EU AI Act Compliance Assessment

The EU AI Act entered into force in August 2024, with phased implementation obligations running through 2027. For a DACH-region enterprise with 23 active AI deployments across five business units, the immediate question was not whether compliance was required — it was which systems were in scope and what each classification meant operationally.

Leadership needed a clear, defensible view of their AI portfolio before external regulatory scrutiny intensified and before procurement partners began requiring AI Act compliance documentation.

The organization underestimated the breadth of the Act's reach. Several systems assumed to be low-risk fell into Annex III high-risk categories once sector, affected user groups, and decision autonomy were properly assessed.

• No consistent definition of what constituted an AI system under the Act across business units.
• Provider versus deployer obligations were misunderstood — the client was a deployer for several third-party systems but had assumed compliance responsibility sat with vendors.
• No governance structure owned the classification and remediation program across business units.

The engagement followed three phases: system inventory and profile collection, risk tier classification against EU AI Act criteria, and obligations mapping with a phased remediation roadmap.

Each AI system was characterized by its purpose, affected user groups, sector context, decision autonomy, and reversibility — the minimum profile needed to apply the Act's classification criteria consistently.

• Structured system inventory across five business units.
• Deterministic risk tier assignment using EU AI Act Article 5, Annex III, and Article 50 criteria.
• Per-system compliance checklist with article references and named compliance owners.

The compliance architecture treated each AI system as a governed asset: classified by risk tier, assigned a compliance owner, tracked against mandatory obligations, and scheduled for periodic review as systems evolve and regulatory guidance develops.

The architecture separated the classification layer from the obligations tracker, allowing risk tiers to be updated independently as system configurations changed without requiring a full reassessment.

Governance was structured around the distinction the Act draws between providers and deployers. For most third-party AI tools, the client was a deployer — which carries different but significant obligations under Article 25.

• Each high-risk system was assigned a named compliance owner responsible for technical documentation, monitoring, and incident reporting.
• A quarterly review cadence was established to update classifications as systems changed and EU Commission guidance developed.
• Systems flagged for possible unacceptable risk received immediate escalation outside the standard compliance program.

The assessment produced a clear portfolio view: 23 systems classified, 7 confirmed high-risk, 4 with limited-risk transparency obligations, and 12 classified as minimal risk.

The 7 high-risk systems required conformity assessments, Annex IV technical documentation, human oversight protocols, and EU database registration — forming the core of the 18-month compliance program.

The remediation roadmap sequenced compliance work by obligation urgency, implementation complexity, and business unit capacity.

The most valuable output was not the classification list. It was the operating clarity it created: which teams needed to act, which systems required immediate attention, and what evidence each compliance program needed to produce.

EU AI Act compliance proved to be an organizational question before a technical one. The systems carrying the most regulatory risk were not the most technically complex — they were the systems deployed closest to high-stakes decisions about people.