Skip to content
Back to insights

AI Governance

What does the EU AI Act actually mean for your organization?

European Union flags outside a glass office building

Most conversations about the EU AI Act start with the wrong question: “does this apply to us?” Almost every organization using AI in the EU, or serving EU customers, is in scope somewhere. The more useful question is: which of our AI use cases fall into which risk tier, and what does that tier actually require of us?

A risk ladder, not a single rulebook

The Act doesn’t regulate “AI” as one thing. It sorts systems into tiers based on what they do and who they affect:

  • Unacceptable risk: practices like social scoring or manipulative systems that exploit vulnerabilities. These are prohibited outright, not regulated.
  • High-risk: systems used in areas like employment, credit, education, or critical infrastructure, where a wrong output has real consequences for a person. This tier carries the bulk of the compliance obligations.
  • Limited risk: systems like chatbots or emotion-recognition tools, where the main obligation is transparency: telling people they’re interacting with AI.
  • Minimal risk: most everyday AI features (spam filters, recommendation widgets) carry no additional obligations.

The practical implication: two AI features built with the same underlying model can sit in completely different tiers depending on what decision they inform.

What “high-risk” actually asks for

If a system lands in the high-risk tier, the obligations are concrete, not aspirational:

  • A risk management system that runs across the system’s lifecycle, not a one-time assessment.
  • Data governance: knowing what data trained and feeds the system, and being able to show it’s fit for purpose.
  • Technical documentation thorough enough that a regulator (or your own team, a year later) can understand how the system works.
  • Human oversight designed into the workflow, not bolted on as a disclaimer.
  • Logging and monitoring so the system’s behavior over time is traceable.

None of this is exotic. It’s closer to the discipline good engineering teams already apply to production systems. The Act just makes it a requirement rather than a best practice.

Where organizations actually get stuck

In practice, the hard part isn’t understanding the rules. It’s the step before: most organizations don’t have a reliable inventory of where AI is already being used, built, or bought. Without that inventory, classification is guesswork, and without classification, none of the tiered obligations above have anywhere to attach.

That’s the practical starting point we’d recommend regardless of exact deadlines or enforcement timelines, which are worth confirming against the current official guidance rather than any single article: get an honest, current picture of your AI use cases first, then classify, then govern. Trying to do it in the other order is how “AI governance” programs stall into paperwork nobody can act on.