KIND and its experts help SMEs and mid-sized companies find out which AI systems they use, which risk level each one falls under and which actions to prioritise. A four-module approach, with deliverables you can show to a customer or a regulator.
The European regulation on artificial intelligence (Regulation (EU) 2024/1689) applies to any organisation that develops, deploys or distributes AI systems in the Union. For an SME or mid-sized company, the most common situation is that of the deployer: the company uses AI tools bought or built into its business software and must keep their use under control.
KIND's assignment focuses on the points that everything else depends on: knowing what you use, qualifying the risk of each use, checking what the systems really do, and keeping evidence of the decisions taken.
Listing of AI systems that are officially deployed and of undeclared uses, with the vendors and data involved.
Each use is classified according to the AI Act risk levels, and your role is identified: provider, deployer, importer or distributor.
Experts test how the systems behave instead of relying only on what the company declares: reliability, bias, robustness, human oversight.
Register, governance decisions, evaluation results and action plan, gathered in a file that is kept up to date.
For continuous follow-up, see KIND Compliance. For the initial review, see AI mapping.
This timeline evolves with EU legislation. Sources: Regulation (EU) 2024/1689 on EUR-Lex and the CNIL page on artificial intelligence (in French). Always check the version in force.
Your teams can also train: AI compliance: AI Act and GDPR (in French), a course listed by France Travail and the Carif-Oref network.
Yes, as soon as it provides, deploys, imports or distributes an AI system in the European Union. A company that uses an AI tool in its business is generally a “deployer” and has its own obligations, even when the tool comes from an outside vendor. The level of obligation depends on the risk level of the system and on the company's role.
With an inventory. You need to know which AI systems are used, by whom, for what purpose and with which data, including tools adopted directly by teams. This is the purpose of KIND's AI mapping, delivered in three days of work.
Prohibited practices and the rules for general-purpose AI models already apply. For high-risk systems, the “Digital Omnibus” agreement postpones application to 2 December 2027 for the use cases listed in Annex III and to 2 August 2028 for AI embedded in regulated products (Annex I). Check these dates against official sources before any decision.
The register of AI systems, their risk classification, the results of expert evaluations of system behaviour, governance decisions and follow-up actions. The goal is to present verifiable elements to a customer, an auditor or a regulator.
AI mapping is an initial snapshot of your systems. The Bpifrance Data & AI Diagnostic is a co-funded diagnostic, separate from compliance work. KIND Compliance provides continuous follow-up of the register and evidence.
A few questions are enough to frame your scope, with no commitment on your side.