance, QMS and regression. Every service leads to /contact/.
The twelve services
The table lists each service with the roles it serves, the articles it tests against, the protocol it runs at its current version, and the regulation entries that set its applicability date.
| Service | For | Articles | Protocols | Applies from |
|---|---|---|---|---|
| Classification and readiness assessment | Startups, Enterprises, Non-EU providers |
| ||
| Article 50 transparency and marking/watermark testing | Generative AI features |
| ||
| Robustness and adversarial testing | Annex III providers, Annex I manufacturers, GPAI providers |
| ||
| Bias and fairness testing under the Omnibus sensitive-data provision | Annex III providers, Deployers |
| ||
| Logging and human-oversight verification | Annex III providers, Deployers |
| ||
| Technical documentation and evidence-pack preparation | Annex III providers, Annex I manufacturers, Startups, Non-EU providers |
| ||
| Pre-conformity mock assessment | Annex III providers, Annex I manufacturers |
| ||
| GPAI evaluation support | GPAI providers |
| ||
| FRIA facilitation and evidence structuring | Deployers |
| ||
| Data governance and dataset quality testing | Annex III providers, Annex I manufacturers, GPAI providers |
| ||
| QMS gap analysis | Annex III providers, Annex I manufacturers, Enterprises |
| ||
| Regression testing after substantial modification | Annex III providers, Annex I manufacturers, GPAI providers |
|
How a service is scoped
An engagement is fixed-scope or ongoing, scoped per request. Scope follows from three inputs: the role of the organisation under Regulation (EU) 2024/1689 (provider, deployer, importer, distributor, or provider of a general-purpose AI model), the risk tier of the system under Art. 6 and Annex III, and the obligations that follow from both. Where the role or the risk tier is not yet established, the entry service, Classification and readiness assessment, is the usual starting point. It runs PR-CLS v1.0 and produces a classification memo, an obligation register and a gap list that set the scope of any later service. Each later service runs the protocol its page names, at the version shown, against the articles it lists. The accuracy and robustness test under Art. 15 run by PR-15-ROB v1.0 is one example.
What every engagement produces
Every deliverable belongs to one of nine families. Each family has a specification and a synthetic sample on /deliverables/; the deliverables table on a service page links to the same specification.
- A test report records one protocol run against one system version, with the metric, the criterion source and the verdict per element.
- A traceability matrix holds one row per obligation element, from the article paragraph to the evidence file and its location in the technical file.
- An evidence pack assembles the indexed set of documents an assessor or a market surveillance authority asks for, with the remaining gaps marked.
- A protocol run record is the executed copy of a versioned protocol, step by step, so that a third party can repeat the run.
- A findings register lists every gap or failed criterion with severity, article reference, evidence and the re-test criterion that closes it.
- An assessment memo gives a reasoned technical assessment of one question, such as classification or marking architecture, written for discussion with counsel.
- A register or checklist is a structured list maintained after the engagement, such as an obligation register with the applicability dates from the regulation data.
- A dataset profile with dataset cards states the measured properties of training, validation and test sets against the Art. 10 quality criteria, with one card per set.
- A FRIA record is the structured fundamental rights impact assessment record for a deployer under Art. 27, aligned to the clause structure of
ISO/IEC 42005:2025Published.
What we cannot do
- We do not perform conformity assessments where a notified body is required.
- We do not issue CE marking or the EU Declaration of Conformity.
- We are not a notified body.
- We do not give legal opinions on classification or liability.
- We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.