AdD Tech

AdD TECH — SYSTEMS, DATA AND COMPLIANCE

Technology you can actually operate

Compliance that holds up. Processes that run themselves. For companies growing across borders with a team that isn’t growing at the same speed.

Book a readiness check — €490
Take the free 12-question check

Complexity has always been the tax on growing across borders. Now it has a calendar. Four European regulations — the AI Act, GDPR, the Data Act and the Cyber Resilience Act — land on the same software, the same data and the same company, on different dates, with different obligations and different people responsible.

Most companies find this out the week a customer asks them to prove it.

In Europe, the gatekeeper is no longer just the regulator. It is your customer’s procurement team.

A fine is a possibility. A stalled contract is what actually happens. The supplier questionnaire arrives, it asks how you govern AI, where your data goes and how fast you report an incident, and the deal waits until you can answer it.

The deadline moved. The work didn’t get smaller.

In July 2026 the Digital Omnibus pushed the AI Act’s high-risk obligations from August 2026 to December 2027, and to August 2028 for AI built into products. Plenty of suppliers have not updated their pitch. We have.

What did not move: transparency obligations have applied since 2 August 2026. The Cyber Resilience Act’s reporting duty starts on 11 September 2026. The Data Act’s access-by-design rules start on 12 September 2026.

And the amendment did not only push things back. It added two prohibitions, and those apply from 2 December 2026 — the same day the marking grace period ends. Reading only the headline is how a company ends up relaxed about the wrong date.

You now have fifteen months where you expected four. That is not a reason to wait. It is the only chance you will get to do this calmly, once, and properly.

Three steps. In this order.

R

Assess

Find out what actually reaches you, and what to do about it. Not a report — a plan with owners and dates.

R

Automate

Build the systems that carry the work, compliant from the first line rather than corrected afterwards.

R

Keep it current

The rules move. Someone should be watching them so you don’t have to.

START HERE

Two ways in. Start with the free one.

STEP ONE · FREE

The twelve-question check

€0

Twelve questions about what you sell, what your team uses and where your data sits. You get a provisional read straight back: which of the four regulations reach you, which date is nearest, and the two things twelve questions cannot settle. Five minutes, and it costs you an email address.

It is provisional on purpose. It tells you whether you have a problem. It does not tell you what to do about it.

Take the free 12-question check

STEP TWO · FIXED PRICE

EU Digital Readiness Check

€490

Credited in full against your assessment if you go ahead within 60 days.

You send us a short intake: the AI tools your team actually uses, what you sell into the EU, where your data sits, and whether any of your products connect to the internet or collect usage data. Within seven working days you get three documents, and forty-five minutes with the person who wrote them.

You get the exact date when you book, and we hold the forty-five minutes then too — no chasing a calendar afterwards. If we are ever going to miss that date, you hear it before the date, not after.

  • Your obligations, dated. Which of the four regulations reach you, which articles, and every date that applies to your business — from the same table we keep current further down this page.

 

  • Your systems register. What AI and what data you run, written down once, in the form the regulations will keep asking for.

 

  • Your supplier answer sheet. The AI and data questions arriving in customer procurement questionnaires — what AI you use and what for, whether you are a provider or a deployer, where data is processed, how fast you report an incident, what policy your staff work under — on one page, answered, ready to send. Where you can’t answer honestly yet, it says so. Those blanks are your scope of work, in your own words rather than ours.

What it is not. It is not the assessment, and the answer sheet is not a certificate. Both are built from what you tell us, both are dated, and both say so on the page. They give you the size and the shape of the job before you commit to it — which is exactly what most companies are missing when they ask for a quote.

Book a readiness check — €490

Seven working days. Credited in full against your assessment if you go ahead.

Assess

EU Digital Compliance Assessment

Credited in full against your assessment if you go ahead within 60 days.

AI ACT · GDPR · DATA ACT · CYBER RESILIENCE ACT

Compliance usually arrives one regulation at a time, from one adviser at a time, and never adds up to a single answer. We do it once, across all four, and hand back a plan with names and dates on it instead of a report with findings in it.

Four regulations in one pass is not four times the work. The same inventory, the same data map and the same conversations feed all of them — which is why this costs less than four separate engagements, lands sooner, and produces four positions that agree with each other.

What you get

  • A data flow map and processing inventory, covering your software and your cloud service
  • A GDPR position: roles, lawful basis, international transfers, and whether you need an Article 27 representative
  • A Data Act applicability assessment — whether machine-generated data falls in scope, and what access-by-design attaches to it
  • A Cyber Resilience Act vulnerability handling and incident notification procedure — 24-hour early warning, 72-hour notification, 14-day final report — ready to adopt
  • An AI Act position: your AI systems inventory, whether you are a provider or a deployer, Article 5 screening, the Article 50 transparency obligations that already apply, and what your general-purpose AI suppliers owe you
  • A prioritised remediation plan with owners and target dates
    Implementation support while you work through it
  • A findings session with your management team, so the plan survives contact with the people who have to run it

Who it is for. Companies selling software, connected products or data-driven services into the EU — or preparing to.

see example

Automate

We automate it. You reduce the workload.

Running three countries with the team you hired for one is where small companies break. Not because the work is hard, but because it multiplies: the same report in three formats, the same question in three languages, the same document chasing three signatures.

What we build

  • Country-level reporting that assembles itself
  • Multilingual customer and support flows
  • Document and approval flows between entities
  • Onboarding that runs without a person in the
  • middle

You now have fifteen months where you expected four. That is not a reason to wait. It is the only chance you will get to do this calmly, once, and properly.

Most AI tools ship in breach of Article 50 by default: no notice that the user is talking to a machine, no marking of synthetic content. Ours don’t, because we read the regulation before we wrote the code. How it runs We don’t publish a timeline for automation, because we would be guessing and so is anyone who does. What we can publish is the sequence — and the exact point in it where the guessing stops.
  • Diagnose. We sit with the people doing the work and follow the process as it actually runs, not as the manual describes it.
  • Define. You get the scope in writing before anything is built: what gets automated, what deliberately does not, what it will measure, and a fixed price. Nothing starts until you have signed that page.
  • Build. In working increments you can see and stop. Compliant from the first line, not corrected afterwards.
  • Hand over. Training for the team that will run it, and the measured before and after.
If we can’t measure it, we’ll tell you before you pay for it. And we won’t automate a process that shouldn’t exist: if the problem is how the work is organised rather than how it is carried out, that is AdD Ops, and you will hear it from us at step 1 — before you have spent anything.

Keep it current

The rules moved twice in eighteen months. They will move again.

A retainer, not a project: regulatory watch on the four regulations that reach you, upkeep of your AI governance, and care of the systems we built. When something changes, you hear what it means for you — before it becomes a problem.

What applies, and when

We keep this current because our clients depend on it, and because it is the quickest way to work out whether an adviser is worth your time — including us. Position as at 21 August 2026, following the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026.
ObligationApplies fromStatus
AI Act — prohibited practices (Art. 5)2 February 2025 In force
AI Act — AI literacy (Art. 4)2 February 2025In force,
rewritten July 2026
AI Act — general-purpose AI2 August 2025In force
AI Act — transparency (Art. 50)2 August 2026In force
Cyber Resilience Act — reporting11 September 2026In force
Data Act — access by design (Art. 3(1))12 September 2026In force
AI Act — prohibited practices, new categories (Art. 5)2 December 2026Next
AI Act — marking of generative systems already on the market2 December 2026Grace period ends
AI Act — high-risk, standalone (Annex III)2 December 2027Deferred from August 2026
AI Act — high-risk, embedded in products (Annex I)2 August 2028Deferred from August 2027
If a supplier is still selling you August 2026 as your high-risk deadline, they have not read the amendment.

Questions people actually ask

Are you a law firm?
No. Our assessments are operational: what applies to you, what to do about it, and in what order. Where a formal legal opinion is needed, we bring in counsel we work with regularly.
We only use ChatGPT and a chatbot on our website. Does any of this reach us?
Yes, and less than you fear. Using AI makes you a deployer, which brings transparency duties and an obligation to support AI literacy in your team. It is a shorter piece of work than building AI — but it is not no work, and it is the version most companies get wrong because they assume it doesn’t apply.
How long does an assessment take?
Your regulatory position — what applies, what to do, in what order — lands in about four weeks. We front-load it because that is the part with a deadline attached. A full programme across several products and several markets runs to around sixteen weeks, most of it spent waiting on other people: your engineers, your certification bodies, and the time zones in between. The readiness check tells you which of the two you are.
What happens if the deadlines move again
We tell you, and we tell you what it changes for you specifically. That is what Keep it current is for.
Which languages do you work in?
English and Spanish. Deliverables are written in English as standard; if you need a second language, tell us early and we will quote it separately — and if it is one we can’t do well, we will say so rather than take the work. What we need from your side is the same discipline: technical documentation in English, or bilingual with English. We can’t work from documents we can’t read, and neither can a regulator.
We think our problem is how the work is organised, not our systems. Are we in the wrong place?
Possibly, and that is worth five minutes rather than five months. AdD Tech builds the systems and answers the rules. AdD Ops works on how the business runs — the plant, the flow, the people doing the job. If your bottleneck is in the organising rather than the tooling, we will point you there instead, and it costs you nothing to ask.
We are not selling abroad. Is this still for us?
Yes. These are European regulations, not export rules — they reach you at home too. Crossing a border simply multiplies them.

Complexity is a choice. Clarity is a decision you can make this week.

Start with the readiness check. Two pages, one session, and a clear view of what you are actually facing — credited in full if you go ahead.
Book a readiness check — €490
AdD Tech assessments are operational, not legal opinions.