Regulatory Readiness
EU AI Act
Readiness Assessment
EU AI Act duties depend on your role, system classification and applicable date. Some obligations already apply; the amended high-risk timetable distinguishes Annex III systems from AI embedded in regulated products.
This page introduces the rules and a structured governance baseline. The self-assessment does not determine legal scope, verify controls, conduct a conformity assessment or certify compliance. Consult qualified counsel for your systems and role.
What Is the EU AI Act?
The EU Artificial Intelligence Act (Regulation 2024/1689) is a risk-based regulatory framework that classifies AI systems into four tiers and imposes obligations proportional to their potential harm. It applies to any organization that places AI systems on the EU market — regardless of where the organization is headquartered.
The Act covers providers (developers), deployers (businesses using AI), importers, and distributors. If your organization uses AI tools — even third-party SaaS — you likely have obligations under the deployer provisions.
Compliance Timeline
Risk Categories
The framework is often summarized in four risk categories. Actual duties also depend on the specific system, use, role and exceptions; general-purpose AI models have a separate regime.
Unacceptable Risk
Examples: Certain social scoring, harmful manipulation or exploitation of vulnerabilities, and prohibited biometric uses. Statutory conditions and exceptions matter.
Obligation: Prohibited — banned outright under the Act.
High Risk
Examples: Certain uses in hiring, creditworthiness, critical infrastructure, law enforcement, medical devices and education, subject to classification rules.
Obligation: Requirements depend on classification, provider or deployer role, applicable date and any statutory exception.
Limited Risk
Examples: Chatbots, deepfake generation tools, AI-generated content.
Obligation: Transparency requirements — users must be informed they are interacting with AI.
Minimal Risk
Examples: AI-powered spam filters, AI in video games, general-purpose recommendation engines.
Obligation: No high-risk classification by that description alone. General duties and other applicable law may still apply; voluntary practices are encouraged.
Key Obligations for High-Risk AI
Organizations operating high-risk AI systems face the most demanding requirements. These topics summarize selected provider requirements; deployers have distinct duties, including Article 26.
Risk Management System
High-risk AI systems require a documented risk management process that runs throughout the system's entire lifecycle — from design through decommissioning.
Data Governance
Training, validation, and testing datasets must meet quality criteria: relevance, representativeness, being as far as possible free from errors, and completeness for the intended purpose.
Technical Documentation
Providers must maintain detailed technical documentation demonstrating compliance before placing a high-risk system on the market.
Transparency & Human Oversight
Systems must be designed to allow human oversight. Outputs must be interpretable and auditable by the people responsible for them.
Accuracy, Robustness & Cybersecurity
High-risk AI systems must achieve appropriate levels of accuracy and be resilient against adversarial manipulation, errors, and inconsistencies.
Conformity Assessment
Where required, providers follow the applicable conformity assessment procedure, using internal controls where permitted or a notified body. This governance questionnaire is not that procedure.
How the Self-Assessment Maps to EU AI Act Readiness
These domains introduce governance topics relevant to readiness. The references below are illustrative, not a complete control mapping or proof of compliance. Provider requirements and deployer duties (including Article 26) must be evaluated separately.
Penalties for Non-Compliance
Violations of prohibited AI provisions: up to €35 million or 7% of global annual turnover. Violations of high-risk AI obligations: up to €15 million or 3% of turnover. SMEs and startups may face lower caps, but obligations still apply.