EU AI Regulation

EU AI Act

A practical guide to the EU AI Act; who it applies to, how the risk-based framework works and what organisations need to do to comply.

At a Glance Explore the Framework
EU AI Act regulation and organisational compliance
Regulation (EU) 2024/1689

At a Glance

The EU AI Act establishes a common legal framework for AI across the European Union. What an organisation must do depends on the AI involved, the risk it presents and the role the organisation performs.

The Act is being applied in stages. Prohibited practices, AI literacy and general-purpose AI requirements are already in force, with further provisions taking effect through 2026 and beyond.

The first challenge is knowing which AI is in scope, which obligations apply and whether the organisation can demonstrate compliance in practice.

What It Means

What It Means

The Act creates different obligations according to the AI involved, its risk, how it is used and the legal role an organisation performs.

01
Prohibited Practices

Certain AI practices are prohibited. Organisations need sufficient visibility of actual AI use to identify and prevent prohibited activity.

Priorities
  • • Identify AI use
  • • Screen prohibited practices
  • • Escalate concerns
  • • Record decisions
Key Stakeholders

Legal, Compliance, Governance, Risk, HR and Leadership.

02
High-Risk AI

High-risk systems can face extensive requirements covering risk management, data, documentation, oversight, performance and cybersecurity.

Priorities
  • • Determine high-risk status
  • • Map obligations
  • • Strengthen controls
  • • Maintain evidence
Key Stakeholders

Product, Data, Engineering, Risk, Compliance, Legal and Security.

03
Transparency

Certain AI interactions and synthetic or manipulated content require people to be informed or content to be appropriately marked.

Priorities
  • • Identify affected systems
  • • Define disclosures
  • • Implement marking controls
  • • Monitor compliance
Key Stakeholders

Product, Legal, Compliance, Communications and Digital.

04
General-Purpose AI

Providers of general-purpose AI models face specific obligations, with additional requirements applying to certain models presenting systemic risk.

Priorities
  • • Understand model dependencies
  • • Review supplier information
  • • Map value-chain roles
  • • Govern integration
Key Stakeholders

AI, Engineering, Procurement, Legal, Security and Product.

05
Legal Roles

Responsibilities differ for providers, deployers, importers, distributors, product manufacturers and other operators across the AI value chain.

Priorities
  • • Map roles by system
  • • Assign accountability
  • • Review contracts
  • • Confirm responsibilities
Key Stakeholders

Legal, Procurement, Product, Technology and Governance.

06
Governance & Evidence

Compliance depends on working governance, documented decisions and evidence that applicable controls operate in practice.

Priorities
  • • Assign ownership
  • • Embed lifecycle governance
  • • Maintain evidence
  • • Monitor change
Key Stakeholders

Leadership, Governance, Risk, Compliance, Audit and Technology.

Who the Act Applies To

Applicability depends on the AI involved, where it is supplied or used and the legal role an organisation performs. The same organisation may hold different roles across different AI systems.

Providers placing AI systems or general-purpose AI models on the EU market.
Deployers using AI systems under their authority within the European Union.
Importers, distributors and product manufacturers involved in making AI systems available in the EU.
Certain organisations outside the EU where the output of an AI system is used within the European Union.
Organisations that can assume provider obligations through rebranding, substantial modification or changes to intended purpose.
Organisations that need to determine their legal role and obligations separately for each relevant AI system.
EU AI Act scope and applicability across the AI value chain
High-Risk AI Requirements

The EU AI Act Framework

For high-risk AI systems, the EU AI Act establishes a connected framework covering risk, data, documentation, traceability, transparency, human oversight, performance and security. These requirements need to work together throughout the AI lifecycle, supported by clear accountability and evidence that controls operate in practice.

01. Risk Management

High-risk AI systems require an ongoing risk management process covering the system throughout its lifecycle. Organisations need to identify and evaluate known and reasonably foreseeable risks, apply appropriate controls and respond when testing, monitoring or post-market evidence reveals new concerns.

In practice, this means risk assessment cannot be a one-off approval before deployment. It needs to remain connected to system changes, actual use, monitoring results and emerging risks.

Where high-risk systems are developed using data, the Act places requirements on the governance and management of relevant training, validation and testing datasets. Attention may be required across data quality, relevance, representativeness, collection processes, preparation, assumptions, potential bias and the context in which the system is intended to operate.

Organisations therefore need to understand where important data comes from, how it has been prepared, which limitations are known and whether the evidence supporting data suitability can be maintained.

High-risk systems require technical documentation capable of demonstrating how the system has been developed and how it complies with applicable requirements. Documentation needs to remain sufficiently complete and current for relevant authorities to assess compliance.

For organisations, the challenge is often not creating documents but keeping technical, risk, governance and operational evidence aligned as systems change.

High-risk systems must technically allow for the automatic recording of events relevant to their operation throughout their lifetime. Effective logging helps organisations understand how a system operated, investigate incidents, monitor performance and provide evidence when decisions or outcomes need to be examined.

This creates a practical need to define what must be recorded, who can access relevant records, how long information must be retained and how logs connect to monitoring, incident management and assurance.

High-risk systems must provide deployers with information that enables them to understand and use the system appropriately. This includes information about relevant capabilities, limitations, intended purpose and the measures needed to support effective operation and oversight.

Transparency therefore needs to be operational rather than purely technical: the people responsible for deploying and overseeing the system need information they can actually use when making decisions.

High-risk systems must be designed so that appropriate human oversight can be exercised during their use. The people providing oversight need sufficient understanding, authority and ability to recognise limitations, interpret outputs appropriately and intervene where necessary.

Simply placing a person in the process is not enough. Meaningful oversight requires clear responsibility, usable information, defined intervention points and the practical ability to challenge, disregard or stop AI-supported activity where appropriate.

High-risk systems must achieve appropriate levels of accuracy, robustness and cybersecurity and perform consistently in line with those expectations throughout their lifecycle.

Organisations need defined performance expectations, appropriate testing and monitoring, resilience against faults and manipulation, and clear processes for responding when performance deteriorates or security weaknesses emerge.

The system-level requirements sit within wider obligations that depend on the organisation's role. Providers of high-risk systems have wider obligations including quality management, conformity assessment, registration, corrective action, post-market monitoring and cooperation with competent authorities. Deployers have separate responsibilities for appropriate use, human oversight, monitoring and record keeping, with additional duties applying in certain contexts.

Compliance evidence may therefore be distributed across legal, product, engineering, data, security, risk, procurement and operational teams. Effective governance needs to connect those responsibilities and maintain a defensible record of important assessments, approvals, controls and decisions.

The starting point remains role classification. The same organisation can hold different responsibilities across different systems, and certain actions involving an existing system can result in additional provider obligations. The control framework should follow the role and obligations that apply to each specific AI system.

What Organisations Need to Do

EU AI Act readiness starts with understanding actual AI use, then connecting each relevant system to the organisation's role, risk classification, obligations and supporting evidence.

01
Find Your AI

Build a reliable inventory of AI systems, embedded AI features, general-purpose models and material third-party AI across the organisation.

02
Determine Your Role

Identify the legal role performed for each relevant system and recognise where that role can change across the AI lifecycle.

03
Classify the AI

Determine whether prohibited-practice rules, high-risk requirements, transparency duties, GPAI provisions or other obligations apply.

04
Test Current Controls

Compare applicable requirements with current governance, documentation, data controls, oversight, security, monitoring and supplier arrangements.

05
Close the Gaps

Assign owners and embed required controls into procurement, development, deployment, change management and operational governance.

06
Evidence & Monitor

Maintain the assessments, approvals, documentation, logs and monitoring evidence needed to demonstrate ongoing compliance.

EU AI Act Readiness Snapshot

Use this quick snapshot to consider whether the EU AI Act may be relevant to your organisation and how strong your current readiness foundations appear. Applicability and readiness are assessed separately so greater AI exposure does not incorrectly increase your readiness score.

1. Applicability Signals

Select the statements that reflect your organisation's AI environment. These do not increase your readiness score; they indicate where closer assessment of the Act may be required.

2. Your Readiness

Select only the statements you could demonstrate with reliable organisational evidence today.

Your Readiness Snapshot

Your readiness score reflects the governance foundations you selected. Applicability signals are shown separately because greater regulatory exposure does not mean greater readiness.

Readiness Score
0 /10
Applicability Signals
0 /5
Snapshot Summary

Select the statements that apply to generate your indicative EU AI Act readiness snapshot.

0–3 | Early Stage

Core visibility and governance foundations appear limited. Prioritise AI inventory, role mapping, classification and accountable ownership.

4–7 | Developing

Important foundations are emerging, but material gaps may remain across controls, supplier governance, evidence and ongoing monitoring.

8–10 | Stronger Foundations

More mature foundations appear to be in place. Focus should move to validating effectiveness, addressing system-specific obligations and maintaining evidence over time.

This snapshot is indicative only. It does not determine whether the EU AI Act applies to a particular organisation or system, establish legal classification or demonstrate regulatory compliance.

Need a Deeper View of Your AI Governance?

Take the full AI Governance Assessment™ to examine how your organisation manages accountability, oversight, risk, lifecycle controls, evidence and governance in practice.

Take the AI Governance Assessment
From Readiness to Implementation

Implementation Roadmap

A practical route from understanding AI use and legal exposure to embedded controls, reliable evidence and ongoing regulatory oversight.

01

Establish Visibility

Build a reliable view of material AI systems, models, embedded AI capabilities and significant third-party dependencies.

02

Map Applicability

Determine organisational roles, potential risk categories and which EU AI Act obligations may apply to each relevant system.

03

Prioritise Exposure

Address prohibited practices, potentially high-risk AI and material compliance gaps before lower-priority improvements.

04

Strengthen Controls

Close priority gaps across governance, documentation, human oversight, data, security, monitoring and supplier management.

05

Build the Evidence

Maintain reliable records of classifications, assessments, approvals, controls, responsibilities and material decisions.

06

Maintain Readiness

Review systems, suppliers, controls and regulatory developments as AI use, organisational roles and obligations change.

Where Readiness Breaks Down

Common Gaps

Many readiness problems begin before detailed compliance controls are designed. Organisations may not have a reliable AI inventory, may misunderstand their legal role or may apply inconsistent classification decisions across different systems.

Further weaknesses often appear in fragmented ownership, incomplete documentation, weak supplier evidence, nominal human oversight and governance processes that do not keep pace as AI systems, intended uses or regulatory expectations change.

Strengthen Readiness
Common EU AI Act governance, classification and compliance gaps
INTAI EU AI Act governance, readiness and implementation support
From Requirements to Practice

How INTAI Can Help

INTAI helps organisations translate EU AI Act requirements into governance and control arrangements aligned to their actual AI systems, legal roles and operating environment.

Support can include AI inventory and role mapping, applicability reviews, governance and control gap assessments, implementation planning, supplier assurance, evidence design and preparation for ongoing monitoring and independent review.

Discuss EU AI Act Readiness
INTAI AI Governance Assessment

Ready to examine how your organisation governs AI? Take the AI Governance Assessment™

Frequently Asked Questions About the EU AI Act.

What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689, a European Union regulation establishing harmonised rules for artificial intelligence. It uses a risk-based approach and sets different requirements depending on how an AI system is developed, supplied or used, the role of the organisation involved and the potential impact of the AI system.

The EU AI Act can apply to organisations acting as providers, deployers, importers, distributors and product manufacturers, as well as providers of general-purpose AI models. Its territorial reach can also extend beyond organisations established in the European Union where the conditions set out in the Regulation are met.

Yes, in certain circumstances. The EU AI Act has provisions that can apply to organisations established outside the European Union, including where AI systems or general-purpose AI models are placed on the EU market or where the output produced by an AI system is used in the European Union. Applicability should be assessed against the organisation's specific role, activities and AI systems.

The EU AI Act applies different regulatory requirements according to the nature and potential impact of AI. Certain practices are prohibited, specified high-risk AI systems are subject to extensive requirements, some AI systems have transparency obligations and general-purpose AI models are subject to a separate set of obligations. Many other AI systems are not subject to the same level of mandatory requirements under the Act.

High-risk AI systems are AI systems that fall within defined categories in the EU AI Act, including certain systems connected to regulated products and specified use cases listed in the Regulation. Depending on the circumstances, requirements can include risk management, data governance, technical documentation, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity and ongoing monitoring.

The EU AI Act prohibits specified AI practices considered incompatible with fundamental rights and European Union values. Organisations should determine whether any current or proposed AI use could fall within a prohibited category and should not rely solely on a technology label or vendor description when assessing applicability.

The EU AI Act establishes obligations for providers of general-purpose AI models, with additional requirements for certain models presenting systemic risk. Organisations using general-purpose AI should also understand their own role in the AI value chain, how models are incorporated into downstream systems and whether additional obligations arise from the way those systems are developed or deployed.

A practical starting point is to create visibility of AI use, identify relevant legal roles, assess which systems may fall within the Act, prioritise higher-risk use cases, review existing governance and controls, assign accountability and establish an implementation plan for any applicable requirements. Organisations should also maintain evidence of the decisions and assessments supporting their approach.

No. Standards and frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework can support aspects of AI governance and risk management, but using them does not automatically demonstrate compliance with the EU AI Act. Organisations need to assess the Regulation's specific legal requirements and determine how their governance framework supports those obligations.

INTAI can help organisations understand their AI landscape, assess potential applicability, review governance and control readiness, identify priority gaps and develop practical implementation plans. Support can include AI inventories, role and risk mapping, governance frameworks, control design, supplier review, evidence requirements, readiness assessments and assurance preparation.

Related EU AI Act Services.

Explore services that help organisations assess applicability, strengthen governance, close compliance gaps and build the evidence needed for ongoing AI oversight.

Compliance AI Regulatory Compliance

Translate regulatory requirements into practical governance, controls, responsibilities and evidence.

Explore Compliance
Readiness Compliance Gap Analysis

Identify priority gaps between applicable requirements, current controls and available evidence.

Explore Readiness
Governance AI Governance Strategy

Establish clear accountability, ownership and decision rights across the AI lifecycle.

Explore Governance
Risk AI Risk Classification

Assess AI systems consistently and prioritise the use cases requiring greater scrutiny and control.

Explore Risk
Assurance AI Assurance Reviews

Test governance, controls and evidence to support greater confidence and audit readiness.

Explore Assurance
Advisory AI Regulatory Advisory

Interpret changing AI requirements and connect them to practical organisational decisions.

Explore Advisory
Scroll