Introduction
The EU AI Act, which the European Commission describes as the "first-ever comprehensive legal framework on AI worldwide", does not regulate AI uniformly. It assigns compliance obligations proportional to harm potential — meaning your burden depends almost entirely on what your AI systems do and where you sit in the supply chain.
This guide is written for boards, executive teams, CISOs, and risk leaders — particularly those at US-based organizations operating in or supplying to EU markets. The Act's extraterritorial reach is explicit: under Article 2, any organization whose AI outputs are intended for use in the EU falls within scope regardless of where that company is headquartered, and that exposure applies whether or not you have a European office.
The primary deadline most organizations face is 2 August 2026, when Annex III high-risk obligations become enforceable. That window is shorter than it looks once you account for inventory, classification, documentation, and conformity assessment work.
TL;DR
- The EU AI Act assigns four risk tiers: unacceptable (banned), high risk (strictly regulated), limited risk (transparency required), and minimal risk (no obligations)
- Your compliance burden depends on both your risk tier and your role — provider (developer) or deployer (user)
- High-risk systems must clear conformity assessments, maintain technical documentation, register in the EU database, and sustain post-market monitoring
- Penalties reach €35 million or 7% of global annual turnover for prohibited AI use
- US-based companies are not exempt — Article 2 applies extraterritorially based on where AI outputs are used
What Is the EU AI Risk Framework?
The EU AI Act does not apply uniform rules to all AI systems. Instead, it assigns regulatory requirements proportional to the potential harm a system poses to health, safety, or fundamental rights. Low-harm applications face few or no obligations; high-harm applications face extensive controls.
Two Roles That Shape Every Compliance Question
The Act draws a sharp line between two categories of organization:
- Providers (Article 3(3)): entities that develop an AI system or have one developed, and place it on the market under their own name or trademark
- Deployers (Article 3(4)): entities that use an AI system under their authority in a professional context
Most compliance obligations attach differently depending on which role applies. Providers carry the heaviest documentation and conformity burden. Deployers carry operational oversight and monitoring obligations.
One important nuance: a company that builds a proprietary AI tool and also runs a third-party AI system occupies both roles simultaneously and must satisfy obligations on each side.
Key Dates
The Act entered into force on 1 August 2024. Prohibited AI provisions applied from 2 February 2025. Most requirements — including Annex III high-risk system obligations — apply from 2 August 2026.
One clarification worth making early: the AI Act governs the AI system itself — its design, deployment, and risk management. GDPR governs the handling of personal data. The two frameworks can apply simultaneously to the same product, but they address different objects.
The Four Risk Tiers: What They Mean for Your Organization
Every AI system must be classified before any compliance work proceeds. The tier determines the entire compliance burden — there is no useful shortcut around this step.
Unacceptable Risk (Prohibited)
These systems are banned outright under Article 5. The list includes:
- Social scoring by public or private entities
- Subliminal, manipulative, or deceptive techniques that distort behavior and cause significant harm
- Exploitation of vulnerabilities based on age, disability, or socioeconomic situation
- Biometric categorization to infer sensitive attributes such as political views or religious beliefs
- Real-time remote biometric identification in publicly accessible spaces (narrow law enforcement exceptions apply)
Deploying a prohibited system carries the Act's highest penalty: up to €35 million or 7% of global annual turnover, whichever is higher. Prohibited provisions have already been in effect since February 2025.
High Risk
High-risk systems are not banned, but they face the most stringent requirements. Two pathways create high-risk status:
- Product-embedded AI (Article 6(1)): AI used as a safety component in products covered by EU harmonization legislation — medical devices, machinery, vehicles
- Annex III applications: Eight domains where AI decisions significantly affect individuals' rights or safety
Those eight Annex III domains cover:
- Biometrics and biometric identification
- Critical infrastructure management
- Education and vocational training assessment
- Employment, worker management, and access to self-employment
- Access to essential private and public services, including credit scoring and creditworthiness
- Law enforcement
- Migration, asylum, and border control
- Administration of justice and democratic processes
Organizations in financial services, healthcare, and retail are especially likely to operate Annex III systems. Credit scoring models, recruitment screening tools, and patient triage systems all fall within this tier. The August 2026 deadline is the operative compliance date.
Limited Risk
Limited-risk systems face transparency obligations under Article 50. Users must be informed they are interacting with AI unless it is obvious, and synthetic audio, image, video, and text outputs must carry machine-readable markers. This tier covers chatbots, AI-generated content tools, and most conversational AI.
A separate threshold applies to general-purpose AI (GPAI) models: those whose cumulative training compute exceeds 10^25 FLOPs are presumed under Article 51 to carry systemic risk. These models face additional obligations that go beyond basic transparency disclosures.
Minimal Risk
Spam filters, product recommendation engines, and similar low-stakes tools fall here. No mandatory obligations apply. Even so, organizations should document the classification rationale — that assessment is what demonstrates due diligence when regulators ask, not simply the absence of an obligation.
Compliance Obligations: What Providers and Deployers Must Do
Provider Obligations for High-Risk AI Systems
Providers face the most extensive requirements. Before placing a high-risk system on the EU market, a provider must:
- Establish a risk management system (Article 9) — a continuous process across the full system lifecycle, not a one-time pre-launch review
- Maintain technical documentation covering the system's design, development, and intended purpose
- Implement a quality management system aligned with the Act's requirements
- Conduct a conformity assessment before market entry
- Register the system in the EU database (Article 49) prior to deployment
- Monitor post-market performance (Article 72) and report serious incidents to relevant authorities (Article 73)
The lifecycle framing of Article 9 matters. Risk management that stops at deployment is non-compliant. Systems that are fine-tuned, retrained, or repurposed after launch must be reassessed.
Deployer Obligations
Deployers of high-risk AI systems cannot simply accept provider documentation and consider compliance satisfied. Article 26 requires deployers to:
- Assign human oversight to competent, trained personnel
- Monitor system operation per provider instructions
- Maintain automatically generated logs where under their control
- Inform affected workers and end users in specified cases
- Suspend use if the system presents unexpected risk or a serious incident occurs
Using a third-party vendor's high-risk AI system under your organization's authority makes you the deployer — and activates these obligations fully.
GPAI Model Obligations
Article 53 governs standard GPAI model providers. Article 55 adds a second tier for models deemed to pose systemic risk. Obligations by tier:
Standard GPAI providers (Article 53):
- Maintain technical documentation
- Provide information to downstream providers
- Establish a copyright compliance policy
- Publish a summary of training content
Systemic-risk GPAI providers (Article 55), all of the above, plus:
- Conduct adversarial testing
- Mitigate identified systemic risks
- Report serious incidents to the EU AI Office
Connecting to Existing Governance Frameworks
Article 9's risk management requirement does not have to be built from scratch. Organizations with mature NIST RMF, ISO 27001, or ISO 42001 programs can map existing controls to AI Act obligations rather than creating parallel structures. The Cloud Security Alliance's AI Controls Matrix (AICM), which aligns explicitly with NIST AI RMF and the EU AI Act, provides one practical integration point.
That mapping work also surfaces a governance gap boards need to understand. Deloitte research found that 79% of boards have limited, minimal, or no AI knowledge or experience, while only 2% are highly knowledgeable — and 45% of respondents said AI was not on the board agenda at all.
Boards don't need to manage compliance directly. They do need enough working knowledge of these obligations to evaluate what management is telling them and push back when the answers are thin.
How to Classify Your AI Systems: A Practical Approach
Classification comes first — before documentation, conformity assessments, or registration. Start with a full AI system inventory covering both internally built tools and third-party vendor applications. Deployer obligations apply to vendor AI operated under your authority just as they do to proprietary systems.
Step 1: Check for Prohibited Applications
Evaluate every AI system against the Article 5 prohibited practices list. If any system performs social scoring, exploits vulnerable populations, conducts real-time remote biometric identification in public spaces, or uses subliminal manipulation techniques — stop use immediately and initiate legal review. These prohibitions have been in effect since February 2025.
Step 2: Assess Against Annex III for High-Risk Status
Work through the eight Annex III domains. The core question: does the system make or materially influence decisions affecting individuals in any of those domains?
Article 6(3) offers a limited exception — Annex III systems that neither pose significant harm risk nor materially influence decision-making may avoid high-risk classification. One carve-out applies regardless: systems that profile natural persons stay high-risk with no exception available.
Two rules for borderline cases:
- Default to high-risk classification pending formal guidance from the Commission
- Document your reasoning before placing the system on the market — Article 6 requires this documentation regardless of which direction the assessment goes
The Commission's high-risk AI classification guidelines provide practical examples for providers and deployers working through ambiguous cases.
Step 3: Determine Transparency and Minimal Risk Status
Systems that survive Steps 1 and 2 need one more check before classification is complete:
- Article 50 transparency check: Any generative AI, conversational AI, or synthetic content tools must meet limited-risk disclosure requirements before deployment
- Minimal risk confirmation: All other systems fall into minimal risk — but the classification decision still requires documentation as evidence the assessment was conducted
Common Misconceptions and Governance Pitfalls
"The EU AI Act only applies to EU companies." It does not. Article 2's extraterritorial scope covers any provider or deployer outside the EU where AI output is intended for use in the Union. A 2024 German Law Journal analysis from Cambridge University Press confirmed the Act will likely produce a Brussels Effect, extending EU standards to non-EU organizations serving EU markets. US boards that have not yet assessed their EU AI exposure already have a compliance gap, not a compliance future.
"We classified our AI systems at launch. We're done." Classification is not a one-time exercise. Article 9(2) requires a continuous, iterative risk management process throughout the entire AI lifecycle. A model that is fine-tuned, extended to a new use case, or integrated with new data sources may need reclassification. Governance programs that treat AI Act compliance as a legal project with a completion date will fail under scrutiny.
"We've delegated AI Act compliance to legal and IT." Delegation without oversight is not governance. The Act's requirements span legal, technical, and operational functions simultaneously:
- Conformity assessments
- Post-market monitoring
- Serious incident reporting
- EU database registration
Boards and audit committees need defined escalation thresholds, clear decision rights, and regular reporting on AI risk posture. Active oversight must be demonstrable — awareness alone is not sufficient.
This is where board-level advisory support earns its place. Tyson Martin's board advisory work addresses this gap directly — translating complex AI risk obligations into board-ready frameworks with clear decision rights, escalation thresholds, and governance structures that hold up under regulatory scrutiny.
His AI Governance Starter Pack, a fixed-fee 30-day sprint, delivers an AI risk assessment, decision-rights map, board-level AI policy, and a facilitated director briefing — moving boards from zero formal AI governance to a defensible posture without operational friction.
Frequently Asked Questions
What are the 4 levels of risk in the EU AI Act?
The four tiers are unacceptable risk (banned outright), high risk (extensive compliance obligations including conformity assessments and ongoing monitoring), limited risk (transparency disclosures required), and minimal risk (no mandatory obligations). The tier a system falls into determines the entire compliance burden.
What is the EU risk-based approach to AI?
The EU AI Act assigns regulatory requirements proportional to the potential harm a system poses to health, safety, or fundamental rights. Higher-harm applications face stricter controls; lower-harm applications face little or none. A spam filter and a credit scoring model, for example, are not treated the same way.
What is the EU AI liability framework?
The AI Act itself focuses on compliance obligations and administrative fines for operators. A separate AI Liability Directive was proposed to make it easier for individuals harmed by AI to seek civil compensation — but that proposal was officially withdrawn in October 2025 and is no longer active legislation.
Does the EU AI Act apply to US-based companies?
Yes. Article 2 applies extraterritorially: any organization whose AI systems are placed on the EU market or whose AI outputs are intended for use in the EU must comply, regardless of where the company is headquartered.
What are the penalties for non-compliance with the EU AI Act?
Three penalty tiers apply under Article 99: up to €35 million or 7% of global annual turnover for prohibited AI use; up to €15 million or 3% for other compliance violations; and a lower tier (1%–1.5%, with published sources in conflict) for providing incorrect information to authorities. Verify the third tier against the official text before relying on any summary.
How does the EU AI Act define a high-risk AI system?
The Act identifies two paths to high-risk classification:
- Article 6(1): The system is embedded as a safety component in a regulated product, such as a medical device or vehicle.
- Annex III: The system falls into one of eight listed domains — including credit scoring, recruitment, law enforcement, and critical infrastructure — where AI decisions significantly affect individuals' rights or safety.
