The EU AI Act: A Practical Compliance Playbook

The EU AI Act entered into force in August 2024, and its obligations are phasing in over the years that follow. Prohibitions on certain practices have applied since February 2025. Obligations for general-purpose AI models have applied since August 2025. Most of the obligations for high-risk systems arrive later. For any organisation building, buying or embedding AI, which is now nearly all of them, EU AI Act compliance has moved from a policy discussion to a board-level obligation, with penalties that scale with global turnover.

The organisations that cope best do not treat the Act as a legal memo. They treat it as an engineering and operating model change with legal deadlines attached. This playbook sets out how. It is practical guidance, not legal advice. Timelines and guidance continue to evolve, so confirm the current timetable against official EU sources and consult counsel before relying on any date or classification.

What the Act requires, in plain terms

The Act is risk-tiered, and most confusion comes from teams applying the wrong tier to their systems.

• Prohibited practices. A short list of uses is banned outright, including social scoring, certain forms of biometric categorisation and systems designed to manipulate people in harmful ways.
• High-risk systems. AI used in areas such as hiring, credit, education, critical infrastructure and regulated products carries the heaviest obligations: risk management, data governance, technical documentation, logging, human oversight, security measures and a conformity assessment.
• Limited-risk systems. Chatbots and generative content mainly attract transparency duties. People should know when they are dealing with AI.
• General-purpose AI models. The providers of these models carry their own documentation and transparency duties, which are stricter for the most capable models.

The Act also expects organisations to make sure staff who work with AI understand it well enough to use it responsibly. Most enterprise AI sits in the limited or minimal tiers. The moment a system influences a hiring, lending or similar decision about a person, it may cross into high-risk and the requirements multiply.

Know your role: provider, deployer or both

The Act assigns duties by role as well as by risk. A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses a system in the course of its work.

Most mid-market organisations are deployers most of the time, and deployer obligations are lighter. But the line moves. If you put your own name on a system, change its intended purpose, or modify it substantially, you may take on provider obligations for it.

The Act also reaches beyond EU borders. Organisations based elsewhere can fall within scope if they place systems on the EU market or if the output of their systems is used in the EU.

The EU AI Act compliance playbook

• Build an AI inventory. You cannot govern what you cannot see. Catalogue every AI system: built, bought and embedded in the software you already license. Record its purpose, the data it touches, who owns it, your role and its likely tier.
• Classify by use, not by technology. The same model is limited-risk in a marketing chatbot and potentially high-risk in a lending decision. Risk follows the decision, not the algorithm. Record the reasoning so it can be defended later.
• Stand up a management system. ISO/IEC 42001, the AI management system standard, gives you an auditable structure of policies, roles, risk assessment and review. The NIST AI RMF is a useful companion. Neither equals legal compliance, but both give you a backbone that maps sensibly to what the Act asks for. Our article on an AI governance operating model built on ISO 42001 goes deeper.
• Engineer the controls in. Human oversight gates, decision logging, bias and performance testing, security testing and model documentation are far cheaper to build in than to retrofit.
• Assign accountability. Every system above minimal risk needs a named business owner who answers for its outcomes. Committees review. Individuals own.
• Manage your suppliers. Much of your exposure sits in products you buy. Ask vendors what role they take under the Act and what documentation they will provide, and put it in the contract.

The organisations struggling most are those treating the AI Act as a legal project. It is an engineering and operating model project with a legal deadline.

Where compliance programmes go wrong

• The inventory stops at the data science team. The riskiest systems are often AI features switched on inside HR, finance or customer service software, bought by a business unit and never reviewed.
• Classification is done once. Use cases drift. A summarisation tool becomes a screening tool without anyone deciding that it should. Review classification whenever purpose or data changes.
• Policy without evidence. Regulators, auditors and customers will ask for test results, logs and records of decisions, not a policy document.
• Governance as a gate, not a service. If review takes months, teams route around it. Tier the process so low-risk uses pass quickly and scrutiny is saved for the systems that warrant it.

A 90-day plan

• Days 1 to 30: see it. Appoint an accountable executive. Run the inventory across IT, business units and procurement. Screen everything against the prohibited practices first, since those rules already apply.
• Days 31 to 60: sort it. Classify each system by use and role. Identify the handful that are, or may become, high-risk. Agree a lightweight intake process so new AI uses are captured from now on. An AI readiness assessment can cover much of this ground in one pass.
• Days 61 to 90: control it. For the priority systems, define oversight, logging, testing and documentation standards, and start closing gaps. Brief the board on exposure, the plan and the timeline you have confirmed with counsel.

Compliance as advantage

Treated well, governance is not a brake on AI. It is what lets you scale it. Customers, partners and procurement teams increasingly ask for evidence of responsible AI before they will buy or integrate. The audit trail you build for the regulator is the same trail that builds trust in the market. Security belongs in the same conversation, and red-teaming your AI systems produces exactly the kind of evidence an assessor will want to see.

Common questions

Does the EU AI Act apply to companies outside the EU?

It can. The Act is designed to reach organisations that place AI systems on the EU market or whose system outputs are used in the EU, wherever they are based. If you have EU customers or operations, confirm your position with counsel.

Is ISO/IEC 42001 certification enough for EU AI Act compliance?

No. ISO/IEC 42001 is a management system standard, and the Act sets specific legal obligations that depend on your role and the risk tier of each system. The standard gives you the structure, discipline and evidence that make compliance far easier to achieve and demonstrate.

We only use AI tools from vendors. Do we still have obligations?

Probably, yes. Deployers have their own duties, particularly for high-risk uses, such as using the system as instructed, keeping human oversight in place and being transparent with the people affected. Supplier due diligence matters too.

Where Ganexa can help

Ganexa helps organisations turn the Act into a working operating model: inventory and classification, ISO/IEC 42001-aligned governance, and controls engineered into delivery, without slowing teams to a crawl. Our AI governance and compliance service covers the framework and the evidence, and our AI strategy and implementation team builds the controls into the systems themselves. If you want a clear view of your exposure and a plan you can fund, book a free consultation.