Interpreting obligations, determining your role and contracts are for a lawyer. How an AI system behaves and where data can leak out of it is for an AI auditor. AI literacy under Article 4 is for training by role. Below is the difference on five axes, the order of steps and, openly, what CIAD does not do.
Each profession answers a different question and none of them replaces the others.
| Axis | Lawyer | AI auditor | AI training |
|---|---|---|---|
| The question it answers | What does the AI Act mean for us legally, and who is responsible for what? | How does our AI system behave, and where can data leak out of it? | Can our people work with AI safely in their role? |
| Typical output | Legal opinion, revised contracts and internal policies, representation. | Evidenced findings with severity and a remediation plan with an owner and a deadline. | Curriculum, attendance records and rules for working with AI by role. |
| Link to the AI Act | Determines your role (provider or deployer) and the obligations that follow from it. | The AI Act does not require a general audit. Technical findings are input for decisions. | Article 4 calls for measures to support AI literacy. It prescribes no uniform course or certification. |
| When it makes sense | Contracts with AI vendors, an unclear role, an inspection, a dispute, liability for damage. | Before deploying AI on sensitive data, after a major change, or after a security incident to verify the measures. | People use AI at work and the company wants to document the measures it has taken. |
| What it cannot do | It does not test the system. It interprets what you tell it about the system. | It does not say what the findings mean legally and it does not confirm compliance. | It does not find out whether the system itself leaks, and it does not replace legal advice. |
If points from different columns apply, you need more than one profession. That is the usual case, not a mistake.
Starting with a contract or a course before you know which AI runs in the company solves the right problem in the wrong place.
Find out which AI tools and systems the company actually uses and who supplied them. Without that, nobody knows what to assess.
For each system, determine whether you are the provider or the deployer, and whether the use is high-risk. This is where the lawyer’s work begins.
Have systems that run on sensitive data tested. The findings give your lawyer and management evidence that cannot simply be estimated.
Training by role and rules for working with AI. Attendance records and the curriculum document the measures taken. Article 4 has applied since 2 February 2025, so this step can run in parallel with the others.
Five questions for every vendor, including us.
An auditor who also supplies your AI system or licences is assessing its own work. Ask who pays them.
What will be tested, with what tools and under what authorisation. An offer without a scope of work cannot be compared or checked.
Each finding comes with evidence, a severity and a remediation step. A scanner export alone is not an audit.
A technical audit does not confirm compliance with the AI Act. Under the regulation, certificates are issued only by notified bodies, and only for high-risk systems. The regulation knows no general “AI Act certificate” for a company.
A repeat check after remediation shows whether the measure worked. Without it, the audit stays a list.
Audits and training. Not legal services. Within CIAD, the legal side is overseen by an attorney specialising in IT law, but interpreting your specific situation belongs to your own lawyer. It is neither a legal opinion nor an automatic confirmation of compliance.
Prompt injection, jailbreaks, RAG, agent loops, permissions and paths to unintended data disclosure.
A day of hands-on work with AI on the team’s own tasks, rules by role, a curriculum and attendance records.
Eight questions and an indicative assessment of which obligations may apply to you, right in the browser.
It depends on the question. Interpreting obligations, determining your role and contracts are for a lawyer. How a specific AI system behaves and where data can leak out of it is for an AI auditor. You often need both: audit findings give the lawyer evidence they cannot gather themselves.
Mainly three professions. Law firms focused on IT law and data protection handle interpretation, contracts and representation. AI and security auditors test systems technically. Training providers cover the AI literacy of employees. Of these, CIAD does audits and training, not legal services.
The AI Act does not impose a general obligation on companies to have their AI systems audited. For high-risk systems it requires the provider to carry out a conformity assessment under Article 43, a quality management system under Article 17 and post-market monitoring under Article 72. After the amendment by Regulation (EU) 2026/1744, the requirements and obligations for high-risk systems apply from 2 December 2027 for systems under Annex III and from 2 August 2028 for systems under Annex I. What an audit covers is explained in What an AI system audit actually tests.
Training covers Article 4, that is, measures to support AI literacy according to people’s roles and their actual use of AI. It is an obligation of effort, not of result, and the regulation prescribes no uniform course or certification. Other obligations, such as transparency for chatbots or the requirements for high-risk systems, are not covered by training. What a training certificate does and does not prove is explained in AI training certificates: what the certificate actually means.
No. A technical audit describes how the system holds up and documents the findings. It is neither a legal opinion nor an automatic confirmation of compliance. What the findings mean legally is for a lawyer to assess.
The conformity assessment under Article 43 is an obligation of the provider of a high-risk system. For the areas in Annex III it is mostly internal control under Annex VI. A notified body is mandatory for biometric systems where the provider has not applied harmonised standards, has applied them only in part, or where they do not yet exist. Products under Annex I follow the sectoral legislation. A deployer has its own obligations but does not carry out the conformity assessment unless it becomes a provider under Article 25, for example by substantially modifying the system.
An inventory of AI tools, then determining role and risk, technical testing of systems that run on sensitive data, and training people. Without an inventory nobody knows what to assess, and without a determined role you do not know which obligations apply to you. Training and rules for people can run in parallel, because Article 4 has applied since 2 February 2025. Every date is listed in AI Act compliance deadlines.
Ask five things: whether the auditor sells the system it audits, whether the scope is agreed in writing in advance, whether the findings are evidenced, whether it promises a compliance stamp for the AI Act, and whether it verifies the remediation.
No. CIAD audits AI and LLM systems, websites and applications, databases and data, and runs AI training for companies. Within CIAD, the legal side is overseen by an attorney specialising in IT law, but interpreting your specific situation belongs to your own lawyer.
Pricing is provided on request. For an audit it depends on the number and type of systems, for training on the number of people and roles. We confirm the scope in writing in advance.
Write to office@ciad.cz about the AI your company uses and what worries you about the AI Act. We will tell you whether it is work for an audit, for training or for a lawyer. That is an answer too.
