The EU Artificial Intelligence Act is the first comprehensive, horizontal law regulating AI. It is easy for organizations headquartered elsewhere to assume it does not apply to them. That assumption is often wrong. The Act can reach organizations that place AI systems on the EU market, and in some cases organizations outside the EU whose AI outputs are used in the EU — wherever they are based.
This guide summarizes the Act at a general level and sets out practical steps global companies can take now. It is not legal advice; work with qualified counsel to interpret how the Act applies to your circumstances.
How the Act is structured
The Act takes a risk-based approach, with obligations scaled to the potential for harm:
- Prohibited practices — a short list of uses considered unacceptable, such as certain forms of social scoring and manipulative techniques, and some uses of biometric and emotion recognition technologies
- High-risk systems — AI used in defined sensitive areas, including aspects of employment, education, access to essential private and public services such as creditworthiness assessment, and critical infrastructure, as well as AI that serves as a safety component of regulated products
- Transparency obligations — for example, letting people know when they are interacting with an AI system, and labeling certain AI-generated or manipulated content
- General-purpose AI models — specific obligations for providers of foundation models, with additional duties for models considered to pose systemic risk
Obligations also depend on your role. Providers, who develop an AI system or place it on the market under their own name, carry the heaviest responsibilities. Deployers, who use AI systems in their operations, have narrower but still meaningful duties. Importers and distributors have obligations of their own.
Understand the timeline
The Act entered into force in August 2024 and applies in stages. The prohibitions and AI literacy requirements were the first to apply, in early 2025, followed by obligations for providers of general-purpose AI models later that year. Many of the remaining obligations, including those for a large group of high-risk systems, were scheduled to apply from August 2026, with some product-related high-risk obligations following later.
The European Commission has also proposed adjustments to the timing of some high-risk obligations, and implementing guidance and harmonized standards are still being developed. Because these details are subject to change, confirm the current timeline against the official text and Commission guidance before planning around a specific deadline.
Step 1: Inventory your AI and classify each system
Start by identifying every AI system you develop, buy or use, including AI features embedded in third-party software. For each, capture the purpose, the people affected, the data used, the owner — and whether it is placed on the EU market or produces outputs used in the EU.
Then assess each system against the Act's categories. Confirm that nothing in your portfolio falls under the prohibited practices. Flag candidates for high-risk classification for closer legal review. Record your role for each system, recognizing that substantially modifying a system, or putting your own name on it, can change your role from deployer to provider.
Step 2: Close the gaps for high-risk systems
Providers of high-risk systems must meet requirements covering risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, supported by a quality management system, conformity assessment and post-market monitoring. Deployers must use systems according to the provider's instructions, assign competent human oversight, monitor operation, retain logs and, in some cases, carry out a fundamental rights impact assessment.
Compare these requirements with your current practices. Many organizations find that documentation, logging and post-market monitoring need the most work, because they were never built with external scrutiny in mind.
Step 3: Address transparency and AI literacy across the board
Transparency and AI literacy duties reach well beyond high-risk systems. Review customer-facing assistants and content generation tools for disclosure requirements. Put proportionate training in place so that staff who build, buy or use AI understand its capabilities, limitations and risks, and keep a record of what has been delivered.
Step 4: Build one governance program, not many
The Act is one of several frameworks shaping AI practice. The NIST AI Risk Management Framework and ISO/IEC 42001 offer complementary structures, and the GDPR continues to apply wherever personal data is processed. Mapping a single set of controls to all of them lets one body of evidence serve multiple obligations, rather than running parallel programs for each jurisdiction.
Strengthen vendor due diligence too. Ask AI suppliers how they will support your compliance obligations, what documentation they can provide, and how they will notify you of material changes — then reflect the answers in contracts.
Penalties for the most serious breaches can be calculated as a percentage of worldwide annual turnover, but the more immediate driver for most companies is commercial. Customers and partners increasingly ask for evidence of responsible AI practice, and being able to provide it is becoming part of doing business in Europe.
databridge helps global organizations assess their AI portfolio and build governance programs aligned to the EU AI Act and other frameworks. Talk to our AI governance team.
