The EU AI Act entered into force in August 2024. Most organizations have not completed their compliance assessment. That is the gap this post closes.
EU AI Act compliance is not optional for organizations with EU market exposure. The Act applies based on where AI systems are deployed and used, not where the organization is headquartered. A US company serving EU customers may be fully in scope. A company using AI in hiring, credit decisions, or healthcare delivery almost certainly is.
This guide breaks down the four risk tiers, what each requires, and what the compliance obligation looks like in practice.
What the EU AI Act Is
The EU AI Act is the world’s first comprehensive legal framework governing artificial intelligence. It was adopted in 2024 and establishes a regulatory regime that classifies AI systems by risk level, prohibits certain applications outright, and imposes graduated compliance obligations on the rest.
EU AI Act compliance operates on a fundamental principle: the higher the risk to fundamental rights, safety, or societal stability, the more stringent the requirements before deployment. This is not a self-assessment framework. It carries enforcement authority, fines, and market access consequences.
Who EU AI Act Compliance Applies To
The Act applies to:
- Providers: Organizations that develop or place AI systems on the EU market, including those based outside the EU
- Deployers: Organizations that use AI systems in a professional context within the EU
- Importers and distributors: Entities that bring AI systems developed elsewhere into the EU market
The territorial scope is the key point for US organizations. If your organization provides services in the EU, employs people in the EU, or deploys AI systems that affect EU individuals, you are likely in scope. Jurisdiction follows the market, not the headquarters.
The 4 Risk Tiers
Tier 1: Unacceptable Risk, Prohibited
Certain AI applications are prohibited outright under the EU AI Act. These represent uses that EU regulators determined pose risks incompatible with fundamental rights. Prohibited systems include:
- AI that manipulates behavior through subliminal techniques
- AI that exploits vulnerabilities of specific groups (age, disability, social situation)
- Social scoring systems by public authorities
- Real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions)
- AI that predicts criminal behavior based solely on profiling
Organizations deploying any system that falls into this category face prohibition orders and significant fines regardless of their location.
Tier 2: High Risk, Strict Pre-Deployment Requirements
High-risk AI systems are subject to the most extensive compliance obligations in the Act. A system is high-risk if it poses significant risk to health, safety, or fundamental rights. The Act defines high-risk categories specifically:
- AI used in hiring, CV screening, and employment decisions
- AI in credit and insurance scoring
- AI in critical infrastructure (water, gas, electricity, transport)
- AI in educational assessment and access to education
- AI in law enforcement and border control
- AI in administration of justice and democratic processes
- AI in medical devices and safety components
What high-risk compliance requires:
- Risk management system: A documented, ongoing process identifying and mitigating risks specific to the AI system
- Data governance: Controls over training, validation, and testing data including bias testing and data quality standards
- Technical documentation: Comprehensive records allowing assessment of conformity with the Act
- Logging and record-keeping: Automatic logging of operation sufficient to trace decisions post-deployment
- Transparency to deployers: Providers must give deployers the information needed to fulfill their obligations
- Human oversight: Design measures enabling humans to monitor, override, or halt system operation
- Accuracy, robustness, and cybersecurity: Documented performance standards and security controls
- Conformity assessment: Third-party or self-assessment confirming the system meets requirements before market placement
The conformity assessment is the critical gate. High-risk AI cannot legally go to market in the EU without it.
Tier 3: Limited Risk, Disclosure Obligations Only
Limited risk AI systems face transparency obligations rather than pre-deployment requirements:
- Chatbots and conversational AI must disclose to users that they are interacting with an AI system
- AI-generated content, deepfakes, and synthetic media must be labeled as AI-generated
- Emotion recognition systems must notify individuals that their emotional state is being analyzed
These obligations are ongoing. Every user interaction requires the disclosure. Non-compliance is an enforcement risk even without a high-risk classification.
Tier 4: Minimal Risk, No Specific Obligations
Most AI systems fall into this category: spam filters, AI-powered games, recommendation engines with low societal impact. The Act imposes no specific requirements, though voluntary codes of conduct are encouraged.
The Compliance Timeline
The EU AI Act is being implemented in phases:
- February 2025: Prohibited AI provisions apply
- August 2025: Obligations for General Purpose AI (GPAI) models and governance rules apply
- August 2026: High-risk AI system requirements fully apply
- August 2027: Certain additional obligations for existing systems apply
The timeline matters for GRC planning. High-risk AI compliance has a defined deadline. Organizations that have not begun their conformity assessment process are running behind.
What EU AI Act Compliance Looks Like in Practice
For most GRC programs, EU AI Act compliance starts with four questions:
- Does the Act apply to us? Assess EU market exposure. If you have EU customers, EU employees, or AI-enabled services reaching the EU, the answer is likely yes.
- Do we have any prohibited AI? Audit current AI systems against the prohibited list. This is a binary check.
- Which of our systems are high-risk? Map each AI system against the high-risk categories. Any system used in hiring, credit, healthcare, or critical infrastructure warrants assessment.
- What do we have documented? High-risk compliance requires prior documentation: risk management records, data governance procedures, technical files, and conformity assessment records.
The answer to question 4 is where most organizations discover their gap. The AI systems are running. The documentation does not exist.
Frequently Asked Questions
Does the EU AI Act apply to US companies?
Yes, if the company places AI systems on the EU market or deploys them within the EU. Jurisdiction follows the market. A US company with EU customers or EU employees using AI tools is potentially in scope for EU AI Act compliance.
What are the fines for non-compliance?
Fines under the EU AI Act are tiered. Violations of prohibited AI provisions can reach 35 million euros or 7% of global annual turnover, whichever is higher. Non-compliance with high-risk requirements can reach 15 million euros or 3% of global turnover.
What is a conformity assessment?
A conformity assessment is the process by which a provider demonstrates that a high-risk AI system meets the requirements of the EU AI Act before placing it on the market. Some high-risk categories require third-party certification bodies. Others allow self-assessment with technical documentation.
How does EU AI Act compliance relate to ISO 42001?
They are complementary. ISO 42001 provides the management system structure for AI governance. EU AI Act compliance defines the specific regulatory obligations. An organization implementing ISO 42001 is building the governance infrastructure that supports EU AI Act compliance documentation.
Conclusion
EU AI Act compliance is not a future concern. The prohibited AI provisions applied in February 2025. High-risk requirements apply fully by August 2026. Organizations deploying AI in hiring, credit, healthcare, or critical infrastructure are already in the compliance window.
The starting point is the same as any compliance program: know what you have. An AI system inventory is the first deliverable. Classification against the four risk tiers is the second. Documentation comes from there.
Organizations that begin the assessment now have the most options. Organizations that begin it when an enforcement action starts have none.
If your organization needs EU AI Act compliance documentation, the GRC documentation service on Fiverr delivers AI system inventories, risk tier classification templates, and policy documentation aligned to the Act’s requirements. View the GRC documentation service on Fiverr.
Leave a Reply