AI Act-audit
for transport en logistics
Optimising routes is one thing. Assessing drivers is another.
Route planning, fleet optimisation and estimated arrival times usually fall outside the high-risk category. For those systems, the main obligation is AI literacy, which has applied since 2 February 2025.
The tipping point is the driver. Once a system scores driving behaviour, measures performance, allocates journeys or monitors rest periods, it is assessing people. That brings it within Annex III, with a duty to inform your staff and their representatives before the system is put into use. In practice that function usually sits in the same telematics box as the fuel reporting.
Most transport companies do not build that software themselves. They buy it from a telematics supplier and assume the obligations sit there.
Driver and telematics
We establish which functions in your telematics system assess drivers' behaviour or performance, and which only track the vehicle.
That distinction determines which category the system falls into. We also look at what happens with those scores. Do they feed into scheduling, appraisals or pay?
Scheduling and allocation
We determine where route optimisation ends and work allocation begins. An algorithm that distributes routes among drivers also makes decisions about their working day and their income.
Once this is the case, you have an obligation to inform your employees and their representatives.
Purchased systems
Your TMS, telematics unit and on-board computer come from external suppliers. We determine who is the provider and who is the deployer in that chain.
Anyone who places a system under their own name or changes its intended purpose becomes the provider, even if the contract suggests otherwise.
Samenloop met bestaande
regels
Driving and rest times, tachographs and ADR each have their own regulatory framework.
We map out where those obligations already cover what the EU AI Act requires, so that you do not document the same thing twice, and where the two frameworks diverge.
What you receive
An inventory of the AI systems within scope, a qualification for each system, and a prioritised list of the gaps identified. The qualification is the work of the affiliated lawyers, acting in their own name and under their own professional indemnity insurance.
We carry out the audit and compile the report. We do not assess conformity and we do not issue certificates.
After the audit,
Automation
The remediation plan is yours. You can carry it out in-house, with your existing supplier, or with us.
If the audit shows that your AI systems run on US infrastructure and you want that to change, that is a separate question.
That is what we are developing Thor for: a self-hosted environment in which your business data does not leave Europe. Development starts on 1 November 2026 and runs for six months, against thresholds set in advance. It is a separate engagement, not a follow-on from the audit.