EU AI Act

The EU AI Act is the European Union's risk based regulatory framework for artificial intelligence, placing the heaviest documentation, data governance, and oversight obligations on AI systems classified as high risk.

The Act sorts AI systems into tiers by the risk they pose. A small set of uses are prohibited outright. High risk systems, which include AI used in consequential decisions like credit scoring and other assessments of a person's access to essential services, along with uses in areas like employment, education, and critical infrastructure, carry the most demanding requirements. Systems with narrower concerns, such as chatbots that need to disclose they are AI, face lighter transparency obligations, and most everyday AI use falls into a minimal risk category with few specific requirements.

For a high risk system, the obligations are substantial: a documented risk management process across the system's lifecycle, data governance practices covering the training, validation, and testing data behind the model, technical documentation and record keeping detailed enough to reconstruct how the system behaves, human oversight built into how the system is used, and post market monitoring once the system is in production. Conformity assessment is generally required before a high risk system can be placed on the market. The Act's obligations are phasing in on a staggered timeline, with prohibited practices addressed first and the full high risk system requirements following on a longer runway, so organizations building or deploying high risk AI should treat the compliance date as approaching rather than distant.

How the EU AI Act Relates to Adjacent Terms

GDPR governs the personal data an AI system uses; the EU AI Act governs the AI system itself, and the two obligations overlap heavily for any high risk system trained on personal data. AI governance is the broader organizational practice the Act formalizes into law for high risk uses. AI explainability and model risk management are capabilities the Act's documentation and oversight requirements draw on directly, particularly for systems making decisions that affect people's access to credit, employment, or other essential services.

Meeting EU AI Act Requirements in Practice

For a governance and compliance leader overseeing a high risk AI system such as a credit or underwriting model, the Act's documentation and data governance requirements come down to one practical question a regulator can ask at any time: what data trained and validated this model, and can you prove it. Meeting that requirement takes the kind of technical visibility, lineage, and provenance that source code analysis provides, tracing model inputs back through the pipelines and code that produced them. Provable data lineage of that kind tends to shorten the path through regulatory review rather than lengthen it.

Related Terms

• GDPR
• AI governance
• AI explainability
• Model risk management

Frequently Asked Questions

Does the EU AI Act apply to companies outside the EU?

It can. Similar to GDPR, the EU AI Act generally applies based on where an AI system's output is used, not just where the provider is based, so a company outside the EU offering an AI system to users or customers in the EU can fall within scope. Organizations should evaluate their specific systems and markets rather than assuming location alone puts them outside the Act's reach.

What makes an AI system high risk under the EU AI Act?

High risk status generally comes from the consequences of the decision the AI system supports, not the underlying technology. Credit scoring and other assessments of a person's access to essential services, along with uses in areas like employment, education, law enforcement, and critical infrastructure, are treated as high risk because a wrong or biased output can materially affect someone's life.

When do the high risk AI system obligations take effect?

The Act's obligations are phasing in over a staggered timeline rather than all at once, with prohibited practices addressed earliest and the full set of high risk system requirements following on a longer implementation runway. Because exact dates matter for compliance planning, organizations building or deploying high risk AI should confirm current timelines rather than relying on a general summary.