EU AI Act Compliance
The EU AI Act is the world’s first comprehensive AI regulation and is now largely applicable across the EU. While many obligations already apply, the main requirements for high-risk AI systems will take effect from December 2027 and August 2028, depending on the type of system.
If your organisation operates in the EU, places AI systems on the EU market, or uses AI systems whose outputs are used in the EU, the AI Act may apply to you.
This article explains EU AI Act compliance requirements, high-risk AI systems, and what your organisation needs to do to comply.
- Applies across the EU and, in certain circumstances, beyond it
- Uses a risk-based regulatory framework
- Many AI Act obligations already apply
- High-risk AI requirements apply from December 2027 or August 2028, depending on the system
- FRIAs are required for certain high-risk AI deployments
EU AI Act Timeline: Key Deadlines
What High-Risk AI Compliance Requires
For providers of high-risk AI systems, the AI Act sets out requirements covering the system throughout its lifecycle, including:
- Risk Management — ongoing identification, assessment and mitigation of risks
- Data Governance — appropriate data quality and governance measures to reduce risks, including discriminatory outcomes
- Technical Documentation — detailed documentation on the system, its purpose and compliance
- Record-Keeping & Traceability — logging capabilities to support monitoring and accountability
- Transparency & Instructions for Use — clear information enabling deployers to understand and use the system appropriately
- Human Oversight — measures enabling effective human supervision and intervention
- Accuracy, Robustness & Cybersecurity — appropriate levels of performance, resilience and security
- Conformity Assessment & Registration — conformity assessment and EU database registration where required
- Post-Market Monitoring — ongoing monitoring, incident reporting and corrective action
FRIA vs DPIA: Key Differences
When deploying high risk AI systems, organisations often need to conduct both a DPIA under GDPR and a FRIA under the AI Act. While the methodologies overlap, the scope differs significantly.
FRIA vs DPIA: How to Conduct AI Impact Assessments
Understand when a Fundamental Rights Impact Assessment is required, how it differs from a DPIA, and how to structure your assessment process in practice.
Read full guide →Penalties for Non-Compliance
EU AI Act Penalties & Enforcement Explained
Understand the financial exposure, enforcement structure, and real-world risks of non-compliance under the EU AI Act.
See penalty breakdown →Provider vs Deployer: Understanding Your Role Under the AI Act
Identify whether your organisation is acting as a provider or deployer — and understand the specific compliance obligations that follow from each role.
Explore roles →