The EU AI Act is the first horizontal AI regulation with real teeth — fines up to 7% of global turnover for prohibited-practice violations. Phase-by-phase enforcement is rolling out across 2026 and 2027.
If your AI roadmap was built before mid-2024, it almost certainly does not account for the Act's classification model, conformity-assessment requirements, or the post-market monitoring obligations that come with high-risk systems.
The Four-Tier Risk Model
The Act sorts AI systems into four tiers, each with different obligations:
- Unacceptable risk — banned outright (social scoring, real-time biometric surveillance in public spaces with narrow exceptions, manipulative dark patterns).
- High risk — permitted with conformity assessment, technical documentation, human oversight, post-market monitoring. Includes credit scoring, hiring, critical-infrastructure operations, and most enterprise decision systems.
- Limited risk — transparency obligations only (e.g. chatbots must disclose they are AI).
- Minimal risk — no specific obligations beyond existing law.
Most enterprise AI projects we see — fraud detection, employee assessment, customer-eligibility scoring, supply-chain decision support — land in the high-risk tier.
What "High Risk" Actually Requires
Six concrete obligations that translate directly into engineering and operating-model work:
- Risk management system — documented, ongoing across the AI system's lifecycle.
- Data governance — training, validation, and test datasets must meet quality criteria with documented provenance.
- Technical documentation — proof of conformity, kept current.
- Logging — automatic event logging that enables traceability.
- Human oversight — designed into the system, not bolted on.
- Robustness, accuracy, cybersecurity — measured, documented, monitored.
The Operating-Model Gap
Most enterprises have AI capabilities scattered across product, data-science, IT, risk, and procurement. The Act assumes a single accountable line of sight from system design through deployment to retirement. Closing that gap is more organisational than technical.
The companies moving early are establishing AI governance councils with risk, legal, and engineering co-ownership; mapping their AI inventory against the Act's risk tiers; and integrating conformity-assessment workflows into the same release pipelines that already handle SOC 2 and ISO 27001.
The late movers will spend 2027 retrofitting compliance into already-deployed systems. That is a more expensive — and more visible — path.
Written by
Acmatic SAP Practice
Senior practitioners across SAP, AI compliance, supply chain, and procurement.
