Getting Ready for the EU AI Act: What You Should Know For Effective Compliance

The AI Act classifies AU systems into four categories based on a risk-based framework. The four categories are: unacceptable risk (prohibited), high-risk, limited-risk, and minimal-risk. High-risk AI systems typically include biometric identification, employment decisions, and critical infrastructure, making them subject to elevated compliance requirements such as documentation, transparency, and human oversight. Other tiers are subject to relatively moderate obligations, ensuring the tied approach ensures appropriate oversight measures based on their potential impact.

The AI Act has an extensive set of provisions related to penalties. The maximum is €35 million or 7% of their global annual turnover, whichever is higher. Various factors will be taken into account when assessing the penalty amount, including the nature of the violation and the prohibited AI practices and AI systems used.

The AI Act has been designed to complement the EU’s other landmark regulations, such as the GDPR, by focusing acutely on the risks and governance of AI systems. While the GDPR is meant to regulate how personal data is collected, processed, stored, shared, and protected, the AI Act governs how AI systems use such data, specifically in high-risk contexts. There are various intersections between the two regulations, such as transparency, data protection, and user rights, requiring organizations to adopt a proactive and integrated approach when devising their compliance strategy.