Get ready for the EU AI Act with controls you already run

The EU AI Act is Regulation (EU) 2024/1689, the European Union's law on artificial intelligence. It takes a risk-based approach: some AI practices are banned outright, high-risk AI systems must meet requirements on risk management, data governance, documentation, logging, human oversight and cybersecurity, certain systems carry transparency duties, and providers of general-purpose AI models have their own obligations. It entered into force on 1 August 2024 and applies in stages.

Yes, if your AI systems reach the EU market. The Act applies to providers that place AI systems or general-purpose AI models on the EU market or put them into service there, wherever they are based, and to providers and deployers outside the EU where the output of the AI system is used in the EU. A UK business selling AI products or AI-enabled services to EU customers should assess its role and obligations.

The Act applies in phases. Prohibited practices and AI literacy applied from 2 February 2025, and general-purpose AI model obligations from 2 August 2025. Following the Digital Omnibus on AI, Regulation (EU) 2026/1744, obligations for stand-alone high-risk systems listed in Annex III are reported to apply from 2 December 2027, and for high-risk AI in products covered by Annex I from 2 August 2028. Check the current consolidated text for your use case.

Fines are tiered under Article 99. Using a prohibited AI practice can lead to a fine of up to 35 million euros or 7% of total worldwide annual turnover, whichever is higher. Breaching most other operator obligations can cost up to 15 million euros or 3%, and supplying incorrect or misleading information to authorities up to 7.5 million euros or 1%. For SMEs and start-ups, the lower of the two amounts applies.

An AI system is high-risk under Article 6 if it is a safety component of, or itself, a product covered by the EU harmonisation laws in Annex I that needs third-party conformity assessment, or if it is used in an Annex III area. Annex III areas include biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit scoring, law enforcement, migration and the administration of justice.

The AI Act sits alongside GDPR rather than replacing it: where an AI system processes personal data, both apply, and Article 10 allows special category data for bias detection only under strict safeguards. ISO/IEC 42001 is a voluntary AI management system standard. Certification to it does not by itself prove AI Act conformity, but its governance, risk and lifecycle controls overlap heavily with the Act's quality management and risk management requirements.

Start by inventorying your AI systems and deciding your role for each one: provider, deployer, importer or distributor. Then classify each system by risk, stop any prohibited uses, and for high-risk systems build a risk management system, quality management system, technical documentation, logging, human oversight and post-market monitoring. Providers complete a conformity assessment, sign an EU declaration of conformity, affix CE marking and register the system.

The EU AI Act is mapped in OneClickComply's control library and is available on request. That means its requirements are linked to the same controls, policies and evidence you use for frameworks such as ISO 27001 and GDPR, so work you have already done counts towards it. Speak to our team to enable it for your account and to get guidance from our in-house auditors.