What is the EU AI Act?

The EU AI Act is a comprehensive regulatory framework that governs how artificial intelligence systems are developed, placed on the market, and used within the European Union. It applies to both AI providers and deployers and establishes clear legal obligations based on how AI systems impact individuals, society, and fundamental rights. The Act promotes innovation while safeguarding health, safety, and fundamental rights by setting requirements for transparency, risk management, human oversight, data governance, and cybersecurity across the AI lifecycle.

The EU AI Act uses a risk-based approach, meaning AI systems are regulated according to the level of risk they pose to individuals and society. The higher the potential risk, the stricter the obligations imposed on providers and deployers.

• Prohibited practices
  AI systems that pose an unacceptable risk are banned outright. These include cognitive behavioural manipulation, social scoring by public authorities, indiscriminate scraping of facial images, and biometric inference of sensitive attributes such as political beliefs or sexual orientation.
• High-risk AI systems
  High-risk systems are those used in sensitive or regulated areas such as critical infrastructure, employment and HR, creditworthiness assessments, education, healthcare, law enforcement, border control, and the administration of justice. These systems must meet strict requirements, including risk management processes, high-quality training data, technical documentation, human oversight, cybersecurity safeguards, and CE marking before being placed on the market.
• General-purpose AI models (GPAI)
  This category includes large-scale models such as large language models (LLMs). Providers must meet transparency obligations, respect copyright rules, document training practices, and implement measures to address systemic risks, particularly for more capable or widely deployed models.
• Limited-risk AI systems
  These systems are subject primarily to transparency obligations. Users must be informed when they are interacting with AI-generated content, such as chatbots or deepfakes, unless an exception applies.
• Minimal or no-risk AI systems
  AI applications that pose little to no risk, such as AI-enabled video games or spam filters, are largely exempt from regulation under the AI Act.

Violations of the AI Act can result in fines up to EUR 35 million or 7% of global annual turnover, whichever is higher.

Since February 2, 2025, providers and deployers must ensure sufficient AI literacy among staff. Training is recommended but not mandatory.

Key considerations include the company's role, general understanding of AI, associated risks, and tailored literacy measures based on technical knowledge and context.

Implementing the EU AI Act requires organisations to translate regulatory obligations into operational controls. Audits play a critical role in this process by helping companies understand how AI systems are used, where risks exist, and what compliance measures are required.

These audits are intended to:

• Identify and classify AI systems according to the Act’s risk categories
• Determine whether the organisation acts as a provider, deployer, or both
• Assess how AI systems process data and generate outputs
• Identify gaps in transparency, human oversight, cybersecurity, and risk management
• Inform remediation plans, governance structures, and internal controls needed for compliance

In practice, these assessments form the foundation for AI governance programs and enable organisations to prioritise compliance efforts based on risk and regulatory exposure.