Expertise · Regulation
EU AI Act
The world's first comprehensive AI regulation — a risk-based framework with obligations that scale from transparency to strict conformity, for organisations that build or use AI.
What it is, and why it matters.
The EU AI Act establishes harmonised rules for artificial intelligence across the EU, using a risk-based approach. Practices deemed an unacceptable risk are prohibited outright. High-risk systems face strict requirements — risk management, data governance, technical documentation, human oversight, accuracy, and robustness. Limited-risk systems carry transparency obligations (telling people they're interacting with AI). Minimal-risk uses are largely unregulated. Providers and deployers each have distinct duties, and general-purpose AI (GPAI) models have their own dedicated rules. For most organisations the urgent question is no longer "if" but "which of our AI systems are in scope, and at what tier."
Who it affects.
Providers and deployers of AI systems placed on the EU market or used within the EU — including organisations established outside the EU. It is especially relevant if you build AI, embed it into products, or use it in higher-stakes contexts such as recruitment, credit, education, or critical infrastructure.
Key dates
Entered into force in 2024, with obligations phasing in over the following years — prohibited practices and AI-literacy duties first, then general-purpose AI obligations, then the bulk of the high-risk requirements, with certain embedded high-risk systems later still.
Key obligations.
A risk-management system across the AI lifecycle
Data governance and data quality
Technical documentation and record-keeping
Human oversight
Accuracy, robustness, and cybersecurity
Transparency to users (for limited-risk systems)
Sits under:
Compliance
EU AI Act within your managed office.
The EU AI Act sits under Compliance and connects to Governance, Risk, and Architecture & Transformation. We manage it alongside your wider AI Security & Compliance topic so AI adoption stays both compliant and genuinely safe — part of one program, not a bolt-on.
How we help.
00
AI inventory & classification
Identify which systems are in scope, and at what risk tier.
00
AI governance
Accountability and oversight for how AI is built and used.
00
AI risk management
Risk management tailored to AI's specific failure modes.
00
Conformity readiness
Technical documentation and the evidence conformity requires.
00
Deployer obligations
Human-oversight design and the duties that fall on users of AI.
00
Aligned to AI Security & Compliance
Kept consistent with your broader safe-AI posture.
Latest on EU AI Act.
COMPLIANCE
AI Compliance Beyond the Hype: A Practical Framework
Related expertise.
Risk Management
The living discipline of identifying, assessing, treating, and monitoring risk — aligned to your appetite, so you take the right risks knowingly.
Cyber Resilience Act (CRA)
EU security requirements for products with digital elements — secure-by-design, vulnerability handling, and lifecycle obligations for anyone making or selling connected hardware and software.
TRUSTED BY ORGANISATIONS ACROSS EUROPE
