EU AI Act

The EU AI Act is the European regulation that sorts AI systems into risk levels: unacceptable practices are banned outright, high-risk systems must meet documentation, data-quality, logging and human-oversight requirements before they can be sold or deployed, and the rest face lighter transparency duties.

Safety & governanceAI ActRegulation (EU) 2024/1689

§ 01DefinitionEU AI Act

No jargon, no math

In plain words, what is it?

The Act works like a building code. First you classify: every AI system you run or sell lands in one of four buckets. Unacceptable uses (social scoring, manipulative techniques) are illegal, full stop. High-risk uses (hiring filters, credit scoring, safety components in machinery) carry the heavy duties: a risk management process, documented training-data quality, technical files, automatic event logs, and a human who can override the system. Limited-risk systems (chatbots, AI-generated content) mostly owe users a disclosure: you are talking to a machine. Minimal-risk systems (spam filters, game AI) are left alone. Before a high-risk system goes live, it passes a conformity assessment, an auditable paper trail. After launch the obligations continue: incident reporting, post-market monitoring. The boundary people miss: the Act binds whoever deploys the system in the EU, not just whoever built it. Buying an AI tool does not outsource your duties, and penalties for getting it wrong run to percentage points of global turnover.

A real example

The letter. A key customer asks your 600-employee appliance plant to confirm EU AI Act compliance before renewing the contract. The operations director realises nobody has mapped which AI the company actually runs.The sort. An audit finds three systems. The CV-screening tool is high-risk by the Act's employment rules. The weld-inspection camera on line 2 is high-risk as a safety component of machinery. The meeting-notes assistant is minimal risk.The work. The two high-risk systems get a file each: risk register, training-data documentation, an override procedure for the line supervisor, event logs. The vendors' technical files fill half of each dossier; the plant writes the rest.The boundary. The questionnaire asks who is accountable. The answer: the plant, as deployer, not just the vendor. Getting it wrong can cost up to 3% of global turnover, so the file is maintained, not archived.

§ 02Glossary3

Terms that live nearby.

BUSINESS & STRATEGY

AI Governance

AI governance is the set of policies, roles and controls that decide how an organisation may build, buy and use AI: who approves a use case, what data a model may see, how incidents are handled, and who is accountable when something goes wrong.

Read

BUSINESS & STRATEGY

AI Audit

An AI audit is a structured review of how an organisation actually uses AI: every tool, model and workflow is inventoried, then tested for accuracy, data exposure, cost and compliance, with findings ranked by risk and a remediation plan attached.

Read

SAFETY & GOVERNANCE

Explainability

Explainability is the property of an AI system (or of a layer added to it) that lets you see why it gave a specific answer: which inputs mattered, which rules fired, and what would have changed the outcome.

Read

§ 03

Want this running in your stack?

We design and ship AI systems with permissions, logs and human approval. It starts with a 30-minute scoping call.

Book a scoping call