From Quiz to Diagnostic: What Happens in an AI Readiness Diagnostic

You took the quiz, or you read the articles. Either way you now know two things: the EU AI Act applies to your business, and you cannot currently prove compliance. That knowing is worth something — most firms haven't got that far.

What you don't have is the part that matters. A list of your AI systems. The role you play for each one under the Act. Their risk classes. A plan that says what to fix first, what can wait, and what's already fine. The quiz tells you that you're exposed. The Diagnostic tells you exactly where, how badly, and what to fix first.

This page is the walk-through of what happens in those two weeks — the same material we cover in our full guide to the EU AI Act for UK and Irish businesses, but from the delivery side: what we do, what you do, and what lands on your desk at the end. No "contact us for pricing" games — the price is below, in writing.

Week 1 — finding every AI system you actually run

Most firms think they know what AI they use. They know the two or three tools with a login they approved. What they don't know is everything else: the browser extensions, the free tiers, the tool someone in sales adopted last quarter and told nobody about. Week one is about replacing that impression with a list.

The anonymous survey matters more than people expect. Staff won't confess to undeclared tools in a meeting; they will tick a box on a form with no name on it. The result is the shadow AI problem surfacing on paper instead of in an audit — most firms find at least a few tools nobody declared. Finding them in week one is the process working, not failing.

Role mapping matters because it decides what you owe. For most SaaS AI, you're a deployer — the Act's duties land on you as the operator of the system. Where you've built or substantially modified a system, you may be a provider, which is a heavier set of obligations. Getting this wrong per system is how firms either under-comply on the tools that matter or gold-plate the ones that don't.

Week 2 — classification, gaps, and the plan that matters

Week two turns the inventory into decisions. Every system gets classified under the Act's risk tiers — the same categories that decide which obligations attach, from AI literacy and transparency through to the high-risk regime's logging and documentation duties.

Then comes the gap analysis: for each obligation that applies to you, where do you actually stand? Ranked by exposure — not alphabetically, not by how interesting the tool is. A chatbot with no disclosure label can be a bigger problem than a well-governed ML pipeline, and the ranking reflects that.

The output is a prioritised remediation plan in three lanes: fix first (exposure is live and the fix is cheap), can wait (the obligation's date is ahead of you, start it now but calmly), and already fine (you'd be surprised how much of it is — knowing what not to worry about is half the value).

The readout — what lands on your desk

At the end of week two you get the AI Readiness Diagnostic Report and a walkthrough call. The report contains, in plain English:

1. AI inventory — every AI system in the business, what it does, who owns it.
2. Role per system — provider or deployer, and what the Act requires of you in that role.
3. Risk classification — each system's tier under the Act, with the reasoning shown.
4. Gap list ranked by exposure — what's missing, how bad it is, in order.
5. Prioritised remediation plan — the fix-first / can-wait / already-fine plan you can hand to anyone.

You own the report regardless of what happens next. That's deliberate: it's your data, your risk position, your decision what to do with it.

What it costs and why it's fixed

£3,500 / €4,000. Two weeks. Fixed. No hourly rates, no day rates, no "it depends."

Fixed pricing works here for one reason: the process is repeatable. We run the same inventory method, the same classification logic, the same gap framework every time — which means the effort is predictable, and a predictable effort can carry an honest price. If the Diagnostic were bespoke consulting, priced by the hour, it would cost more and tell you less.

What's not included: legal advice. We work alongside your legal counsel, not instead of them — the Diagnostic maps your position and your exposure, and your solicitor acts on it as they see fit. That boundary keeps the price fixed and the work honest.

After the Diagnostic

You leave with a prioritised plan. What you do with it is your call, and there are three sane options:

• Execute it yourself. The plan is written to be followed. Many firms do exactly this.
• Hand it to your existing providers. It's vendor-neutral — no product agenda baked in.
• Work with us. The Governance Blueprint turns the plan into a designed system, and Implementation makes it operational.

No obligation, no hard sell. The full track — from AI Act Readiness through Blueprint to Implementation — exists for the firms that want it; the Diagnostic works fine as a standalone answer.

Is it the right next step for you?

If you've read this far, the honest answer is: probably. Nobody reads a two-week project walk-through for fun. But "probably" isn't a booking basis — so book the 20-minute call and make it a certainty. The call is free, it's a conversation rather than a pitch, and if the answer is "you're not ready for a Diagnostic yet," you'll hear that too.

Not sure yet? Take the AI Act quiz (2 min) — if the result surprises you, this page is where you go next.