EU AI Act: How to Prepare Your AI Systems for Compliance
Regulation (EU) 2024/1689, the EU AI Act, applies to providers who place AI systems on the EU market, deployers who use AI systems in a professional context in the EU, and importers and distributors in the supply chain. The Regulation establishes a risk-based classification with four tiers: prohibited practices (Article 5), high-risk systems (Annex III), limited-risk systems subject to transparency obligations, and minimal-risk systems. Providers of high-risk systems bear the heaviest obligations: a quality management system, technical documentation, conformity assessment, registration in the EU database, and post-market monitoring. Deployers of high-risk systems must conduct a fundamental rights impact assessment for certain uses and maintain logs of operation. Compliance is not achieved once: the Regulation imposes ongoing obligations tied to the system lifecycle. Optivalue.ai provides the evidence framework to inventory systems, classify them by risk, assign named owners, and maintain the documentation that regulators and notified bodies require. Note that GDPR applies to AI systems that process personal data, and both obligations run concurrently for most high-risk deployments.
AI System Classification: High-Risk, Limited-Risk, General-Purpose
Article 6 and Annex III of Regulation (EU) 2024/1689 define which AI systems are high-risk. The categories include systems used in critical infrastructure, education and vocational training, employment and human resources management, access to essential private services, law enforcement, migration and border control, administration of justice, and democratic processes. A system that is both listed in Annex III and performs a safety component function, or is itself a product covered by existing product safety legislation, is high-risk by definition. Limited-risk systems, such as chatbots, must disclose their AI nature to users (Article 50). General-purpose AI models with systemic risk carry specific obligations under Chapter V of the Regulation. The first obligation of any compliance programme is therefore to inventory every AI system in use and assign it a documented classification with a named owner.
Documentation Obligations for High-Risk AI Systems
Article 11 of Regulation (EU) 2024/1689 requires providers of high-risk systems to draw up technical documentation before placing the system on the market and to keep it up to date. Annex IV specifies the content: a description of the system and its intended purpose, design choices and logic, training data and methodologies, performance metrics, known risks and mitigation measures, the quality management system reference, and post-market monitoring procedures. Article 12 requires automatic logging of events throughout the system lifecycle. Article 13 imposes transparency obligations: the system must provide sufficient information for deployers to use it correctly. Each piece of documentation must be traceable to a named owner and kept available for the duration required by Article 18 (at least ten years for high-risk systems placed on the market after the date of application).
AI Governance: Appointing an Owner and Structuring the Register
Article 9 of Regulation (EU) 2024/1689 requires providers to establish a risk management system for each high-risk AI system, covering identification and analysis of known and foreseeable risks, estimation and evaluation of risks that may arise from intended use, and residual risk evaluation after mitigation. Article 17 requires a quality management system that covers policies, design methodology, testing and validation procedures, and post-market monitoring. Governance means assigning a named owner to each system in the register; that owner is responsible for maintaining the documentation, triggering updates after changes, and reporting serious incidents under Article 73. A register without named owners produces evidence that no one can defend under examination. For risk mapping for high-risk AI systems, the same owner-assignment logic applies.
How AI Governance Software Covers the Obligations in the Text
AI governance software structures the compliance programme in three layers: an inventory of all AI systems with their classification, a documentation workspace for each high-risk system linked to the requirements of Annex IV, and a governance layer that assigns owners, tracks review cycles, and produces the evidence package for a conformity assessment or a regulatory inspection. A spreadsheet can hold an inventory for an organisation with few AI systems in a stable state; it becomes inadequate when systems are numerous, when classification decisions need audit trails, or when post-market monitoring must be logged automatically. Optivalue.ai provides each of these three layers in a single platform, connects the AI system register to the wider compliance evidence framework, and guides each named owner through the documentation obligations of Regulation (EU) 2024/1689.
Book a demonstration with Optivalue.ai
FAQ
Who is a provider under the EU AI Act?
Article 3(3) of Regulation (EU) 2024/1689 defines a provider as any natural or legal person who develops an AI system or a general-purpose AI model and places it on the market or puts it into service under their own name or trademark, whether for payment or free of charge. A company that develops an AI system for its own internal use and then deploys it is also treated as a provider for the purposes of the Regulation. The distinction between provider and deployer determines which set of obligations applies; most high-risk obligations fall on the provider.
What is the timetable for applying the EU AI Act?
Regulation (EU) 2024/1689 entered into force on 1 August 2024. The prohibition of unacceptable-risk practices under Article 5 applied from 2 February 2025. Obligations for general-purpose AI models applied from 2 August 2025. Obligations for high-risk systems listed in Annex III applied from 2 August 2026. Obligations for high-risk systems that are safety components of products covered by existing legislation apply from 2 August 2027. Dates are set in Article 113 of the Regulation and should be verified against any corrigenda published in the Official Journal of the European Union.
Does the EU AI Act apply to organisations established outside the EU?
Yes. Article 2(1)(c) and (d) of Regulation (EU) 2024/1689 extend the scope to providers established in third countries when the output of their AI systems is used in the EU, and to deployers established in third countries when their users are located in the EU. An organisation established in the United States, the United Kingdom or any other non-EU country that places a high-risk AI system on the EU market, or uses one in an EU context, is in scope and must comply with the obligations applicable to its role.
What is a fundamental rights impact assessment under the AI Act?
Article 27 of Regulation (EU) 2024/1689 requires deployers of high-risk AI systems, when they are bodies governed by public law or private entities providing public services, to carry out a fundamental rights impact assessment before deploying the system. The assessment must describe the intended use, the population affected, the risks to fundamental rights, the safeguards planned, and the monitoring arrangements. It must be submitted to the relevant market surveillance authority on request. The obligation applies from the date of application of the high-risk obligations for Annex III systems.
How does the EU AI Act relate to existing standards such as ISO 42001?
ISO 42001, the international standard for AI management systems published in 2023, provides a framework for governing AI development and use. Compliance with ISO 42001 does not automatically demonstrate compliance with Regulation (EU) 2024/1689, because the Regulation imposes specific legal requirements that go beyond management system principles. However, the risk management system required by Article 9 of the Regulation and the quality management system required by Article 17 align substantially with the ISO 42001 framework. An organisation that already operates under ISO 42001 has a structural head start on the governance layer of AI Act compliance.
Back to top
On the same topic