No confusion: This is what you should do before August 2 to comply with Europe's AI regulations

## How classification works in practice

Once you have an inventory, each system needs a risk classification. The AI Act creates four tiers: unacceptable risk (prohibited), high risk (heavily regulated), limited risk (transparency obligations only), and minimal risk (no specific obligations).

The high-risk classification is where most of the compliance weight sits. Article 6 and Annex III define high-risk by sector and function. AI systems used in employment and worker management, including CV screening, performance evaluation, and task allocation, are high-risk. Systems used in education to assess students or determine access to educational institutions are high-risk. AI systems used in credit scoring, insurance pricing, and financial services risk assessment are high-risk. Systems used in healthcare for clinical decision support are high-risk. Biometric categorisation and emotion recognition systems used in the workplace are high-risk.

The sector obligations matter here. Because if, for example, your organisation uses an AI tool for recruitment shortlisting, it is high-risk under the Act regardless of how the vendor describes it. The same logic applies to a bank running automated credit decisions or a hospital using an AI diagnostic support tool. Classification follows function and sector, not vendor labelling.

For limited-risk systems, the main requirement is transparency. Chatbots and AI-generated content must be disclosed as such. The EU AI Act's transparency rules require that users are informed they are interacting with an AI system, and that AI-generated content is labelled accordingly. For generative AI providers specifically, the Act requires watermarking of synthetic media and disclosure of the content's AI origin.

## Governance before documentation

Most compliance programs reach for documentation templates first. The more durable move is to build governance infrastructure: the people, process, and accountability structures that make documentation a byproduct of how decisions are made, rather than a retrospective filing exercise.

A governance framework for AI Act compliance requires at minimum a designated accountability owner, a process for reviewing new AI deployments against the classification criteria, a vendor due diligence protocol, and a mechanism for reporting serious incidents. Under the Act, providers and deployers of high-risk AI systems must report serious incidents to national market surveillance authorities, with timeframes that require pre-existing processes rather than ad hoc responses.

Vendor due diligence deserves particular attention. Organisations deploying third-party AI tools bear deployer obligations under the Act even when they did not build the underlying model. This means reviewing vendor contracts to confirm that technical documentation, conformity assessments, and CE marking requirements are in place for high-risk systems. If a vendor cannot produce conformity documentation for a high-risk system, the deploying organisation carries compliance exposure it cannot offload.

## The high-risk requirements: what comes after August 2025

The full set of high-risk obligations, including technical documentation requirements, conformity assessment, CE marking, and registration in the EU database, applies to new high-risk AI systems from August 2026, with a longer transition for certain existing systems. This does not mean high-risk compliance preparation can wait until 2026. Technical documentation for high-risk systems requires a complex procedure involving a risk management system, data governance records, detailed system specifications, human oversight mechanisms, accuracy and robustness testing results, and post-market monitoring plans. Building this from scratch in the months before a deadline is a significantly hard, time-consuming problem that requires a solution now, and building it incrementally as part of a long-term governance program.

The AI Act's human oversight requirement for high-risk systems is specific. Article 14 requires that high-risk AI systems be designed to allow human oversight by natural persons during deployment, with the capacity to intervene, override, or stop the system. Organisations need to document not just that oversight is possible but that it is operationally embedded.

The conformity assessment pathway depends on the system type. For most high-risk AI systems, providers can conduct internal conformity assessments. For biometric identification systems and certain other categories, third-party notified body assessment is required. The CE marking requirement follows successful conformity assessment and must appear on the system before it enters the EU market.

## Data protection and the AI Act

The GDPR is business as usual while your organisation works through AI Act compliance. Where AI systems process personal data, which is most high-risk deployments, a Data Protection Impact Assessment is required under GDPR alongside the technical documentation required by the Act. The EDPB and EDPS have both issued guidance noting that AI Act compliance does not replace GDPR compliance, and that the two frameworks interact directly on questions of purpose limitation, data minimisation, and the use of personal data in training datasets.

Building AI documentation in a way that satisfies both frameworks simultaneously, rather than sequentially, is the more efficient path. The risk management documentation required by the AI Act and the DPIA required by GDPR cover substantial overlapping ground on data processing risks.

## What this means for SMEs in particular

The Act includes specific provisions for small and medium enterprises, including reduced fees for conformity assessments and access to regulatory sandboxes at the national level. The Stanford AI Index 2025 documents that AI adoption among smaller firms has accelerated sharply, which means the compliance surface for SMEs is wider than it might have been had the Act been adopted three years earlier. Regulatory sandboxes allow SMEs to develop and test high-risk AI systems under national authority supervision before full market deployment, with the compliance learning that entails.

## What to do

The sequence for an organisation starting now: build the inventory, classify each system against the Act's risk tiers, discontinue any prohibited practices, deliver AI literacy training with documented records, establish governance accountability, begin vendor due diligence on third-party tools, and identify which systems will require high-risk documentation before their applicable deadline. This is not a one-time exercise. The Act builds in post-market monitoring obligations and incident reporting requirements that make compliance an ongoing operational function rather than a project with a close date.

Companies that began this sequence in early 2025 likely have documentation, governance, and vendor alignment in place when enforcement begins in earnest. Companies that begin in the weeks before a deadline will still have to file in time, and think about a long-term running system.