If you search “EU AI Act compliance” in 2026, you will hit a wall of options: free diagnostics, SaaS platforms, consulting firms, checklists, and courses. Most of them look similar from the outside — a quiz, a dashboard, a report, a price.
They are not the same, though. Once you look at the decision dimensions that actually matter — who owns the evidence, where the data sits, and what you can show an auditor — the market splits into three clearly different models. This is a map of those three, and a way to choose.
The three models
1. Compliance SaaS platforms
These are the most numerous. They offer a free diagnostic or a scan, then a subscription platform that tracks your obligations, generates documentation, and shows a dashboard. The positioning across the category is consistent: “assess, report, and track your AI Act readiness.”
What they do well:
- Fast to start. A free scan gives you an immediate, structured answer to “where do I stand?”
- A shared vocabulary: risk classification, obligation tracking, deadline reminders.
- Documentation generated for you, which is useful if you have no engineering to build it.
What to weigh:
- You rent the compliance. The evidence lives in their platform, on their infrastructure. If your obligation under Article 26(4) is to retain execution logs you control, a dashboard screenshot is not the same as a log you can produce.
- The data goes somewhere you don’t decide. If the compliance tool itself processes data about your AI systems (or your data samples), that is a new data flow to account for under GDPR.
- The tool is not the system it audits. A SaaS compliance platform tracks your AI; it does not govern your AI. The runtime that enforces the control is still yours to build or buy separately.
This is a reasonable choice for organisations that need a fast, low-effort way to inventory obligations and are comfortable with the evidence living in a third-party platform.
2. Consulting and services
These are local and expert-led — firms in the Netherlands and Italy that classify your systems, map your obligations, and produce the compliance documentation and roadmap. Many offer a free scan or quick assessment as the entry point.
What they do well:
- Judgement. The AI Act is a legal instrument with interpretive grey areas — who is a deployer vs. a provider, whether a system is high-risk — and that call needs a human who has read the Annexes.
- Local context. A firm that understands the Dutch or Italian enforcement environment and your industry adds real value.
- End-to-end. They can take you from “we use AI in our CRM” to a documented, defensible position.
What to weigh:
- The deliverable is a document, not a control. A good consultancy gives you the evidence and the roadmap. But if the underlying controls (logging, routing, approval) are not built into your systems, the compliance is a snapshot — it holds until the next change, and then you re-derive it.
- You are paying for the mapping every time something changes. A consultancy is a project; the ongoing enforcement of the control is still on you.
This is a strong choice when you need the obligation mapping, the legal interpretation, and the initial documentation, and you have (or will hire) engineering to implement the controls.
3. Self-hosted governance (open source)
This is the third model, and it is the least common in the AI Act context specifically. Instead of a platform that tracks your AI or a consultancy that documents it, you deploy an open-source governance layer that enforces the control in the execution path of your own AI system — model routing, guardrails, approval gates, structured audit logging — and you keep the code, the logs, and the evidence.
What it does well:
- You own the evidence. The audit log is generated by your system, in your infrastructure, under your retention policy. When an auditor asks for the Article 12 log, you produce the actual log — not a screenshot of someone else’s dashboard.
- The control survives change. Because the enforcement is in the runtime, every new model, prompt, or workflow still passes through the same governance boundary. Compliance does not rot when the system changes.
- Data residency is a design choice, not a policy sentence. Sensitive workloads route to private models on your infrastructure; the decision is explicit and logged. This is the cleanest way to satisfy both the AI Act and GDPR data-control expectations at the same time.
What to weigh:
- It is engineering, not a click. You need (or hire) a team that can deploy and operate it. It is not a zero-effort dashboard.
- It is young. A self-hosted governance runtime for the JVM (like TramAI) is a newer category than the established SaaS platforms, so you are trading maturity for ownership.
- It governs, it does not advise. It enforces the technical controls. The legal interpretation — is this system high-risk, which Annex applies — still needs a human judgement.
This is the right choice when you have engineering, when data residency is a genuine constraint, and when you want the compliance to be a durable property of the system rather than a periodic document.
The decision table
| Dimension | SaaS platform | Consulting | Self-hosted (open source) |
|---|---|---|---|
| Time to first answer | Minutes (free scan) | Days (assessment) | Weeks (implementation) |
| Who owns the evidence | The vendor’s platform | You (as a document) | You (as a log, in your infra) |
| Where the data sits | Vendor cloud | N/A (advisory) | Your infrastructure |
| Does it enforce the control? | Tracks, does not enforce | Recommends, does not enforce | Enforces, in the execution path |
| Survives system change? | Partial (re-scan) | No (re-engage) | Yes (runtime boundary) |
| Legal interpretation | Template-based | Expert judgement | You bring it in |
| You are renting or owning | Renting | Buying a snapshot | Owning |
| Effort required | Low | Medium (their effort) | Higher (your engineering) |
A note on fairness
These three models are not in competition for the same job. A lot of the strongest outcomes come from combining them: a consultancy for the legal interpretation and obligation mapping, and a self-hosted governance runtime for the durable technical control. The SaaS platform is the right answer when you have no engineering and need speed. The consultancy is the right answer when you need judgement and documentation. The self-hosted runtime is the right answer when you need the compliance to be a permanent, auditable property of a system you own.
The honest question is not “which tool is best?” It is “for each obligation I have, do I want to rent the answer, buy a snapshot of it, or own the control that produces it continuously?”
If you want the second model, concretely
If you are a team that would rather own the control than rent the dashboard, that is exactly what TramAI is built for: an open-source governed AI runtime for the JVM (Java, Kotlin, Spring Boot) that enforces model routing, guardrails, approval gates, and structured audit logging in the execution path. See how it maps to the EU AI Act →
If you are not sure which model fits your situation, the fastest way to find out is a fixed-scope assessment: an inventory of your AI systems, a risk classification, and a gap analysis against the deployer obligations — with a recommendation on which of the three models (or combination) fits. Book the €500 readiness audit →
Related
- TramAI: the governed AI runtime for the JVM
- EU AI Act: the full guide to obligations, deadlines, and penalties
- TramAI vs. LangChain for EU AI Act compliance
This article is for informational purposes and is not legal advice. The product names mentioned are used to describe the market fairly and are the property of their respective owners. For authoritative guidance on the EU AI Act, refer to the official EU AI Act Service Desk.
