A two-artifact deliverable: an Executive Summary Word document for sign-off (compliance scorecard, top 5 priority actions, cross-framework synthesis where applicable, sign-off block), plus a multi-sheet Excel workbook with per-framework gap tables, prioritised action plan, 10-domain compliance heat map, 3-phase implementation timeline, jurisdiction-specific regulatory deadlines, and a live Dashboard with native radar + doughnut charts that auto-refresh as you mark gaps Done. Aligned to your selected framework — EU AI Act, NIST AI RMF, ISO 42001, or all three.
EU-specific obligations covered
The output is anchored on the regulations that apply to AI deployments in EU. The top frameworks cited:
EU AI Act (Regulation 2024/1689)regulation · In force
Providers and deployers of high-risk AI systems must complete conformity assessments, maintain technical documentation, implement human oversight measures, and register systems in the EU AI Act public database before market placement.
General Data Protection Regulation (Regulation 2016/679)regulation · In force
Controllers must establish a lawful basis for all personal data processing, honour data subject rights including the right to explanation of automated decisions, and report personal data breaches to supervisory authorities within 72 hours.
EU Data Act (Regulation 2023/2854)regulation · In force
Manufacturers of connected products must ensure users can easily access data generated by their products and share it with authorised third parties upon request, without discrimination or unfair contractual terms.
EU Data Governance Act (Regulation 2022/868)regulation · In force
Data intermediation service providers must notify their national competent authority before commencing operations, remain neutral and not use data for their own commercial purposes, and maintain structural separation between intermediation and other services.
How the AI Compliance Gap Analyser approaches this
You describe your organisation, choose your framework (EU AI Act / NIST AI RMF / ISO 42001 / all three), and answer a brief 10-question self-assessment per framework. The tool maps your stated posture against each framework requirement to produce a structured, evidence-based gap analysis ready for your compliance, legal, and governance practitioners.
The Executive Summary Word document is a one-page sign-off artifact — overall scorecard, top 5 priority actions, cross-framework synthesis (when comparing all three), sign-off block. The detailed Excel workbook is the working remediation instrument: per-framework gap sheets with current state, target state, gap severity, priority action, framework citations, owner, effort, and a Status dropdown that drives the live Dashboard. Both are AI-assisted drafting aids intended to accelerate review and remediation by qualified practitioners.
What you get
✓ Two artefacts, two jobs: Executive Summary (.docx) for board sign-off, Detailed Workbook (.xlsx) for the working remediation tracking — no overlap, no confusion.
✓ Customer self-assessment driven: gap ratings come from your stated posture, not from inferred maturity. The workbook pre-fills your answer alongside each requirement so reviewers see the basis for every gap rating.
✓ Live dashboard with formulas + native radar + doughnut charts that auto-refresh as you mark gap rows Done — no regeneration needed to see remediation progress.
✓ Tailored to your jurisdiction, industry, organisation size, and risk appetite — every gap rating accounts for your context, not a generic checklist. Designed for review and sign-off by qualified compliance, legal, or governance practitioners.
Frequently asked
What does an EU AI Act gap analysis actually check for a service provider?
It checks three things in sequence: whether any system is caught by a prohibited-practice category (in force since 2 February 2025), whether any system meets the Annex III standalone high-risk criteria (application deferred by the adopted Digital Omnibus to 2 December 2027) or the Annex I embedded high-risk route (deferred to 2 August 2028), and — separately — whether the organisation is a General-Purpose AI model provider under Articles 51–56 (in force since 2 August 2025, a different obligation track entirely). A gap analysis that only checks one of these three misses obligations that are already live today. The AI Compliance Gap Analyser scores all three tracks against your stated posture rather than assuming one applies.
Which EU AI Act obligations are already in force in 2026, and which are still deferred?
Already in force: Article 5 prohibited practices and the AI-literacy obligation (2 February 2025), GPAI model provider obligations under Articles 51–56 (2 August 2025), and Article 50 transparency obligations including penalties and national-authority designation (2 August 2026 — not deferred by the Digital Omnibus, only the narrower Article 50(2) machine-readable-marking duty for GPAI already on the market has a grace period to 2 December 2026). Still deferred: Annex III standalone high-risk to 2 December 2027, and Annex I embedded high-risk to 2 August 2028. A gap analysis dated before the Digital Omnibus’s formal adoption (June 2026) is very likely working from the wrong Annex III/Annex I dates.
Does a GPAI model provider need a different gap analysis than a high-risk AI system provider?
Yes — they are separate obligation tracks under separate articles. High-risk AI system providers work through Article 9 risk management, Article 17 quality management, and Article 11 technical documentation, gated by the Annex III/Annex I application dates above. GPAI model providers work through Articles 51–56 regardless of those dates, including downstream-deployer documentation and, for models presumed to carry systemic risk, additional risk-mitigation duties. An organisation that is both a GPAI provider and deploys separate high-risk systems needs both tracks assessed, not one used as a proxy for the other. The AI Compliance Gap Analyser lets you select EU AI Act alongside NIST AI RMF and ISO/IEC 42001 and scores each framework’s applicable track independently.
Ready to generate?
$39 · one-time — answer a 6-question intake (including jurisdiction = EU), and download your tailored document immediately.