This guide translates the regulation into what actually matters for compliance teams, boards, and AI governance functions.
The extraterritorial reach of the EU AI Act mirrors GDPR’s approach. You are in scope if:
If your SaaS product has a single EU customer using an AI feature, you are likely in scope. This catches far more US and UK companies than most realise.
The EU AI Act’s core mechanism is risk classification. Obligations scale with risk:
Certain AI practices are banned outright, including:
This is where most enterprise compliance effort concentrates. High-risk categories include:
High-risk obligations include:
Chatbots, deepfakes, and emotion recognition systems require disclosure that users are interacting with AI or AI-generated content.
The majority of AI applications (spam filters, AI in video games) fall here with no specific obligations beyond general product safety law.
Foundation models and general-purpose AI systems have their own obligations, scaling further for models deemed to carry “systemic risk” based on compute thresholds.
| Date | Obligation |
|---|---|
| February 2025 | Prohibited practices ban took effect |
| August 2025 | GPAI obligations took effect |
| August 2026 | High-risk system obligations take effect |
| August 2027 | Extended deadline for certain embedded high-risk systems |
If you are reading this and have not yet begun a high-risk classification exercise, the August 2026 deadline is closer than it appears once you account for documentation and conformity assessment lead time.
US organisations often ask how their NIST AI RMF work translates to EU AI Act compliance. The honest answer: it helps, but does not replace it.
| Aspect | EU AI Act | NIST AI RMF |
|---|---|---|
| Nature | Mandatory law | Voluntary framework |
| Enforcement | Fines up to €35M or 7% global turnover | None (reputational/contractual only) |
| Structure | Risk-tiered prohibitions and obligations | Four functions: Govern, Map, Measure, Manage |
| Scope | EU market impact, extraterritorial | Primarily US-focused, increasingly cited internationally |
| Certification | Conformity assessment required for high-risk | No formal certification |
Practical implication: Organisations using NIST AI RMF as their governance foundation have strong process maturity that maps well onto EU AI Act risk management requirements — but legal compliance still requires EU AI Act-specific documentation, conformity assessment, and CE marking for high-risk systems.
For board members and executives overseeing AI governance, the right questions are:
Before any compliance programme can function, organisations need a complete inventory:
For each AI system, document:
- Business purpose and deployment context
- Risk tier classification (and rationale)
- Data sources used for training/operation
- Human oversight mechanisms in place
- Vendor/third-party AI components
- Current documentation status
This inventory becomes the foundation for risk registers, board reporting, and conformity assessment preparation.
The EU AI Act represents a fundamental shift — AI governance is no longer a voluntary best practice for organisations with EU exposure; it is enforceable law with significant penalties. Organisations that begin systematic risk classification now will face August 2026 with confidence. Those that wait face a documentation and conformity assessment timeline that does not compress easily.
The next article in this series covers building an AI governance committee structure — who should sit on it, what authority it needs, and how it reports to the board.
Questions or corrections on this analysis? Get in touch.
]]>