EU AI Act Compliance Roadmap

The EU AI Act entered into force on August 1, 2024, with a staggered enforcement timeline. Understanding this timeline is critical for prioritizing compliance work. Organizations that wait until obligations become enforceable will not have enough time to implement the required controls, documentation, and organizational changes.

The Act classifies AI systems into four risk tiers, each with different compliance obligations. The classification depends on the system's intended purpose and the sector in which it operates, not on the underlying technology. A simple logistic regression model used for credit scoring is high-risk, while a sophisticated LLM used for internal code review is likely limited or minimal risk.

The assessment phase establishes your compliance baseline. It produces three deliverables: a complete AI system inventory with risk classifications, a gap analysis comparing current controls against Act requirements, and a resource plan for closing identified gaps. This phase is primarily an analytical exercise, but its output determines the scope and cost of the implementation phase.

Begin by cataloging every AI system in your organization: production systems, systems in development, third-party AI services you integrate, and AI components embedded in other products. For each system, document its intended purpose, the sectors and user populations it serves, the data it processes, and the decisions it influences. Then classify each system using the Act's risk tier definitions, paying careful attention to the Annex III list of high-risk use cases.

The implementation phase builds the technical controls, documentation, and organizational processes required for compliance. For high-risk systems, this is substantial work. The Act requires a documented risk management system, data governance practices, technical documentation (the 'technical file'), automatic logging of system operation, transparency and provision of information to users, human oversight mechanisms, and demonstrated accuracy, robustness, and cybersecurity.

The certification phase prepares your organization for conformity assessment. For most high-risk AI systems, conformity assessment can be performed internally (self-assessment against harmonized standards). However, certain categories -- notably remote biometric identification -- require assessment by a notified body (an independent third-party assessor). The certification phase includes preparing the conformity assessment documentation, conducting internal audits against the technical file, engaging a notified body if required, and completing the EU Declaration of Conformity and CE marking.

The technical file is the central artifact of conformity assessment. It must contain a general description of the system, detailed documentation of the system design, a description of the risk management system, data governance documentation, technical documentation per Article 11, instructions for use, evidence of accuracy and robustness testing, and a description of the post-market monitoring system. Plan for this documentation to take several weeks to compile even if the underlying controls are already in place.