The EU Artificial Intelligence Act is now the world's most comprehensive horizontal AI regulation. For enterprises deploying AI in or into the European Union, compliance is no longer a future planning exercise — phased obligations are already taking effect, and regulators expect demonstrable governance, not policy slides.
Risk-based classification
The Act organizes AI systems into risk tiers. Unacceptable risk practices — such as social scoring by public authorities or certain real-time biometric identification — are prohibited. High-risk systems face the heaviest requirements: conformity assessments, technical documentation, human oversight, logging, and post-market monitoring. Limited risk systems (e.g. chatbots) require transparency. Minimal risk systems have few mandatory obligations but remain subject to general product safety and data protection law.
Most enterprise pain concentrates on correctly classifying internal AI — copilots, decision-support tools, HR screening aids, and agentic workflows that touch regulated domains.
Provider vs. deployer
Organizations often wear both hats. A provider develops or places an AI system on the market. A deployer uses an AI system under its authority. Deployers of high-risk systems must implement assigned controls, monitor operation, keep logs, and cooperate with providers on incidents. If you fine-tune a foundation model for a specific workflow, you may assume provider-like duties for that system.
What regulators expect to see
- Documented intended purpose, boundaries, and non-goals for each AI use case
- Risk assessment tied to data exposure, affected persons, and autonomy of action
- Human oversight mechanisms for consequential decisions
- Technical logs linking policy versions to runtime behavior
- Evidence that controls were tested before deployment
Building a governance program
Start with a deploy gate: no AI reaches staging or production without governance intake. Automate risk tiering and control mapping where possible — manual spreadsheets do not scale across dozens of agent deployments. Tie every authorized deploy to a policy version and enforce that policy at runtime, not only at approval time.
openRegal's dual-portal workflow connects engineering intake, Regal AI assessment, compliance evidence, and runtime enforcement — giving GRC teams the audit trail the EU AI Act implicitly demands.
Key dates to track
Prohibited practices and AI literacy obligations apply from 2025. Governance rules for general-purpose AI models are phasing in through 2026–2027. High-risk system requirements follow staged timelines by category. Enterprises should map their AI inventory now and assign owners per system — waiting for final guidance is a liability.