We align our data and services according to the EU AI Act, helping you reveal where your AI sits and what to build next.
What Is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is Europe’s comprehensive legal framework for artificial intelligence, entering into force on 1 August 2024. The Act employs a risk-based approach, establishing obligations tailored to specific risk levels, ranging from prohibited practices to minimal-risk applications.
This Act applies extra-territorially to any organization placing AI systems on the European market or whose AI outputs are used within Europe. For businesses dealing with EU clients, AI compliance is an essential extension of broader enterprise governance.
The Risk Tiers
1. Prohibited AI Practices (Enforced from 2 February 2025)
Certain AI practices are strictly prohibited due to the unacceptable risks they pose:
- Social scoring by public authorities
- Manipulative or deceptive AI techniques causing significant harm
- Exploiting vulnerabilities related to age, disability, or socio-economic status
- Real-time remote biometric identification in publicly accessible spaces for law enforcement
- Emotion recognition in workplace and educational settings (except for specific medical or safety reasons)
- Untargeted scraping of facial images to create or expand recognition databases
- Predictive policing based solely on profiling or personality traits
- Creation or dissemination of child sexual abuse material (CSAM) and non-consensual intimate imagery
2. High-Risk AI Systems (Enforcement target: 2027/2028)
AI systems utilized in critical sectors—such as biometrics, critical infrastructure, education, employment, essential public/private services, credit scoring, law enforcement, migration, and administration of justice—are categorized as high-risk.
Providers and deployers of high-risk AI systems must fulfill stringent requirements:
- Establish and maintain a continuous risk management system
- Ensure high data governance and quality standards for training and testing datasets
- Create and maintain technical documentation and complete audit records
- Provide clear transparency and instructions for end-users
- Enable effective human oversight ("human-in-the-loop")
- Ensure high levels of accuracy, robustness, and cybersecurity
- Complete conformity assessments and register the system in the EU database
- Implement post-market monitoring and report serious incidents
Deployers must ensure appropriate operational oversight, data quality maintenance, and log retention and perform Fundamental Rights Impact Assessments (FRIAs) where required.
3. General-Purpose AI (GPAI) Models (Enforced from 2 August 2025)
Providers of general-purpose AI models must adhere to key transparency obligations:
- Maintain detailed technical documentation
- Provide information and documentation to downstream AI deployers
- Publish a comprehensive summary of content used for model training
- Establish policy to respect EU copyright law
GPAI models posing systemic risk are subject to additional obligations, including model evaluation, adversarial testing, systemic risk assessment and mitigation, incident tracking, and heightened cybersecurity measures.
4. Transparency Requirements (Enforced from 2 August 2026)
Organizations must explicitly inform users when they interact with specific AI applications, including:
- AI systems generating or manipulating text, audio, images, or video
- Deepfakes and synthetic content
- Emotion recognition systems
- Biometric categorization systems
Additionally, AI-generated content must be embedded with machine-readable markings and watermarking technologies.
5. Minimal-Risk AI
Minimal-risk AI systems (such as AI-enabled video games or spam filters) face no additional mandatory requirements under the Act, though adherence to voluntary codes of conduct is encouraged.
Under Article 4, organizations must foster AI literacy across their workforce, ensuring employees possess sufficient skill and understanding to deploy AI responsibly.
How Eminenture Helps
- AI Inventory & Risk Classification: Evaluate every system and model against Articles 5, 6, 50, and key Annexes, complete with Article 6(3) analysis.
- Obligation Register by Role: Define tailored compliance steps depending on your role (provider, deployer, importer, distributor, or manufacturer).
- Technical Documentation & Annex IV Build-Out: Prepare model cards, training data summaries, and logging architectures.
- Conformity & Market Placement: Support Quality Management System (QMS) scoping, conformity path selection, CE marking, and EU database registration.
- GPAI Model Compliance: Assist with documentation, copyright policies, Code of Practice alignment, and systemic risk assessments.
- AI Governance Program: Establish governance policies, board oversight, incident response workflows, and employee AI literacy training.
- Timeline Management: Manage multi-year transition roadmaps across key enforcement dates (2025, 2026, 2027, and 2028).