EU Artificial Intelligence Act (EU AI Act) Compliance Guide

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the first-ever legal framework specifically targeting AI technologies in the European Union. Adopted by the European Parliament and Council on 15 May 2024 and published in the Official Journal on 30 May 2024, it will enter into force on 1 January 2025. The regulation aims to ensure that AI systems placed on the EU market are safe, transparent, and respect fundamental rights as enshrined in the EU Charter of Fundamental Rights and the Treaty on the Functioning of the European Union.

This guide provides a detailed overview of the regulation’s scope, key definitions, obligations for stakeholders, compliance timelines, penalties for non-compliance, and practical steps to achieve conformity with the EU AI Act.

Legal Basis and Scope

The legal basis for the EU AI Act is Article 114 of the Treaty on the Functioning of the European Union (TFEU), which allows harmonisation measures for the internal market. The regulation applies to:

• Providers placing AI systems on the EU market or putting them into service, regardless of whether they are established in the EU or third countries;
• Users of AI systems within the EU;
• Importers and distributors of AI systems;
• AI systems used or intended to be used in the EU, including those developed outside the EU but deployed within the EU market.

It covers AI systems as defined in Article 3(1) of the regulation, including software developed with machine learning, logic- and knowledge-based approaches, and statistical methods.

Key Definitions from Regulation (EU) 2024/1689

Obligations Under the EU AI Act

The regulation imposes a risk-based approach with obligations differentiated by the AI system’s risk category:

1. Prohibited AI Practices

Article 5 prohibits AI systems that:

• Deploy subliminal techniques to materially distort behaviour causing harm;
• Exploit vulnerabilities of specific groups (e.g., children, disabled persons) to cause harm;
• Use real-time biometric identification in public spaces for law enforcement, except under strict conditions;
• Deploy AI for social scoring by public authorities.

2. High-Risk AI Systems

High-risk AI systems, listed in Annex III, include AI used in:

• Critical infrastructure (e.g., transport, energy);
• Education and vocational training affecting access to education or professional advancement;
• Employment, workers management, and access to self-employment;
• Essential private and public services (e.g., credit scoring, social benefits);
• Law enforcement and migration;
• Administration of justice and democratic processes.

Providers of high-risk AI systems must:

1. Conduct a conformity assessment before placing the system on the market;
2. Implement a risk management system to identify and mitigate risks;
3. Ensure high levels of data quality and documentation;
4. Maintain transparency and provide clear instructions to users;
5. Establish a post-market monitoring system;
6. Register the AI system in the EU database managed by the European Commission.

3. Limited Risk AI Systems

These systems require transparency obligations such as informing users they are interacting with AI (e.g., chatbots). Examples include AI-generated content or emotion recognition systems.

4. Minimal Risk AI Systems

These systems are largely unregulated under the EU AI Act, allowing free use without additional requirements (e.g., AI-enabled video games or spam filters).

Compliance Timeline

Penalties and Enforcement

Non-compliance with the EU AI Act can lead to significant penalties enforced by national market surveillance authorities. The regulation establishes a tiered penalty system based on the nature and severity of the infringement:

Enforcement is carried out by national competent authorities designated by each Member State, coordinated by the European Artificial Intelligence Board established under the regulation.

Key Articles in Plain English

Article 3 – Definitions

This article defines all key terms used throughout the regulation, including what constitutes an AI system, provider, user, high-risk AI system, and other relevant concepts.

Article 5 – Prohibited AI Practices

Specifies AI practices that are banned outright due to unacceptable risks to safety or fundamental rights.

Article 6 – Classification of High-Risk AI Systems

Lists categories of AI systems considered high-risk and subject to strict requirements.

Article 10 – Obligations of Providers

Details the responsibilities of AI system providers, including risk management, data governance, documentation, and transparency.

Article 43 – Conformity Assessment

Describes the procedures providers must follow to verify their AI systems comply with the regulation before market placement.

Article 61 – Post-Market Monitoring

Requires providers to continuously monitor AI systems after deployment to identify and mitigate emerging risks.

Article 71 – Penalties

Sets out the fines and enforcement mechanisms for breaches of the regulation.

How to Achieve Compliance

Compliance with the EU AI Act requires a structured approach:

1. Identify whether your AI system falls under the regulation’s scope and risk categories.
2. Classify the AI system as high-risk, limited risk, or minimal risk according to Annex III and Article 6.
3. Conduct a conformity assessment for high-risk AI systems, including risk management and technical documentation.
4. Register high-risk AI systems in the EU AI system database before placing them on the market.
5. Implement transparency measures for limited risk AI systems, such as user notifications.
6. Establish a post-market monitoring plan to detect and address risks during the AI system’s lifecycle.
7. Prepare for audits and inspections by national authorities by maintaining thorough documentation.

Failure to comply can result in severe penalties and market restrictions, making early and thorough compliance essential.