The EU AI Act and what businesses need to know

The way we develop; deploy; and interact with AI is changing; fast. But with innovation comes regulation. The EU AI Act; the world’s first comprehensive AI legislation; is now in place and will soon shape how businesses manage risk; compliance; and trust in their AI systems. 

Whether you are building your own models or using third-party AI tools; this regulation matters; and preparation starts now. 

What is the EU AI Act?

Officially adopted in July 2024; the EU AI Act introduces a structured; risk-based approach to AI governance. The goal? Ensure AI is safe; transparent; and respects fundamental rights. 

AI systems are classified into four risk categories: 

• Unacceptable risk – Banned entirely (e.g. social scoring; real-time biometric surveillance). 
• High risk – Heavily regulated; covering use cases like recruitment; healthcare; law enforcement; and infrastructure. s
• Limited risk – Subject to transparency requirements (e.g. chatbots; emotion recognition tools). 
• Minimal risk – Low concern AI (e.g. spam filters); with no specific legal obligations. 

There are also added responsibilities for General-Purpose AI (GPAI) systems and foundation models; including transparency around training data and safeguards for highly capable models. 

Does this affect you?

If your AI systems operate within the EU or serve EU users; the EU AI Act applies to you – even if your company is located outside the EU.

This applies to: 

• AI developers and providers – companies that create AI systems and place them on the EU market.
• AI users/deployers – companies or organisations that use AI tools in their operations within the EU.
• AI importers and distributors – businesses that import or resell AI tools developed outside the EU.

Why this matters to your business

Beyond compliance; the EU AI Act sets the tone for global regulation. Failing to prepare now could lead to: 

• Significant penalties – up to 7% of global turnover for serious breaches.
• Loss of trust – from clients; investors; and the public.
• Competitive risk – as customers and partners increasingly expect transparent; ethical AI.

Early compliance unlocks opportunity. By taking action now; companies can build a futureproof AI governance framework; align with other standards such as ISO 42001; and demonstrate leadership in responsible AI.

Timeline: when is this happening?

• Feb 2025: Ban on unacceptable risk AI systems takes effect.
• Aug 2025: GP AI transparency and risk requirements begin.
• Aug 2026: High risk system obligations enforced.
• Aug 2027: Full compliance required; including CE marking.

How your organisation can get ahead

Map your AI landscape 

Audit where and how AI is used across your organisation; including externally sourced tools. Understand their purpose; data flows; and outcomes. 

Assess risk levels 

Classify each system using the EU AI Act’s risk tiers. If high-risk; identify the gaps in documentation; oversight; and monitoring. 

Build your AI governance framework 

Establish clear ownership. Define roles; responsibilities; and escalation paths for AI-related decisions. Integrate human oversight; ethical principles; and ongoing model evaluation. 

Prepare technical documentation 

Especially for high-risk systems; you will need comprehensive records; from training datasets to performance metrics; security controls; and user guidance. 

Upskill teams 

AI literacy matters. Equip teams with the knowledge to identify risks; follow procedures; and stay compliant. 

How we can help

The EU AI Act introduces complexity; but compliance does not have to be chaotic. 

If you are already using Hicomply for ISO 27001; SOC 2; or GDPR frameworks; you know the value of structured; scalable compliance. That same logic applies to AI governance. 

Hicomply can support you to: 

• Map and manage AI-specific risks. 
• Centralise documentation and audit logs. 
• Automate compliance processes and evidence collection. 
• Align AI governance with ISO 42001 and other emerging standards. 

The EU AI Act is more than just a regulatory milestone; it is a catalyst for better; more transparent AI. Organisations that act now will be better placed to adapt; differentiate; and thrive in a world where ethical AI is not a nice-to-have; but a legal necessity. 

Ready to simplify your AI compliance journey? Book a demo with our team today to see how Hicomply can help.