AI Act Compliance: The Non-Negotiable Requirement

The EU AI Act is the first comprehensive legal framework for artificial intelligence, categorizing AI systems by risk level and imposing specific requirements

TAGS: Compliance, AI Act, Risk Management

Executive Summary

The EU AI Act is the first comprehensive legal framework for artificial intelligence, categorising AI systems by risk level and imposing specific requirements. Non-compliance carries significant penalties: up to €35 million or 7% of global annual turnover. Most teams don’t understand how to classify their AI systems or implement compliance requirements. This article explores the AI Act compliance requirements and why early risk assessment is critical.

The EU AI Act: What It Means

The EU AI Act represents a fundamental shift in how AI systems must be developed, deployed, and maintained. It’s the first comprehensive legal framework specifically designed for artificial intelligence, establishing a risk-based approach to regulation.

Penalties for Non-Compliance

Non-compliance carries severe penalties:

• Up to €35 million or 7% of global annual turnover (whichever is higher)
• Reputational damage
• Loss of customer trust
• Potential product bans
• Legal liability

These penalties make compliance non-negotiable for organizations operating in or serving the EU market.

Risk-Based Approach

The AI Act categorizes AI systems into four risk levels, each with different compliance requirements:

• Prohibited: Completely banned
• High-risk: Strict compliance required
• Limited-risk: Transparency obligations
• Minimal-risk: No specific obligations

The Risk Classification Challenge

Most teams don’t know how to classify their AI systems correctly, leading to either over-classification (unnecessary compliance overhead) or under-classification (missing required compliance measures).

Prohibited AI Practices

Completely banned AI practices include:

• Social scoring systems that evaluate trustworthiness
• Manipulative or exploitative AI that causes harm
• Real-time remote biometric identification in public spaces (with limited exceptions for law enforcement)
• Biometric categorization based on sensitive attributes (race, political opinions, etc.)

High-Risk AI Systems

Strict compliance required for:

• Medical devices with AI components
• Credit scoring and financial assessment systems
• Hiring and recruitment tools
• Critical infrastructure safety systems
• Law enforcement tools
• Education and training systems
• Access to essential services

Limited-Risk AI Systems

Transparency obligations for:

• Chatbots and conversational AI
• AI-generated content (must be labeled)
• Emotion recognition systems
• Deepfakes and synthetic media

Minimal-Risk AI Systems

No specific obligations for:

• Spam filters
• Recommendation engines
• Video games
• General-purpose AI systems (with some exceptions)

Common Classification Errors

Teams often:

• Over-classify: Applying unnecessary high-risk requirements to minimal-risk systems
• Under-classify: Missing required compliance measures for high-risk systems
• Don’t classify: Assuming minimal-risk when systems are actually high-risk

The Compliance Requirements

For high-risk systems, the AI Act requires comprehensive compliance measures.

Risk Management System

Continuous risk assessment and mitigation:

• Identify and assess risks throughout the AI system lifecycle
• Implement risk mitigation measures
• Monitor and update risk assessments
• Document risk management activities

Data Governance

Representative, relevant, and sufficient training data:

• Data quality management
• Bias detection and mitigation
• Data representativeness
• Data governance processes

Technical Documentation

Detailed documentation of the AI system:

• System architecture and design
• Training data and methodology
• Performance metrics and evaluation
• Risk assessment and mitigation
• Human oversight mechanisms

Record Keeping

Logging of AI system operations:

• Operation logs
• Decision records
• Error tracking
• Performance monitoring

Transparency

Informing users about AI usage:

• Clear disclosure of AI system use
• Information about capabilities and limitations
• User rights and remedies
• Contact information for inquiries

Human Oversight

Effective human oversight mechanisms:

• Clear approval gates
• Defined intervention points
• Transparent decision-making
• Traceable accountability

Accuracy, Robustness, and Cybersecurity

Ensuring system reliability and security:

• Accuracy requirements
• Robustness testing
• Cybersecurity measures
• Adversarial testing

The Cost of Non-Compliance

Teams that assess risk late face significant costs.

Costly Refactoring

Adding compliance measures after implementation requires:

• Architecture changes
• Code refactoring
• Process redesign
• Documentation creation
• Testing and validation

This can cost 2–3x more than building compliance in from the start.

Potential Penalties

Non-compliance risks:

• Financial penalties (up to €35M or 7% of turnover)
• Reputational damage
• Loss of customer trust
• Product bans
• Legal liability

The Early Assessment Advantage

Teams that assess risk early:

• Build compliance into architecture from the start
• Maintain proper documentation from day one
• Design security measures in, not bolt them on
• Integrate human oversight into workflows
• Avoid costly refactoring

Risk Classification

Correctly classify AI systems by risk level:

• Understand AI Act definitions and guidance
• Assess system characteristics and use cases
• Determine appropriate risk category
• Document classification rationale

Compliance Requirements Implementation

Understand and implement requirements:

• Identify applicable requirements for risk level
• Design compliance into architecture
• Implement compliance measures from start
• Maintain compliance documentation

Human Oversight Design

Design effective human oversight:

• Define approval gates for critical decisions
• Establish intervention points
• Create transparent decision-making processes
• Ensure traceable accountability

Documentation Maintenance

Maintain technical documentation:

• Meet AI Act documentation requirements
• Keep documentation current
• Ensure completeness and accuracy
• Enable compliance verification

Security Integration

Build security into workflows:

• Design secure AI integration patterns
• Implement security measures from start
• Conduct security testing
• Maintain security documentation

The Ongoing Compliance Challenge

Compliance is not a one-time activity. It requires continuous attention and maintenance.

Ongoing Risk Assessment

As systems evolve:

• Reassess risk classification
• Update risk assessments
• Adjust compliance measures
• Monitor for new risks

Regular Compliance Audits

Conduct regular audits to:

• Verify compliance status
• Identify compliance gaps
• Update compliance measures
• Ensure ongoing compliance

Documentation Updates

As requirements change:

• Update technical documentation
• Maintain compliance records
• Ensure documentation accuracy
• Enable compliance verification

Monitoring and Training

Continuously:

• Monitor for new compliance requirements
• Train teams on compliance requirements
• Update compliance processes
• Ensure compliance awareness

Conclusion

AI Act compliance is non-negotiable. Teams that don’t understand compliance requirements risk significant penalties and reputational damage. A POAI ensures compliance from day one, avoiding costly refactoring and ensuring ongoing compliance as systems evolve.

Early risk assessment and compliance implementation are critical. Organizations that build compliance into their AI systems from the start avoid costly refactoring and ensure ongoing compliance. Those that don’t face significant risks and costs.

About the Author: Michael Wybraniec is a Software Architect and Developer with expertise in Agentic Context Engineering. He has made AI Act compliance audit tool for projects made with AWP 10x. He helps organisations ensure compliance from day one.

For more insights on Product Management and AI, connect with me on www.one-front.com