A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →The EU AI Act is the European Union's regulation governing artificial intelligence, which entered into force in 2024. It classifies AI systems by risk: a small set of unacceptable uses are prohibited, high-risk systems carry strict obligations, and limited-risk systems face transparency duties. Like the GDPR, it applies beyond the EU to providers and deployers whose systems are used in the EU market.
The Act is risk-tiered, so the expensive mistake is treating every AI feature as high-risk or assuming none of it counts. Classification decides whether you owe documentation, human oversight, and conformity work, or simply a disclosure that users are dealing with AI.
It sits alongside, not inside, your other obligations. A company may face the AI Act, the GDPR, and Quebec Law 25's automated-decision rules on the same product, which is why we assess them together rather than running three separate projects.
traztech delivers EU AI Act readiness for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
The AI Act reaches Canadian companies the same way the GDPR did, through the market rather than the map. If your AI system is placed on the EU market or its output is used in the EU, the obligations can apply regardless of where you are based. EU AI Act readiness starts with working out whether you are in scope.
The first practical step is classification, because almost everything downstream depends on which risk tier a system falls into. Many products that feel high-stakes are actually limited-risk with transparency duties, while some unglamorous back-office uses land in the high-risk category. Our ISO 42001 versus the EU AI Act comparison sets out how the two fit together.
It applies in phases rather than all at once. The ban on prohibited practices came first, obligations for general-purpose AI models followed, and the full high-risk regime phases in later. The phasing is why classification and a timeline matter early.
For the most serious breaches, those involving prohibited practices, fines reach up to 35 million euros or 7 percent of total worldwide annual turnover, whichever is higher. Lower tiers apply to other breaches.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.