Non-compliance with the EU AI Act carries fines of up to 7% of your organization's global annual turnover. But the fine is rarely the first consequence. Before it gets there, non-compliant organizations face audits, forced system shutdowns, and reputational damage that is difficult to recover from.
The good news is that compliance is not a single obligation — it is a structured process, and one that is manageable if approached correctly. This article breaks down exactly what that process looks like, depending on your role and the AI systems you use.
What is your risk level?
Compliance under the EU AI Act is not one-size-fits-all. What you need to do depends on two things: the risk tier of your AI systems, and your role in the supply chain.
Your role
If you build AI systems and bring them to market, you are a provider. If you use AI systems built by someone else in your operations, you are a deployer. If you sell or distribute AI systems built by a third party, you are a distributor. These are not mutually exclusive — many organizations are both a provider and a deployer simultaneously.
Role matters because providers carry heavier obligations than deployers. If you built the system, you are responsible for its design, documentation, and conformity. If you deploy it, you are responsible for how it is used and whether adequate oversight is in place.
Your risk tier
Does your AI do any of the following:
- Score or rank people based on behavior or social characteristics?
- Manipulate people's decisions without their awareness?
- Identify individuals in real-time in public spaces?
If yes → these systems are banned outright under the Act and must be discontinued.
Does your AI influence consequential decisions about people in hiring, credit, healthcare, education, law enforcement, or border control?
If yes → you are operating a high-risk system.
Does your AI interact with people directly or generate content?
If yes → you are in the limited risk tier.
If none of the above apply → you are in the minimal risk tier.
Your compliance checklist
Once you have identified your risk tier and role, your obligations become clear. Here is what each tier requires.
If you are in the unacceptable risk tier
Discontinue the system immediately. These practices are banned and cannot be made compliant through modification.
If you are in the high-risk tier
As a provider:
- Conduct a conformity assessment before deployment
- Establish a risk management system
- Ensure data quality and governance
- Produce and maintain technical documentation
- Enable human oversight mechanisms
- Register your system in the EU database
As a deployer:
- Implement human oversight procedures
- Monitor system performance and log activity
- Ensure staff are trained and AI-literate
- Report serious incidents to authorities
If you are in the limited risk tier
- Inform users they are interacting with AI
- Label AI-generated content as such
If you are in the minimal risk tier
- Ensure basic AI literacy among staff who work with the system
For a detailed breakdown of how to approach each requirement, see our EU AI Act Compliance Guidelines.
How it looks in practice
To see how this looks in practice, let's use the example of an HR technology company based in the EU. It builds AI tools for recruitment, uses third-party AI in its operations, and relies on everyday AI for internal productivity.
What is their risk level?
- They built a CV screening tool that automatically ranks and shortlists job candidates. This influences whether a person will progress in a hiring process → they are providers of a high-risk AI system.
- They use a third-party AI chatbot to communicate with candidates during the hiring process. The chatbot interacts with people directly but does not make decisions about them → they are deployers of a limited-risk AI system.
- They use an AI grammar checker internally. It assists with writing but influences no decisions about people → they are deployers of a minimal-risk AI system.
Their compliance checklist
- As a provider of a high-risk system, the company must conduct a conformity assessment before deploying the CV screening tool, establish a risk management system, ensure the training data is representative and free from bias, produce and maintain technical documentation, enable human oversight so that no candidate can be rejected by the tool alone, and register the system in the EU database.
- As a deployer of a limited-risk system, the company must inform candidates they are interacting with an AI chatbot.
- As a deployer of a minimal-risk system, the company must ensure staff using the grammar checker have basic AI literacy.
By evaluating their risk levels, the company has a clear plan for what needs to be done to ensure compliant AI use. The EU AI Act is a major regulatory shift, and the organizations that assess their position early will have the upper hand. The first step is knowing where you stand.
.png)