EU AI Act readiness: where to start if your company uses AI

The EU AI Act is the first broad law that regulates artificial intelligence by what it is used for, not by the technology behind it. It entered into force in August 2024 and its obligations apply in stages. The bans on prohibited practices and the duty to build AI literacy among staff already apply, rules for general-purpose AI models followed in 2025, and most obligations for high-risk systems come after that. The timeline for some high-risk rules has been under review at EU level, so treat any single date as something to re-check rather than a reason to wait.

Most companies we talk to are not building foundation models. They buy software with AI inside, add a chatbot to their website, or score leads and applications with a model. The Act still matters to them, because obligations follow the role you play: provider, deployer, importer or distributor.

Step 1: make an inventory

You cannot classify what you have not listed. Start with a simple register of every system that uses AI, including features inside tools you buy. For each one, record:

• What it does and who it affects (customers, employees, applicants, the public).
• Whether you built it, bought it, or configured someone else's model.
• What data it uses and what decisions it influences.
• Who in the company owns it.

Step 2: classify by risk

The Act sorts uses into four broad groups. A small set of practices is prohibited outright, such as manipulative techniques that cause harm or social scoring. High-risk uses are listed in the Act and include areas like recruitment and worker management, credit scoring, education, and access to essential services. Some systems carry transparency duties, for example telling people they are talking to a chatbot or labelling AI-generated content. Everything else is minimal risk.

The classification decides almost everything else, so document your reasoning for each system. A short written rationale is far more useful in an audit than a spreadsheet of labels.

Step 3: close the gaps

For high-risk systems, the work is mostly about evidence: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness. Deployers have their own duties, such as using the system as instructed, assigning competent human oversight and keeping logs. For transparency-only systems, the fix is often a clear notice in the interface.

Step 4: AI literacy

Everyone who operates or uses AI systems on your behalf should understand what they do and where they fail. This does not need to be a course catalogue. A short, role-specific briefing with real examples from your own tools is usually the most effective version.

Why it pays to start now

Fines for the most serious breaches can reach €35 million or 7% of global annual turnover, whichever is higher. But the stronger reason is practical: the inventory and documentation you build for the Act are the same things that make AI systems easier to maintain, explain and improve.

If you want a second pair of eyes on your inventory or a risk classification, we run EU AI Act readiness reviews that end with a documented classification and a prioritised gap list.