The AI Act in practice: How Anywhere helps assess your software's compliance with new EU rules

Framework structure of the EU AI Act and risk categorization

The EU Artificial Intelligence Act introduces a risk-based framework that classifies AI systems into four levels according to their potential impact on health, safety, and fundamental rights. This categorization stems from extensive risk assessment and recognized practices in product safety and rights protection within the European Union.

The most serious category includes systems with unacceptable risk, which are directly prohibited. These AI practices pose a clear threat to people's safety, livelihoods, and rights.

Examples include social scoring, manipulative techniques exploiting vulnerabilities, evaluation of social behavior or personal characteristics for purposes other than their original collection, and indiscriminate facial image extraction from the internet for biometric databases. Other prohibited uses include emotion recognition in workplaces or schools, and real-time remote biometric identification in public spaces without legal exceptions.

As of December 18, 2024, placing, putting into service, or using these systems in the EU is prohibited. Violations can incur high penalties, up to 35 million euros or 7% of global annual turnover, whichever amount is higher.

The second and most extensive category comprises high-risk AI systems. While not directly prohibited, their development and deployment are subject to strict requirements to minimize risks to fundamental rights, safety, or financial standing.

High-risk systems include AI used in critical infrastructure, education and vocational training, recruitment and managerial decisions, credit or insurance assessment, legal and judicial decisions, criminal justice, and border controls. This category also covers AI systems that are safety components of regulated products, such as medical devices or automobiles.

For instance, a CV scanning tool that automatically sorts candidates based on qualifications is now regulated as high-risk. Placing these systems on the market or putting them into service without compliance constitutes a legal breach, potentially incurring fines of up to 15 million euros or 3% of global turnover.

The third category encompasses limited-risk AI systems, which are not high-risk but fall into specific areas like chatbots or deepfake generators. These systems are subject to a lower degree of regulation, primarily transparency requirements. Providers and deployers must ensure users know they are interacting with AI and that AI-generated content is clearly identifiable.

Finally, the fourth category consists of minimal-risk or unregulated AI systems. This includes applications such as AI-powered video games, spam filters, or common productivity tools. In these cases, virtually no obligations apply under the AI Act.

A key observation from practice is that the boundaries between categories are not always clear. The choice between high-risk and low-risk classification often depends on the context, deployment method, and how the AI system specifically influences decision-making, health, or personal safety.

The regulation acknowledges this uncertainty by allowing providers who believe their system, falling under Annex III (list of high-risk use cases), is not actually high-risk, to document this assessment before placing it on the market. This approach is not static; it requires continuous assessment and monitoring.

The methodology for determining whether an AI system is high-risk therefore requires a systematic assessment. First, it is necessary to clarify precisely what the system does, its inputs and outputs, its application area, and its impact on individuals' decisions or safety.

Then, an assessment must be made as to whether it falls under Annex II or III. If so, it is necessary to verify whether it meets any of the exceptional conditions. This process is not a one-off; if the system changes or its deployment alters, the assessment must be repeated.

In practice, organizations often lack this systematic approach. They may initially be uncertain whether their systems are AI at all, and if so, what their risk profile is. In such cases, it makes sense to keep briefs, documents, and future steps in one centralized location. This allows for gradual accumulation of all relevant information and ensures the assessment is complete and correct.

Definition and identification of high-risk AI systems

High-risk AI systems are defined in the AI Act across two main categories. The first includes AI systems serving as safety components of products covered by EU harmonization law, such as medical devices, cars, or aircraft, where third-party assessment is required by corresponding legislation.

The second category covers specific uses listed in Annex III of the AI Act. These include AI systems in biometric identification, critical infrastructure, education, employment, provision of public and private services, criminal justice and administration, migration and border controls, and other areas demanding high trust and accuracy in decision-making.

An important part of the definition concerns what is considered high-risk in the employment sector. AI systems designed for recruiting individuals, especially for targeted job advertisements, application analysis and filtering, or candidate evaluation, are classified as high-risk.

Similarly, AI systems intended for making decisions on employment terms and conditions, promotion, or termination are regulated as high-risk. This also applies to systems for task allocation based on individual behavior or personal characteristics, or for monitoring and evaluating employee performance and conduct.

The practical implications are significant. If a company's HR team uses automated tools to group candidate CVs or to automatically assess their suitability for a role, it must ensure compliance with the AI Act's requirements.

The regulation includes an important "exception with conditions," stating that an AI system falling under Annex III may not be classified as high-risk if it meets certain criteria. Specifically, if an AI system is intended for a narrow procedural task, aims to improve the outcome of a pre-completed human activity, detects decision-making patterns without replacing human judgment, or serves as a preparatory task for an assessment, it might not be high-risk.

Thus, if a system serves only as an auxiliary tool for data collection and preliminary analysis without automatic decision-making, it could qualify for this exception. However, this exception does not apply if the system performs profiling of natural persons.

Profiling involves the automatic processing of personal data to assess various aspects of a person's life, such as work performance, economic status, health, preferences, interests, reliability, behavior, location, or movement. In such cases, the system remains high-risk regardless of other factors.

The methodology for determining whether an AI system is high-risk therefore requires a systematic assessment. First, it is necessary to clarify precisely what the system does, its inputs and outputs, its application area, and its impact on individuals' decisions or safety.

Then, an assessment must be made as to whether it falls under Annex II or III. If so, it is necessary to verify whether it meets any of the exceptional conditions. This process is not a one-off; if the system changes or its deployment alters, the assessment must be repeated.

In practice, organizations often lack this systematic approach. They may initially be uncertain whether their systems are AI at all, and if so, what their risk profile is. In such cases, it makes sense to keep briefs, documents, and future steps in one centralized location. This allows for gradual accumulation of all relevant information and ensures the assessment is complete and correct.

Key obligations of providers of high-risk AI systems

Providers of high-risk AI systems face the most stringent set of obligations under the AI Act. These responsibilities cover all phases of the system's lifecycle, from design to post-market monitoring.

The first and central obligation is establishing and maintaining a comprehensive risk management system, implemented as an iterative process throughout the AI system's entire lifecycle. This system must systematically identify known and reasonably foreseeable risks that the AI system may pose to health, safety, or fundamental rights when used for its intended purpose and under conditions of reasonably foreseeable misuse.

Providers must then adopt appropriate and targeted measures to address these risks, including their mitigation or elimination, where technically feasible.

A second substantial obligation is the implementation of a quality management system to ensure compliance with the regulation throughout the system's entire lifecycle. The quality management system must be documented systematically and clearly.

It must include, at a minimum, the following elements: a regulatory compliance strategy, techniques and procedures for system design and verification, quality development and control procedures, testing and validation procedures, and applicable technical specifications and standards.

Furthermore, it must cover data governance systems and procedures (including data collection, analysis, labeling, and storage), a risk management system, the establishment and maintenance of a post-market monitoring system, procedures for reporting serious incidents, communication procedures with authorities and notified bodies, and a responsibility framework defining management and personnel responsibilities.

A third key obligation is the preparation of detailed technical documentation before placing the system on the market. Technical documentation must clearly demonstrate that the system meets all AI Act requirements and must provide national authorities and notified bodies with all necessary information for compliance assessment.

The documentation must include, at a minimum, the elements listed in Annex IV of the AI Act, such as a description of the system, its purpose, data sets, architecture, testing results, risk analysis, and mitigation measures. For Small and Medium-sized Enterprises (SMEs), a simplified form of documentation is being prepared by the Commission specifically for their needs.

A fourth obligation is ensuring proper data governance. High-risk AI systems trained on data must be developed using training, validation, and testing datasets that meet the quality criteria defined in the AI Act. This means data must be relevant, sufficiently representative, as error-free as possible, and complete with regard to the system's intended purpose.

Data must be analyzed for potential biases that could affect individuals' health and safety, negatively impact fundamental rights, or lead to discrimination. Providers must take appropriate measures to detect, prevent, and mitigate these biases. This is especially crucial in recruitment and employment, where unfair data can lead to discriminatory outcomes.

A fifth obligation is designing the system to allow for effective human oversight. High-risk AI systems must be designed with appropriate interfaces enabling natural persons to monitor them effectively during use. Human oversight must be designed to prevent or minimize risks to health, safety, and fundamental rights.

Control measures must be proportionate to the risks, degree of autonomy, and context of the system's use. For biometric identification systems, at least two individuals with the necessary competence and authority must independently verify and confirm the identification of the person concerned, unless there is a specific exception for law enforcement authorities.

A sixth obligation is the reporting of serious incidents. Providers must report all serious incidents to national authorities without undue delay and, in any case, no later than 15 days from the moment they become aware of the incident.

After reporting an incident, providers must promptly conduct the necessary investigation, including risk assessment and the adoption of corrective measures, and must cooperate with the competent authorities.

A seventh obligation is to provide detailed instructions for use to deployers. The instructions must clearly explain what the system does, its capabilities and limitations, known risks, technical characteristics, and how to use it safely and effectively. Instructions must be accessible and understandable to those who will be using the system.

A eighth obligation is to ensure an appropriate level of robustness, cybersecurity, and accuracy of the system. High-risk AI systems must be resilient to attacks and manipulations, have suitable security measures, and achieve a reasonable level of accuracy.

A ninth and final obligation is the establishment and maintenance of a post-market monitoring system. Providers must actively and systematically collect, document, and analyze relevant data on the system's performance throughout its lifespan to evaluate its ongoing compliance with AI Act requirements.

In practical situations, fulfilling all these obligations requires coordination across multiple teams and departments, from AI/ML engineers to legal and risk management. Information must be gathered and organized in a single location.

Documents from the development process, testing results, risk analyses, and monitoring plans must be centralized and regularly updated. In such cases, leveraging a platform like Anywhere.legal makes sense.

It allows centralization of the system brief, uploading of relevant documents, using AI for preliminary processing and drafting documentation, and then engaging a relevant legal or technical expert in the EU to verify the process and help ensure compliance.

Obligations of deployers and other value chain participants

While providers bear the greatest responsibility, deployers and other participants in the value chain (importers, distributors, modifiers) also have substantial obligations. Deployers, meaning persons using AI systems within their activities (typically employers for HR systems, banks for credit systems, etc.), must ensure they use systems in accordance with the instructions provided by the provider.

They must also monitor system operation and, if they have reason to believe the system may become a source of risk, must inform the provider and relevant national authorities without undue delay.

Deployers must also assign human oversight to qualified individuals who possess the necessary competence, training, and authority, as well as the required support to properly exercise control.

This means that if an HR department uses an AI system to filter candidates, it must have a corresponding person or team to review the results and not simply adopt them without critical consideration.

Deployers must also ensure, if they have control over input data, that this data is relevant and sufficiently representative with regard to the system's intended purpose.

For instance, if a recruitment team sends candidate data through the system, they must ensure this data is not biased or incomplete.

Deployers must also maintain automatically generated logs related to system operation for at least six months.

These logs are crucial for investigating incidents and demonstrating compliance.

Employers deploying high-risk AI systems in the workplace must also inform workers' representatives and the workers themselves that they will be subject to a high-risk AI system.

This information must be provided in accordance with legal procedures and customs concerning employee and representative notification.

Deployers from public authorities or Union institutions must also register high-risk AI systems in the EU database.

This registration obligation is crucial for transparency and state control.

Importers and distributors also have specific obligations. Importers, meaning persons placing AI systems on the market under their name or trademark, must verify that the conformity assessment adopted by the provider has been duly carried out, that technical documentation is present, and that the system bears the CE marking and EU declaration of conformity.

Distributors, meaning persons who further distribute AI systems, must verify that the system complies with the AI Act and must not place it on the market if they have reason to believe it is not compliant.

A key aspect is "reclassification" within the value chain. If a distributor, importer, deployer, or other third party substantially modifies a high-risk AI system, they become the provider of that modified system and must fulfill all provider obligations.

This means that if an organization takes an existing AI system and alters it in a way that changes its risk profile or intended purpose, it must now comply with all provider obligations, including conformity assessment and technical documentation.

Procedural aspects: Conformity assessment and notified bodies

Conformity assessment is a key process for verifying the compliance of a high-risk AI system with AI Act requirements. There are two main conformity assessment procedures: internal control (self-assessment) and third-party assessment via a notified body.

For high-risk AI systems under Annex III (recruitment, credit scoring, education, law, etc.), providers typically conduct internal control according to Annex VI of the AI Act, which does not require the involvement of a notified body. Providers self-assess whether their system meets all requirements and can then affix the CE mark and issue an EU declaration of conformity.

However, in some cases, the involvement of a notified body is mandatory. One such case involves biometric identification systems, including remote biometric identification systems, regardless of whether they are real-time or post-event.

The second case is when a high-risk AI system is part of a product covered by Union harmonization law (Annex II) and for which a third-party assessment is standardly required (e.g., medical devices, motor vehicles).

Notified bodies are independent third parties formally designated by individual Union Member States to carry out conformity assessments of high-risk AI systems. They must be independent and free from conflicts of interest, possess the relevant competence and technical means for assessment, and conduct assessments objectively and transparently.

Third-party assessment involves a detailed review of the technical documentation, quality management system, development process, and the AI system itself. The notified body also issues a certificate if the system meets the requirements and authorizes CE marking.

The conformity assessment process consists of multiple phases. First, the provider identifies and engages a suitable notified body. Then, an application is submitted with technical documentation, quality management system documentation, and a system description.

The notified body reviews the documentation, which typically takes several months. It then audits the provider's internal environment, verifying development and testing processes.

Furthermore, it conducts a technical assessment of the system itself, including its performance, accuracy, and error resilience. Finally, it issues a decision – either the system passes, corrective actions are required, or it is rejected.

Importantly, conformity assessment is not a one-time activity. If a high-risk AI system is subsequently substantially modified, it must undergo a new conformity assessment.

A substantial modification is defined as a change not foreseen by the provider at the time of the initial conformity assessment, and which affects compliance with AI Act requirements or the system's intended purpose.

In practice, the conformity assessment process is complex and requires close coordination between the provider and the notified body. Both parties must exchange information, respond to queries, and resolve identified issues.

If they focus solely on themselves without an external perspective, they can easily overlook important aspects. In such cases, it makes sense to have a centralization point where all relevant materials are stored, where teams can communicate internally, and where external experts can be involved as needed to advise on the process.

Implementation timelines and compliance deadlines

The AI Act was adopted in March 2024 and entered into force on June 18, 2024, but its rules are being introduced gradually in several phases. Understanding these deadlines is critical for planning compliance activities.

The first phase, which became applicable from December 18, 2024 (six months after the regulation's entry into force), concerned the prohibition of unacceptable AI practices and the obligation to ensure AI literacy among employees. From this date, these practices are directly prohibited, although disputes regarding their interpretation and application continue to arise.

The second phase, applicable from March 18, 2025 (nine months after the regulation's entry into force), covered the regulation of General Purpose AI (GPAI) models. This includes large language models and other foundational models capable of performing a wide range of tasks.

Providers of GPAI models, especially if they pose systemic risk (i.e., if trained with more than 10^25 floating-point operations), must now fulfill obligations related to transparency, cybersecurity, and incident reporting.

The third phase, applicable from June 18, 2026 (twenty-four months after the regulation's entry into force), will bring obligations for most high-risk AI systems, including those listed in Annex III of the AI Act. This covers recruitment and HR systems, credit scoring, educational assessments, biometric identification, and more.

From this date, all high-risk AI systems in these categories must comply with all obligations described in previous sections, including technical documentation, risk management systems, conformity assessment, and post-market monitoring.

The fourth and final phase, applicable from June 18, 2027 (thirty-six months after the regulation's entry into force), will introduce obligations for high-risk AI systems that are safety components of products falling under Union harmonization legislation (Annex II), and for AI systems in law enforcement and migration (Article 6(3)). This longer timeframe aims to give manufacturers more time to adapt to the new requirements.

This means that organizations developing or deploying high-risk systems do not have much time to prepare. It is critically important that they initiate their compliance activities without undue delay.

In addition to these general deadlines, there are also various specific timelines for particular activities. For example, the AI Office, established within the European Commission, will issue detailed guidelines and recommendations for the practical application of the AI Act. This aims to help organizations better understand how to apply the rules in practice and to contribute to the harmonization and easier application of the rules.

Practical challenges and common examples from practice

Despite the clear rules of the AI Act, its practical implementation proves complex in the real world. One of the main challenges is identifying all AI systems within an organization. Many companies do not realize that some of their tools or processes contain AI elements.

Suppose a large pharmaceutical company uses an Excel spreadsheet with algorithms to predict prices or market trends. Is this an AI system? If so, which risk category does it fall into? Without clear mapping of all AI applications within the organization, it is impossible to assess compliance needs.

A second challenge is determining if a specific AI system is high-risk. The lines between high and lower risk are not always sharp. Suppose an AI system for candidate screening has the following characteristics: it assigns candidates to categories based on scores, but the results are subject to human review, who can override or reverse the system's output.

Is such a system high-risk? The answer is not simple and depends on the details – specifically, how often a human overrides the result (if almost never, it is still high-risk), and whether the override is transparent and justifiable.

A third challenge is collecting the correct data for technical documentation. Organizations must be able to demonstrate that they meet all AI Act requirements. This means having all data related to system development: how the dataset was created, how the system was tested, test results, identified risks, and mitigation measures.

If this data was not systematically collected during development, it cannot be retrospectively reconstructed and consolidated. The result is either incomplete documentation or even an inability to achieve compliance.

A fourth challenge is ensuring proper human oversight. How should it be implemented? In some cases, this means a human must review every decision made by the AI system. In others, human oversight might involve regularly reviewing a series of decisions and responding to anomalies.

However, the specific requirements of the AI Act are not always clear on what exactly constitutes "proper" human oversight. A range of factors must be assessed: the system's autonomy, its purpose, the risks it poses, and its deployment context.

A fifth challenge is communication with multiple stakeholders and coordinating their activities. Who is responsible for compliance? The development team? HR department? Legal department? Risk management? In practice, compliance requires coordination among all these teams.

Developers must provide technical details, HR must understand deployment and monitoring, the legal department must ensure documentation is correct and complete, and risk management must verify that risks are correctly identified and mitigated.

Practical examples illustrate these challenges. Suppose a technology company develops a new HR system for large corporations. The system uses machine learning to predict which candidate will be best for a given position. The company initially did not consider it a high-risk system, viewing it as just one of many tools in the HR process.

However, a detailed analysis revealed that the system primarily drives candidate hiring decisions. When applied to various positions, it also influences decisions on promotions and employment termination. In this case, it involves several high-risk use cases simultaneously.

The company had to retrospectively consolidate technical documentation, conduct risk analysis, implement human oversight, and establish post-market monitoring. Due to incomplete planning, it lacked all necessary training data and development reports, leading to prolonged compliance processes and higher costs.

Second example: a bank used an AI system to detect fraud and risks in transactions. The system was part of a complex ecosystem with multiple components: a pre-processing module, a classification module, and an escalation module.

Which part is responsible for compliance? How is the entire system properly tested? How are logs recorded in case of an incident? The bank had individual teams responsible for each component, but their communication was fragmented. This resulted in a lack of clarity regarding how the system was truly built and, consequently, whether compliance was genuinely ensured.

Third example: a startup developed an AI assistant for education – a tool that answers student questions and provides explanations. The startup initially did not think this fell under the AI Act, as it was "just an educational tool."

However, it was found that the system also evaluates what content a student needs to see next, which constitutes a form of assessment. Thus, the system falls under high-risk education categories. The startup was small and lacked resources for extensive documentation and conformity assessment. It had to seek support to ensure compliance without jeopardizing its operations.

All these examples illustrate that compliance is not merely a legal obligation but requires a coordinated effort across the entire organization. In such cases, it makes sense to have a centralized approach to the entire process in one location.

This involves structuring a system brief, uploading documents, communicating between teams, preparing initial documentation drafts, and if necessary, engaging experts from one or more EU countries to assist with specific issues.

Global context and regulatory fragmentation

While we focus on the EU AI Act, it is important to understand that it is not the only AI regulation globally. Other jurisdictions, notably the United States, are adopting their own AI legislation, creating a complex landscape for companies operating internationally.

Europe has adopted the first comprehensive regulation in the form of the AI Act, but the United States has so far focused more on sectoral regulations in individual states and industries, without a unified federal AI law. In 2025, over 260 AI-related measures were introduced in the US, 22 of which passed the legislative process.

This creates a situation where the same AI system may be subject to entirely different requirements in various jurisdictions.

This fragmentation creates new challenges. If a company develops an AI system to be sold or deployed in Europe, the USA, Canada, and Asia, it must adhere to the strictest requirements from all these jurisdictions and ensure simultaneous compliance across them all.

Companies might attempt to create a "modular" architecture where regionally specific configurations can be toggled on or off depending on the location, but this increases the complexity of development and testing.

It is also noteworthy that the EU AI Act holds an advantage by being the most unified and stringent regulation. Companies achieving compliance in the EU will have an easier path to compliance elsewhere, even if additional requirements exist. From this perspective, the EU AI Act sets a high standard, effectively becoming a global benchmark for AI compliance.

Systematic approach to compliance

Given the complexity and scope of the AI Act, it is crucial to adopt a systematic and process-driven approach to compliance. Instead of attempting ad hoc or last-minute compliance, organizations should establish a structured path.

The first step is a comprehensive mapping of all AI systems that the organization develops, deploys, or uses. This involves an inventory – a list of all applications, with information on what they do, what data they rely on, and what decisions they support.

This mapping is not a one-off; it should be periodically updated as new systems are continuously developed or introduced within the organization.

The second step is the risk classification of each system. Using the AI Act framework (prohibited, high-risk, limited-risk, minimal-risk), an assessment is conducted for each system. This combines a legal assessment (does it fall under any AI Act definitions?) and a technical assessment (what is its actual impact on individuals?).

Specifically for high-risk systems, a deep audit is performed: what exactly it does, what data it relies on, how it is trained, how it is tested, who uses it and how, and what known risks exist.

The third step is developing a compliance plan. Based on the classification, a plan is drafted describing specific actions required to achieve compliance.

For each high-risk system, this will include: preparing technical documentation, implementing/improving the risk management system, ensuring a proper post-market monitoring process, and preparing incident reports. For limited-risk systems, this will involve preparing informational materials and content labeling. For other systems, minimal actions may suffice.

The fourth step is defining responsibilities. Who is primarily responsible for compliance for each system? This should be someone with the authority and resources to lead the work.

This person or team will coordinate with others – developers, data science specialists, lawyers, risk management – to ensure all requirements are met.

The fifth step is implementation. This involves actually carrying out the work according to the plan: data and documentation collection, testing, ensuring verification, and communication with partners and experts.

This is not work that can be done in isolation; it requires a central coordination point where all materials are available and progress can be tracked.

The sixth step is continuous monitoring and updating. Compliance is not a final state; it is an ongoing process. When deploying a system, its behavior must be monitored, incidents reacted to, feedback collected, and processes updated as needed.

Furthermore, as the AI Act evolves and the Commission issues new guidelines, requirements may change, and organizations must be prepared to adapt.

The role of AI-assisted tools in the compliance process

Given the extensive and technical nature of the AI Act, the use of AI-assisted tools in the compliance process is highly beneficial. Such tools can accelerate and improve various aspects of compliance work.

First, they can assist with analyzing and structuring large volumes of technical documentation. When an organization collects dozens or hundreds of pages of documentation – model datasheets, testing reports, risk analyses – an AI tool can quickly analyze, extract key information, and prepare summaries.

This can significantly reduce the time lawyers and engineers spend reading and understanding individual documents.

Second, AI tools can help with preparing initial drafts of technical documentation. Based on the structure of AI Act requirements and examples from Annex IV, an AI tool can create templates and initial documentation drafts. Engineers and lawyers can then refine and adapt these to the specific system, again saving substantial time.

Third, AI tools can assist with risk analysis. Based on the system's description, its data, architecture, and deployment, an AI tool can help identify potential risks and suggest mitigation measures.

Although final decisions must be made by humans, AI can provide valuable analytical support.

Fourth, AI tools can aid communication and coordination. If the compliance plan is centralized in one location, allowing document uploads, queries, and progress tracking, communication between teams significantly improves.

AI can then participate in automatic information gathering, deadline reminders, and generating status reports on compliance. However, it is crucial to emphasize that AI serves only as a supporting tool and does not replace the expertise and critical judgment of legal and technical specialists.

Specifically, a platform like Anywhere.legal, which combines centralized document management, AI-assisted processing, and the ability to involve experts from various countries, provides a comprehensive solution for managing the compliance process.

Instead of developing their own processes and tools, organizations can leverage existing infrastructure designed for complex, interdisciplinary, international legal and regulatory projects, ensuring the safe and controlled use of AI in sensitive contexts.

Conclusion

The EU Artificial Intelligence Act represents a fundamental shift in how AI systems are regulated. It introduces extensive and specific obligations for providers and deployers, especially for high-risk applications. Understanding these obligations and adopting a systematic approach to compliance are not optional; they are essential for the legal operations and reputation of organizations developing or using AI in the EU, particularly in an international and cross-border context.

However, compliance need not be a burden. If properly planned and implemented, it can improve the quality of AI systems, increase user trust, and reduce operational risks.

Key insights from examining the AI Act are as follows: First, organizations must clearly identify their AI systems and assess their risk profile. Second, high-risk systems are subject to strict requirements, including technical documentation, risk management, human oversight, and monitoring. Third, compliance is an ongoing process, not a one-time activity.

Fourth, communication and coordination among multiple teams and international experts are crucial for addressing complex situations across many jurisdictions. Fifth, AI-assisted tools can significantly accelerate and improve compliance work, but always under expert supervision. Finally, given the global fragmentation of AI regulation, EU compliance is in the interest of any organization seeking to operate in global markets and address cross-border legal and tax challenges.

Frequently asked questions

1. Which AI systems are prohibited in the EU?
The EU has prohibited eight specific AI practices considered to pose an unacceptable risk. These include social scoring, manipulative techniques exploiting human vulnerabilities, predicting individual criminal risk solely based on profiling, and indiscriminate facial image extraction from the internet to create biometric identification databases. Other prohibited practices include emotion recognition in workplaces and schools, and biometric categorization to classify sensitive characteristics. This also extends to real-time remote biometric identification systems in publicly accessible spaces, with very limited exceptions for law enforcement. These prohibitions came into effect on December 18, 2024.

2. How is an AI system determined to be "high-risk"?
An AI system is high-risk if it is part of a product covered by EU harmonization law (e.g., medical devices, Annex II) or if it falls under one of the eight categories in Annex III (e.g., recruitment, education, critical infrastructure, law enforcement, migration). An exception applies to specific situations described in Article 6, where it demonstrably does not pose a significant risk. If an organization believes its system does not fall into these categories, it must document this assessment.

3. What happens if we ignore the AI Act?
Violations of the AI Act can have serious consequences. For infringing prohibited practices, fines can reach up to 35 million euros or 7% of global annual turnover, whichever is higher. For breaching high-risk system obligations, fines can be up to 15 million euros or 3% of turnover. Providing incorrect, incomplete, or misleading information can incur penalties up to 7.5 million euros or 1.5% of turnover. Fines for prohibited practices can be imposed from December 18, 2024, and for most high-risk systems from June 18, 2026.

4. How can organizations prepare for the AI Act?
The most important first step is to inventory all AI systems within your organization and assess their risk profile. Then, prioritize those classified as high-risk and begin working on their compliance. Consolidate your technical archives and documentation, ensuring you have all necessary data on development, testing, and deployment. Engage a legal expert or specialist to assist with the process, especially in an international context. Record key deadlines and implement a compliance plan for each system.

5. What role do "notified bodies" play, and when is their involvement mandatory?
Notified bodies are independent third parties designated by Member States to perform conformity assessments for certain high-risk AI systems. Their involvement is mandatory for biometric identification systems and for high-risk systems that are safety components of products already regulated by EU harmonization law (Annex II, e.g., medical devices). For other high-risk systems (recruitment, credit, etc., Annex III), providers may conduct their own internal conformity assessment without involving a notified body.

6. How can AI-assisted tools help with compliance?
AI-assisted tools, such as the Anywhere.legal platform, can help by centralizing documentation, analyzing large volumes of text, preparing initial documentation drafts, supporting risk analysis, automating information collection, and generating status reports. They combine central document management, AI-assisted processing, and the ability to involve experts. This provides a comprehensive solution for managing the compliance process, always emphasizing the role of human oversight and judgment.