EU AI Act Compliance
EU AI Act | Regulation (EU) 2024/1689 | AI Governance & Compliance
Manage EU AI Act Compliance with Cetbix GRC
Bring AI governance, risk assessments, regulatory requirements, controls, evidence and corrective actions together in one central GRC environment. Build a structured approach to responsible AI and prepare your organisation for the obligations of the European Union Artificial Intelligence Act.
Request a demonstrationBuild trust through structured AI governance
Artificial intelligence is increasingly embedded in products, services and business processes. Organisations use AI to support decisions, interact with customers, analyse information, manage operations and automate activities. These applications can create value, but they can also introduce risks involving safety, fundamental rights, privacy, security, transparency and accountability.
The European Union Artificial Intelligence Act (EU AI Act), Regulation (EU) 2024/1689, establishes a harmonised legal framework for AI across the EU. It follows a risk-based approach: the obligations that apply depend on the AI system, its intended purpose, the role of the organisation and the level of risk involved.
Organisations may have responsibilities as providers, deployers, importers, distributors or product manufacturers. A company can also have more than one role, depending on how an AI system is developed, supplied, modified or used.
Cetbix GRC supports the management activities behind an AI governance programme by helping organisations structure requirements, risks, controls, accountable owners, evidence, assessments and remediation activities.
Understanding the EU AI Act
The AI Act is designed to promote human-centric and trustworthy AI while protecting health, safety and fundamental rights. It establishes different obligations for different AI risk categories and for the organisations involved in the AI value chain.
Risk-based regulation
Requirements are proportionate to the potential harm and the context in which an AI system is used.
Fundamental rights
The framework addresses risks to safety, equality, privacy, dignity and other protected rights.
Accountability
Providers and deployers have defined responsibilities for the systems they place on the market or use.
Transparency
People may need to be informed when they interact with AI or encounter certain AI-generated or manipulated content.
EU AI Act risk classification
The Act distinguishes between prohibited AI practices, high-risk AI systems, AI systems subject to transparency requirements and other AI systems. General-purpose AI models are also subject to a dedicated set of obligations.
Unacceptable risk
Certain AI practices are prohibited because they are considered to pose unacceptable risks to fundamental rights and EU values. Organisations must identify whether any planned or existing use falls within a prohibited practice.
High risk
Specific AI systems, including certain uses in sensitive areas and AI used as safety components of regulated products, are subject to extensive requirements. These include risk management, data governance, documentation, logging, human oversight and conformity-related obligations.
Limited risk / transparency
Certain AI systems are subject to transparency duties. Examples include informing people when they interact directly with an AI system and appropriately identifying certain synthetic or manipulated content.
Minimal or lower risk
Many AI applications are not subject to additional obligations under the Act beyond generally applicable law. Voluntary codes of conduct and sound governance practices may still be relevant.
The category depends on the specific system, intended purpose and legal criteria. The labels above are a practical overview, not a substitute for a documented classification assessment.
EU AI Act at a glance
| Area | Regulatory focus | Organisational response |
|---|---|---|
| Prohibited practices | AI practices identified by the Act as unacceptable and prohibited. | Screen AI use cases, document decisions and prevent prohibited uses. |
| High-risk AI | Requirements for specified high-risk systems and their operators. | Assess classification, establish controls, maintain documentation and monitor performance. |
| Transparency | Information and disclosure duties for specified AI interactions and generated or manipulated content. | Define notices, labelling, user information and technical measures where applicable. |
| General-purpose AI | Specific duties for providers of general-purpose AI models, with additional duties for models presenting systemic risk. | Identify provider responsibilities and maintain required technical, copyright, training-content and risk documentation. |
| AI literacy | Providers and deployers must take measures to ensure an appropriate level of AI literacy among relevant personnel. | Define role-based awareness, training and competence activities. |
| Governance and enforcement | EU and national oversight, market surveillance, cooperation and penalties. | Assign accountability, maintain traceable records and prepare for regulatory enquiries. |
1. Prohibited AI practices
The AI Act prohibits specified AI practices that are considered incompatible with EU values and fundamental rights. Examples include certain manipulative or exploitative techniques, specified forms of social scoring, certain uses of biometric categorisation and emotion recognition, and certain forms of individual risk assessment for criminal offending based solely on profiling or personality traits.
The precise prohibition depends on the legal conditions and exceptions set out in the Regulation. Organisations should assess actual functionality, purpose, context and safeguards rather than relying only on a product label or vendor description.
- Maintain an inventory of AI systems, models, features and relevant use cases.
- Screen intended purposes and actual deployment contexts against prohibited-practice rules.
- Document the classification rationale, legal review and approval decision.
- Define controls to prevent prohibited functionality or unauthorised use.
- Review material changes to systems, data, purpose and deployment context.
- Assign accountable owners for ongoing monitoring and escalation.
2. High-risk AI systems and their requirements
High-risk AI systems are subject to the most extensive requirements under the AI Act. They include certain AI systems used in areas listed in Annex III, such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and the administration of justice. Certain AI systems that are safety components of products, or products themselves, covered by EU harmonisation legislation can also qualify as high-risk.
For systems within scope, the Act establishes obligations that may apply to providers and, depending on their role, deployers and other operators. These can include a risk management system, data and data governance measures, technical documentation, record-keeping, transparency and information for deployers, human oversight, accuracy, robustness and cybersecurity. Applicable conformity assessment, registration and post-market monitoring requirements must also be considered.
Risk management
Identify, analyse, evaluate and address known and reasonably foreseeable risks throughout the relevant AI system lifecycle.
Data governance
Establish appropriate data practices for training, validation and testing datasets where the requirements apply.
Technical documentation
Maintain documentation that demonstrates how the system is designed, developed and assessed against applicable requirements.
Logging and traceability
Enable automatic recording of events to the extent required, supporting traceability and post-market monitoring.
Human oversight
Design and implement appropriate human oversight measures to reduce risks and support responsible use.
Accuracy, robustness and cybersecurity
Define and verify appropriate performance, resilience and security measures throughout the system lifecycle.
Cetbix GRC can support the governance processes associated with these requirements by linking applicable obligations to risks, controls, owners, evidence, assessments and corrective actions. The precise compliance activities depend on the organisation's role and the AI system's classification.
3. Transparency obligations
Article 50 establishes transparency obligations for specified AI systems and interactions. Depending on the use case and the organisation's role, people may need to be informed that they are interacting with an AI system. Certain AI-generated or manipulated content, including deepfakes, is subject to disclosure or labelling requirements. Specific rules also address emotion recognition and biometric categorisation systems.
Transparency requirements are context-dependent and include exceptions and qualifications. Organisations should identify which duties apply to each system and user journey, then establish appropriate technical and organisational measures.
- Identify AI interfaces and interactions where people must be informed they are interacting with AI.
- Determine when synthetic or manipulated content must be disclosed or marked.
- Define ownership for notices, labels and user-facing explanations.
- Assess machine-readable marking and detection measures where required.
- Retain evidence of design decisions, testing, implementation and periodic review.
- Update transparency controls when models, interfaces or use cases change.
Article 50 transparency requirements apply from 2 August 2026. A limited transition applies to the marking and detection obligation under Article 50(2) for certain AI systems placed on the market before that date, with compliance required by 2 December 2026.
4. General-purpose AI (GPAI)
The AI Act includes a dedicated regime for providers of general-purpose AI models. These models can perform a wide range of tasks and may be integrated into many downstream AI systems. The obligations differ according to whether a model is a general-purpose AI model or a model with systemic risk.
Obligations for providers of general-purpose AI models
- Prepare and maintain the required technical documentation.
- Provide relevant information and documentation to downstream AI system providers.
- Put in place a policy to comply with EU copyright law and related rights.
- Make publicly available a sufficiently detailed summary of the content used for training, in accordance with the applicable requirements.
Additional obligations for models with systemic risk
- Perform model evaluation and adversarial testing as required.
- Assess and mitigate systemic risks at Union level.
- Track, document and report serious incidents as required.
- Ensure an adequate level of cybersecurity protection.
The GPAI obligations became applicable on 2 August 2025, subject to the Act's transitional provisions. Cetbix GRC can help organisations structure responsibility, risk records, evidence and oversight activities. Whether an organisation is subject to provider-specific GPAI obligations depends on its role and the model concerned.
5. AI literacy and organisational competence
The AI Act requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among relevant staff and other persons dealing with the operation and use of AI systems on their behalf. The measures should take account of people's technical knowledge, experience, education and training, the context in which AI is used and the persons or groups affected.
AI literacy is not simply a one-time awareness course. Organisations should consider the different responsibilities of leadership, procurement, developers, system owners, operational users, compliance teams and human oversight personnel.
- Identify employee groups involved in developing, procuring, deploying or overseeing AI.
- Define role-specific learning objectives and competence expectations.
- Record training completion, attendance and relevant supporting material.
- Review training needs when systems, roles or risks change.
- Monitor whether staff understand limitations, appropriate use and escalation routes.
Cetbix GRC can support the governance of training and competence activities through responsibility assignment, evidence records, review schedules and management reporting, subject to the platform's configured capabilities.
6. Understand your role in the AI value chain
The AI Act allocates responsibilities to different operators. Correctly identifying the organisation's role is an essential part of determining which obligations apply.
| Role | General meaning | Typical governance focus |
|---|---|---|
| Provider | An organisation that develops an AI system or general-purpose AI model, or has it developed, and places it on the market or puts it into service under its name or trademark, subject to the Act's definitions. | Classification, conformity, technical documentation, quality and risk management, monitoring and provider-specific duties. |
| Deployer | An organisation or person using an AI system under its authority, other than personal non-professional use. | Use in accordance with instructions, competent human oversight, input data where relevant, monitoring and incident escalation. |
| Importer | An EU-based person or organisation placing on the EU market an AI system bearing the name or trademark of a third-country provider. | Verification of relevant provider documentation and conformity-related conditions before placing the system on the market. |
| Distributor | An organisation in the supply chain, other than the provider or importer, that makes an AI system available on the EU market. | Due diligence before making systems available and cooperation where non-compliance is identified. |
| Product manufacturer | A manufacturer placing an AI system on the market or putting it into service together with a product under its name or trademark, in the circumstances covered by the Act. | Product-level conformity and the applicable AI Act requirements for the integrated AI system. |
An organisation may assume different roles for different systems or activities. Contractual descriptions are relevant but do not alone determine the legal role. A documented role assessment should consider the actual activities and legal definitions.
7. EU AI Act implementation timeline
The AI Act applies progressively. The following milestones reflect the implementation timetable in force as of November 2026, including the revised dates for certain high-risk AI system requirements.
| Date | Milestone | Practical implication |
|---|---|---|
| 1 August 2024 | AI Act entered into force. | The Regulation entered the EU legal framework and the staged application timetable began. |
| 2 February 2025 | Definitions, AI literacy provisions and prohibited-practice rules began to apply. | Organisations should address prohibited uses and establish appropriate AI literacy measures. |
| 2 August 2025 | Governance provisions and GPAI model obligations began to apply, subject to transitional provisions. | Relevant providers need to assess and address GPAI-specific duties; EU and national governance arrangements apply. |
| 2 August 2026 | Most remaining provisions began to apply, including Article 50 transparency obligations and enforcement for applicable provisions. | Organisations need to comply with the provisions that have reached their application date, including applicable transparency duties. |
| 2 December 2026 | Additional prohibitions concerning non-consensual intimate material and child sexual abuse material apply; certain pre-existing systems reach the Article 50(2) transition deadline. | Review relevant content-generation capabilities and complete applicable marking and detection measures. |
| 2 December 2027 | High-risk AI requirements for systems listed in Annex III apply under the revised timetable. | Prepare classification, risk management, documentation, oversight and other applicable controls ahead of the deadline. |
| 2 August 2028 | High-risk AI requirements for AI systems embedded in products covered by Annex I apply under the revised timetable. | Manufacturers and other relevant operators should prepare for product-related conformity and AI governance requirements. |
8. Manage AI Act requirements through one GRC environment
AI Act compliance requires coordination between legal, compliance, information security, IT, data science, procurement, product, HR and business teams. A central GRC approach can help connect regulatory requirements to the risks and controls that are managed across the organisation.
- AI system inventory: Maintain a structured register of AI systems, models, owners, intended purposes, providers and deployment contexts.
- Regulatory requirements: Organise applicable AI Act provisions and internal requirements.
- Role and classification assessment: Record operator roles, risk category, rationale, scope and approval status.
- AI risk management: Identify, assess and monitor risks to people, operations, data, security and fundamental rights.
- Control management: Define controls, assign accountable owners and monitor implementation.
- Evidence management: Maintain policies, technical records, assessments, training evidence, logs and approvals.
- Gap analysis: Identify missing requirements, control weaknesses and evidence gaps.
- Corrective actions: Assign remediation activities, owners, priorities and target dates.
- Management reporting: Provide visibility into AI system status, risk exposure, control coverage and outstanding actions.
From AI Act requirement to risk, control and evidence
An AI governance programme becomes operational when regulatory requirements are connected to business risks, implemented controls, accountable owners and supporting evidence.
Illustrative example: human oversight of an AI-supported recruitment system
Regulatory context: Certain AI systems used for recruitment or selection of natural persons can fall within the high-risk use cases in Annex III, subject to the applicable legal criteria and exclusions.
Business context: An organisation uses an AI system to rank or filter job applications. It identifies a risk that recruiters may rely on system outputs without appropriate review or understanding of system limitations.
| GRC element | Illustrative record |
|---|---|
| Requirement | Applicable AI Act requirements for high-risk AI systems, including human oversight and deployer obligations, where the system is within scope. |
| Risk | AI-RISK-001 – Inappropriate reliance on automated candidate rankings could contribute to discriminatory outcomes, reduce meaningful human review or lead to unsuitable recruitment decisions. |
| Control | Define a documented human review process. Ensure authorised recruiters understand system limitations, can interpret outputs, can disregard or override recommendations where appropriate, and escalate suspected bias or malfunction. |
| Control owner | Head of Talent Acquisition, supported by HR Operations, Legal, Compliance and the AI System Owner. |
| Evidence | AI system inventory, classification assessment, vendor documentation, user instructions, training records, human review procedure, sampled decision records, monitoring results and incident logs. |
| Corrective action | CAPA-AI-001 – Review the recruitment workflow, update human oversight procedures, train relevant recruiters, test escalation routes and document periodic effectiveness reviews. |
| Outcome | A traceable governance record connecting the applicable requirement to the risk, control, responsible owner, supporting evidence and remediation status. |
The result: The organisation can maintain a structured record of its AI governance activities and retrieve relevant information for internal review, management oversight and regulatory engagement.
A structured AI Act readiness workflow
- Establish governance: Assign executive sponsorship, accountable roles and cross-functional responsibilities for AI oversight.
- Build an AI inventory: Identify AI systems and models developed, procured, supplied or used by the organisation.
- Determine operator roles: Assess whether the organisation acts as provider, deployer, importer, distributor or product manufacturer for each system.
- Define intended purpose and scope: Document use cases, affected groups, deployment context, system boundaries and relevant changes.
- Classify AI systems: Assess prohibited practices, high-risk status, transparency duties and GPAI relevance using the applicable legal criteria.
- Assess risks: Identify risks to health, safety, fundamental rights, privacy, security and business operations, as relevant.
- Map requirements to controls: Translate applicable obligations into policies, procedures, technical and organisational controls.
- Assign owners and evidence: Allocate responsibilities and define the records needed to demonstrate implementation.
- Perform gap analysis: Identify missing controls, incomplete documentation, competence gaps and overdue actions.
- Monitor and improve: Review AI systems, incidents, performance, risks and controls when systems or operating conditions change.
Continuous AI governance, not just regulatory preparation
AI governance should continue throughout the lifecycle of an AI system. Models, data, suppliers, business processes and intended purposes can change. New risks can emerge after deployment, and controls that were appropriate at launch may need to be reassessed.
Cetbix GRC can help organisations move from fragmented spreadsheets and periodic compliance exercises towards a more structured approach to governance, risk and control management.
- Maintain ownership of AI systems and recurring governance activities.
- Track risk assessments, classification reviews and approvals.
- Record AI literacy and role-based training activities.
- Monitor incidents, complaints, exceptions and control deficiencies.
- Maintain evidence and version history for relevant governance records.
- Track corrective actions, review dates and overdue remediation.
- Provide management visibility into AI risks and compliance activities.
More than an AI Act checklist
AI system inventory
Structure information about AI systems, models, owners, intended purposes and deployment contexts.
Regulatory mapping
Organise applicable obligations and connect them to internal requirements and control activities.
AI risk management
Identify, assess and monitor risks affecting individuals, systems, data and business processes.
Control ownership
Assign accountability and monitor control implementation, review and assessment status.
Evidence management
Organise policies, procedures, assessments, approvals, training records and supporting documentation.
Corrective actions
Turn identified gaps and findings into accountable remediation activities with target dates.
Who can benefit from Cetbix GRC?
- Organisations developing or providing AI systems and models.
- Companies deploying third-party AI tools in business processes.
- Software, SaaS and technology providers integrating AI capabilities.
- Manufacturers placing AI-enabled products on the EU market.
- Financial services, healthcare, education and other regulated-sector organisations using AI.
- Organisations using AI in recruitment, customer services, operations or decision support.
- Importers and distributors involved in the AI supply chain.
- Chief AI Officers, CISOs, data protection officers and compliance leaders.
- Risk, legal, internal control and internal audit teams.
Frequently asked questions
What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689. It establishes harmonised rules for artificial intelligence in the European Union, using a risk-based approach and setting obligations for relevant AI systems, models and operators.
Who needs to comply with the EU AI Act?
The Act can apply to providers placing AI systems or general-purpose AI models on the EU market or putting them into service, deployers using AI systems in the EU, and certain importers, distributors and product manufacturers. The exact scope depends on the organisation's activities and the Regulation's territorial and material scope.
What are the four AI risk categories?
A common practical summary distinguishes prohibited or unacceptable-risk practices, high-risk AI systems, systems subject to specific transparency duties and lower-risk AI systems. General-purpose AI models have a separate regulatory regime. The legal classification must be assessed against the Regulation's actual provisions.
What is considered high-risk AI?
High-risk AI includes certain systems listed in Annex III, such as specified uses in biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice. It also includes certain AI systems that are safety components of products, or products themselves, covered by the EU legislation listed in Annex I. Specific exclusions and classification rules apply.
When does the EU AI Act apply?
The Regulation entered into force on 1 August 2024 and applies progressively. Prohibited-practice and AI literacy provisions have applied since 2 February 2025; GPAI and governance provisions since 2 August 2025; and most remaining provisions, including Article 50 transparency rules, since 2 August 2026. Under the revised timetable, Annex III high-risk requirements apply from 2 December 2027 and relevant Annex I product-related requirements from 2 August 2028.
Does the EU AI Act apply to organisations outside the EU?
It can. The Act may apply to providers placing AI systems or general-purpose AI models on the EU market or putting them into service in the EU, and to providers and deployers established or located outside the Union where the output produced by the AI system is used in the Union, subject to the Regulation's scope and conditions.
What are the obligations for high-risk AI systems?
Depending on the system and operator role, requirements can include risk management, data governance, technical documentation, logging, information for deployers, human oversight, accuracy, robustness, cybersecurity, conformity assessment, registration and post-market monitoring.
What are the transparency requirements?
Article 50 includes duties for specified AI interactions and content. Examples include informing people when they interact directly with an AI system and disclosing or marking certain AI-generated or manipulated content, subject to the legal conditions and exceptions.
What is general-purpose AI (GPAI)?
GPAI models are models capable of competently performing a wide range of distinct tasks and that can be integrated into many downstream systems. The Act establishes obligations for providers of GPAI models and additional obligations for providers of models with systemic risk.
Is the EU AI Act a certification?
No. The AI Act is a regulation that establishes legal requirements. Certain high-risk AI systems are subject to conformity assessment procedures and other obligations, but organisations should not describe general AI Act compliance as a universal certification.
Can Cetbix GRC certify an organisation under the EU AI Act?
No. Cetbix GRC supports governance, risk, control, evidence and readiness management. It does not replace legal advice, conformity assessment, notified bodies, market surveillance authorities or other legally required independent activities.
Can AI Act controls be managed alongside ISO 27001, ISO 42001 or NIST AI RMF?
The Cetbix central GRC approach can help organisations manage related risks, controls and evidence across multiple frameworks. However, requirements are not automatically equivalent. Any mappings should be validated for scope, applicability and the organisation's actual processes.
How can Cetbix GRC support AI Act readiness?
Cetbix GRC can provide a structured environment for managing requirements, AI-related risks, controls, owners, evidence, assessments and corrective actions, subject to the capabilities and framework content configured in the live product.
Build a structured AI governance programme with Cetbix GRC
Discover how Cetbix GRC can help connect AI-related requirements, risks, controls, accountable owners, evidence and corrective actions in one central environment.
Contact us for a live demonstrationThe EU AI Act is Regulation (EU) 2024/1689, as amended. This page is for general information and does not constitute legal, audit or compliance advice. Applicability depends on the facts, the organisation's role, the AI system and relevant transitional provisions. Always consult the current official EU legal text and competent authorities for authoritative guidance.