AI Act compliance guide: how to achieve compliance?

What is the AI Act?

The AI Act governs the placing on the market and use of AI systems in the European Union through a risk-based approach. The principle is straightforward: the greater the potential harm a system poses to fundamental rights, safety or health, the stricter the obligations.

The text broadly defines an 'AI system' as an automated system that, from inputs, produces outputs (predictions, recommendations, decisions, content) with a certain degree of autonomy. This definition covers generative models as well as more conventional scoring or sorting algorithms.

It is structured around risk categories and introduces a specific regime for general-purpose AI (GPAI) models — those large foundation models that can serve countless downstream uses.

The four risk levels

Risk classification is the cornerstone of the entire regulation: it determines the intensity of your obligations for each system.

• Unacceptable risk: prohibited practices (generalised social scoring, manipulation exploiting vulnerabilities, certain biometric identifications). Outright prohibition.
• High risk: AI used in critical domains (recruitment, education, credit, essential services, safety components, justice, migration). Heaviest obligations.
• Limited risk: chatbots, systems generating or manipulating content (deepfakes). Transparency obligation: inform the user.
• Minimal risk: the vast majority of AI systems (spam filters, basic recommendation engines, games). No specific obligations.

Who is concerned, and in what capacity?

The AI Act targets the entire value chain. A single organisation may hold multiple roles simultaneously: provider of a tool it has developed, deployer of another it uses. Identifying your role for each system is therefore the first step towards compliance.

• Provider: develops or commissions the development of an AI system and places it on the market under its own name. Maximum obligations for high-risk systems.
• Deployer: uses an AI system in a professional capacity. Obligations regarding human oversight, compliant use, and information provision.
• Importer / distributor: makes a third-party AI system available on the European market; must verify compliance.
• Every organisation: cross-cutting obligation of 'AI literacy' — ensuring a sufficient level of competence among those who design or use AI.

The application timeline you need to know

The AI Act does not apply all at once: its obligations come into force in waves. Preparing for the right deadline avoids both panic and delay.

These milestones may be refined by implementing acts; verify the deadline applicable to your situation before making any decision.

The obligations for high-risk systems

This is the most demanding core of the regulation. A provider of a high-risk system must implement a set of requirements before placing it on the market, then maintain them throughout the entire lifecycle.

• Continuous risk management system.
• Governance of training, validation and test data (quality, representativeness, bias).
• Detailed technical documentation (Annex IV) and automatic logging.
• Transparency and information for deployers (instructions for use).
• Effective human oversight and measures for robustness, accuracy and cybersecurity.
• Conformity assessment, EU declaration and, where applicable, CE marking and registration.

What penalties apply in the event of non-compliance?

Penalties are scaled according to the nature of the infringement. SMEs and start-ups benefit from adapted caps (the lower amount applies), but remain fully subject to the obligations corresponding to the risk level of their systems.

Oversight is entrusted to national authorities and an AI Office at European level, with powers of investigation and market withdrawal.

How to achieve compliance: the 8-step roadmap

Step 1 — Inventory all your AI systems

You cannot classify what you do not know. Take stock of all AI systems developed or used: internal tools, SaaS solutions embedding AI, generative models, scoring algorithms, assistants. An AI systems register is the essential starting point, just like the GDPR register.

This inventory often reveals "hidden" AI within business software, as well as spontaneous use of consumer tools by teams. For each system, record the role played (provider or deployer) and the purpose.

• Include AI integrated into your software and SaaS tools.
• Inventory the use of generative AI by employees.
• Record, for each one, your role and the personal data processed.

Step 2 — Classify each system by risk level

Apply the AI Act framework to each system: prohibited, high-risk, limited risk, or minimal risk. This classification determines the entirety of your obligations: a minimal-risk system requires nothing specific, while a high-risk system requires a great deal.

In case of doubt, document your reasoning: it is this reasoned analysis that will protect you in the event of an audit and guide your priorities.

• Compare each use case against the lists of high-risk systems.
• Identify transparency obligations (chatbots, generated content).
• Prioritise high-risk systems in your action plan.

Step 3 — Deploy AI literacy

AI literacy is a cross-cutting obligation, required early and easy to initiate. It consists of ensuring that the people who design or use AI have a sufficient level of competence: understanding what a system does, its limitations, its biases, and the precautions for use.

It is also a worthwhile investment: trained teams make fewer mistakes, make better use of tools, and identify risky uses before they become incidents.

• Prioritise training for functions that design or oversee AI.
• Raise awareness among all users of best practices.
• Track the training actions carried out.

Step 4 — Establish governance and risk management

For high-risk systems, put in place a continuous risk management system: identification, assessment, and treatment of risks to health, safety, and fundamental rights, reassessed throughout the lifecycle.

Also structure data governance: quality, relevance, and representativeness of training, validation, and test datasets, with particular attention to biases.

• Document the risk analysis for each high-risk system.
• Monitor the quality and biases of training data.
• Define accuracy and robustness indicators.

Step 5 — Draft the mandatory documentation

The AI Act is highly documentation-intensive. Depending on your systems and your role, you must produce: technical documentation (Annex IV), instructions for use, incident management procedures, supplier clauses, and, where required, a Fundamental Rights Impact Assessment (FRIA).

Starting from adaptable templates — designed to be understandable by non-specialists — saves considerable time and eliminates the anxiety of the blank legal page.

• Compile the technical documentation for high-risk systems.
• Conduct the FRIA when it is required.
• Prepare an incident management and reporting procedure.

Step 6 — Manage suppliers and copyright

If you use third-party models or systems, you depend on their compliance. Verify your suppliers' guarantees (documentation, instructions for use, GPAI compliance) and incorporate appropriate contractual clauses.

Also document copyright compliance and data provenance, a sensitive point for generative AI and an explicit obligation for GPAI providers.

• Require the necessary documentation and guarantees from your suppliers.
• Add AI clauses to your contracts.
• Track data provenance and copyright compliance.

Step 7 — Ensure human oversight and transparency

A high-risk system must remain under human control: people must be able to understand the outputs, contest them, and, if necessary, shut the system down. Design this oversight — do not add it as an afterthought.

For limited-risk systems, comply with the transparency obligation: clearly indicating that the user is interacting with an AI, or that content has been generated or modified by AI.

• Define effective human control checkpoints.
• Inform users of interactions with an AI.
• Label content generated or altered by AI.

Step 8 — Implement continuous monitoring

AI compliance is a living process, much like the models themselves. Log usage, monitor performance and drift, establish a reporting mechanism and periodic review, and take corrective action when the system's behaviour evolves.

This continuous improvement loop is also what aligns the AI Act with the ISO 42001 standard: building one greatly facilitates the other.

• Log and monitor system operation.
• Report serious incidents to the competent authorities.
• Reassess classification and measures with every change.

Common mistakes to avoid

• Believing that the AI Act only concerns AI developers: companies that use AI are also "deployers" with their own obligations.
• Ignoring AI embedded in business software and the spontaneous use of generative AI by teams.
• Postponing AI literacy, even though it is required early and straightforward to implement.
• Underestimating the link with GDPR: most AI systems also process personal data.
• Treating the AI Act and ISO 42001 separately, and duplicating the same governance work twice.
• Neglecting technical documentation, which is at the heart of "high-risk" obligations.
• Waiting until 2026–2027 to act, when preparing high-risk systems takes a long time.

How Data Comply One supports you

Data Comply One offers a dedicated AI Act module: an AI systems register, risk-level classification, a library of document templates (usage policy, user notice, Annex IV technical documentation, supplier contracts, incident management, FRIA/AIDF, human oversight, robustness testing) and ongoing obligation tracking.

These templates are designed for non-specialists: explained step by step and adaptable to all your scenarios. You save weeks of work and avoid misinterpretation errors.

Two modes are available to you: manage your AI compliance yourself using the software, or outsource it to our experts who run it on your behalf directly on the platform. Our AI training offer brings your teams up to the level of AI literacy required by the regulation, and our experts align your AI compliance with GDPR to avoid duplication. The approach naturally aligns with ISO 42001 for those who ultimately wish to pursue certification.

Where do you stand? ·