EU AI Act

The EU AI Act, which entered into force in August 2024 with phased application through 2026, establishes a risk-based classification system for AI systems. Prohibited AI practices (manipulation, social scoring, real-time biometric surveillance) are banned outright. High-risk AI systems — used in critical infrastructure, employment, education, law enforcement, and healthcare — face mandatory conformity assessments, technical documentation requirements, human oversight mechanisms, and registration in an EU database. Limited and minimal risk systems face lighter-touch transparency obligations.

High-risk AI system requirements are primarily engineering requirements. Systems must be designed with appropriate risk management systems, trained on data meeting quality criteria, maintain technical documentation sufficient for conformity assessment, be designed to allow effective human oversight, achieve appropriate accuracy and robustness, and implement cybersecurity measures. These are not retroactive compliance checks — they must be built into the AI development lifecycle from the beginning of model development.

The EU AI Act creates new roles with legal significance. Providers (those who develop and place AI systems on the market) bear the heaviest obligations. Deployers (those who use AI systems in professional contexts) have obligations around risk management and employee transparency. Importers and distributors have verification obligations. For organizations using foundation models or third-party AI APIs, the liability and compliance obligations depend heavily on how much customization or fine-tuning they perform — a critical architectural decision with regulatory implications.

We architect EU AI Act compliance into AI system development from the first design decision — conducting risk classification during system design, building required logging and human oversight mechanisms into AI workflows, implementing the technical documentation requirements through automated tooling, and designing data governance processes that satisfy training data quality requirements. Our teams understand how the AI Act interacts with GDPR for AI systems that process personal data.

Compliance-Native Architecture Guide

Design principles and a structured checklist for building software that is compliant by default — not compliant by retrofit. Covers data architecture, access controls, audit trails, and vendor due diligence.