When it comes to the AI Act, many organisations’ instinctive reaction is to pass the matter on to the data science team or the legal department. This is a mistake that risks proving costly, as is the case with other well-known European regulations, both in terms of fines and in terms of operational, reputational and business exposure.
The reality is that the AI Act came into force on 1 August 2024 and is fully applicable from 2 August 2026, with some provisions extending until 2027 (for high-risk systems); its phased implementation has already triggered specific obligations, and the European Commission is adamant on this point: bans on systems posing an unacceptable risk came into force on 2 February 2025, whilst obligations for GPAI models (such as ChatGPT, Claude or Gemini used in production) apply from 2 August 2025.
However, there is something even more important to understand about the AI Act, namely that it is not only significant for those who develop artificial intelligence, but also has a very direct impact on those who use it within organisations to make decisions that affect people.
Who really falls into the ‘high-risk’ category?
The group most at risk includes all companies that use AI systems in their recruitment processes, employee appraisals, credit assessments, insurance scoring, and systems used in healthcare, education and critical infrastructure. It is very common for companies to fall into this category without realising it; these are not niche cases.
If your organisation uses automated tools for one or more of these processes, then you are almost certainly considered to be in a high-risk scope under Regulation (EU) 2024/1689:
- HR recruitment and management (CV screening, performance appraisal, staff turnover analysis)
- Credit scoring or risk assessment (access to credit, insurance, supplier ratings)
- Biometric authentication (corporate access via facial or behavioural recognition)
- Decision support in medical or legal contexts (AI diagnostics, clinical predictive analytics, legal research assistants)
For these systems, by 2 August 2026 (and by 2027 in certain respects), the following are required: comprehensive technical documentation, human supervision, a risk management system, and demonstrated data quality. These are not merely minor administrative formalities, but structural requirements that necessitate defined processes, roles, and verifiable evidence.
It is also worth noting the requirement for AI literacy: all employees who use AI systems must have a basic level of competence commensurate with their role. This requirement is already in place.
The first real steps
Regardless of where you start, the compliance process involves a number of essential steps that are worth getting started on straight away:
Inventory of AI systems in use
Before any assessment can be made, it is important to understand what is currently in use within the company, including both authorised and unauthorised AI.
Risk classification
Once the inventory has been compiled, each system must be classified in accordance with the taxonomy used by the AI Act. This classification determines which obligations apply and with what degree of urgency
Review of contracts with suppliers
The distinction between providers (those who develop) and deployers (those who use) is central to the AI Act. Their responsibilities differ, but the issue of roles is certainly key. Regulatory alignment is essential.
Integration with existing frameworks
If a risk management process is already in place (NIS2, ISO 27001, GDPR), the next step is to determine what can be integrated, what needs to be expanded and what needs to be implemented – no easy task
Training and AI literacy
The requirement is already in force. It does not require everyone to undertake advanced technical training, but rather a basic understanding commensurate with each individual’s role, based on their exposure to AI systems.
Are you also using AI and want to understand how to position yourself in relation to the AI Act?
Contact us to find out how to comply with the AI Act right away!