[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row admin_label=”row” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text admin_label=”Text” _builder_version=”4.27.8″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″]<\/p>\n
The EU AI Act ( <\/a>Regulation (EU) 2024\/1689) is the world\u2019s first legal framework for AI. It took effect on August 1, 2024, and its timeline was revised to the first half of 2026 for high-risk systems. This guide provides an overview of the actual obligations facing companies and is part of our broader overview of <\/span>AI security in the enterprise<\/a>, intended for CISOs and CIOs.<\/span> <\/p>\n The regulation classifies each AI system according to its risk level:<\/p>\n An AI system is classified as high-risk if it significantly influences decisions that affect people in any of the following areas:<\/p>\n The screening mechanism under Article 6(3) allows for the exclusion of certain systems if they do not pose a significant risk to fundamental rights, requiring a case-by-case analysis.<\/p>\n The EU AI Act clearly distinguishes between the roles and their associated obligations:<\/p>\n The implementer (e.g., a purchaser of HR SaaS or scoring software) must follow the vendor\u2019s instructions, ensure effective human oversight, monitor performance, and maintain logs (Article 26). A fundamental rights impact assessment is required for public bodies (Article 27). <\/p>\n Caution:<\/strong> Substantially modifying a system or adding your own branding to it transfers all supplier obligations to the deployer.<\/p>\n The Digital Omnibus (adopted on June 29, 2026) revised the deadlines for Annex III. Specifically, for a company:<\/p>\n This 16-month extension allows companies to plan ahead for the finalization of the technical standards.<\/p>\n The system offines<\/a> remains particularly effective as a deterrent:<\/p>\n The amount of the penalties depends on the severity, duration, and impact of the violation, as well as the size of the company and its level of cooperation.<\/p>\n For small and medium-sized enterprises (SMEs) and startups, penalties are capped at the lowest amount to ensure they remain proportionate to their economic capacity. The Digital Omnibus extends these protections and access to regulatory sandboxes (supervised testing environments) to companies with fewer than 750 employees. <\/p>\n The AI Act applies alongside the GDPR<\/a> whenever personal data is processed (HR, scoring). The CNIL recommends combining the fundamental rights impact assessment with the Data Protection Impact Assessment (GDPR) to reduce the administrative burden. Furthermore, relying on the ISO 42001<\/a> standard (AI management) and the NIS2 Directive (cybersecurity) makes it possible to centralizeaudit <\/span> evidenceand avoid duplication of <\/span>governance<\/a>processes <\/span>.<\/span> <\/p>\n [\/et_pb_text][et_pb_accordion _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_accordion_item title=”What is the EU AI Act?” open=”on” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n The<\/span>EU AI Act<\/strong> (the European Regulation on Artificial Intelligence) is the EU\u2019s first comprehensive legal framework governing the placing on the market, deployment, and use of AI systems based on their level of risk, with the aim of protecting fundamental rights, health, and safety, while promoting innovation.<\/span><\/p>\n [\/et_pb_accordion_item][et_pb_accordion_item title=”Who is subject to the IA Act?” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” open=”off”]<\/p>\n Any organization that provides, distributes, or deploys AI systems or models within the European Union. This applies to private companies, public bodies, subcontractors, and SaaS providers, whether they are based in the EU or abroad, as long as the system affects European users. <\/p>\n [\/et_pb_accordion_item][et_pb_accordion_item title=”What is the scope of the AI Act?” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” open=”off”]The EU AI Act regulates all AI systems marketed or used in the EU, based on a risk-based approach: National authorities<\/strong>: Each Member State designates market surveillance authorities and other competent authorities to monitor the compliance of AI systems within its territory.<\/p>\n<\/li>\n European Commission \/ AI Office<\/strong>: specifically oversees general-purpose AI (GPAI) models, coordinates their implementation at the European level, and may impose sanctions in this area.<\/span>What are the four risk levels under the EU AI Act?<\/strong><\/h2>\n
\n
Appendix III: What are the 8 areas considered high-risk?<\/strong><\/h2>\n
\n
AI Provider or Deployer: What Are Your Legal Obligations?<\/strong><\/h2>\n
If you are a supplier (designer of a high-risk system)<\/strong><\/h3>\n
\n
If you are a deployer (a company using the system)<\/strong><\/h3>\n
What is the timeline for implementing the EU AI Act?<\/span><\/h2>\n
\n
Penalties and Fines: What Are the Consequences for Companies in the Event of Noncompliance?<\/strong><\/h2>\n
\n
Regulatory Synergies: How Can the AI Act Be Aligned with the GDPR, ISO 42001, and NIS2?<\/strong><\/h2>\n
Checklist: 5 Priority Actions to Take Right Now<\/strong><\/h2>\n
\n
FAQ on European Regulations Governing Artificial Intelligence<\/strong><\/h2>\n
\n\u2022 Prohibited: Practices posing an unacceptable risk (e.g., social scoring, real-time biometrics).
\n\u2022 High risk: Sensitive uses (HR, healthcare, infrastructure, justice) subject to strict governance and transparency requirements.
\n\u2022 Limited risk: Generative models and chatbots subject to information disclosure requirements.
\n\u2022 Minimal risk: Common uses without specific regulatory restrictions.[\/et_pb_accordion_item][et_pb_accordion_item title=”Who is responsible for enforcing the regulations?” _builder_version=”4.27.8″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” open=”off”]<\/p>\n\n