AI Governance Framework: EU AI Act Compliance
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
The EU AI Act became law in August 2024 and represents the world's first comprehensive legal framework for artificial intelligence. Prohibited practice bans have applied since February 2025, transparency obligations since 2 August 2026, and, after the Digital Omnibus (Regulation (EU) 2026/1744), high-risk requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products. When the Act was proposed, the European Commission estimated that roughly 5-15% of AI applications would fall into the high-risk category, requiring conformity assessments, technical documentation, and ongoing post-market surveillance. For enterprises with multiple AI systems deployed or in development, building a systematic governance framework is not optional. It's the mechanism that makes compliance operationally manageable.
Key Takeaways
- EU AI Act prohibited practices have applied since February 2025 and Article 50 transparency duties since 2 August 2026; high-risk requirements apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under the Digital Omnibus.
- A minority of enterprise AI systems, estimated by the Commission at 5-15%, are expected to fall into the high-risk category requiring full conformity assessment, technical documentation, and post-market surveillance.
- General Purpose AI (GPAI) models with systemic risk, presumed when trained on more than 10^25 FLOPs, face additional evaluation, incident-reporting and cybersecurity requirements under the Act.
- An enterprise AI governance framework requires four layers: policy, roles and accountability, operational controls, and audit and reporting mechanisms.
- The governance framework must be operational before the first high-risk AI deployment, not built in response to a compliance incident.
What Is the EU AI Act and Who Does It Apply To?
The EU AI Act is a product safety and fundamental rights regulation that applies to any AI system placed on the EU market or used within the EU, regardless of where the provider is established. It follows GDPR's effects-based jurisdiction approach: a US or UK company selling or deploying AI systems whose output is used in the EU must comply. The Act imposes different obligations on providers (organizations that develop and place AI systems on the market) and deployers (organizations that use AI systems in their operations), though both carry significant responsibilities. Our EU AI Act guide covers scope and enforcement in more detail.
The Act's definition of an AI system in Article 3(1) is broad: "a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments." This definition captures modern machine learning models and many other inference-based systems, while the Commission's February 2025 guidelines confirm that simple software executing only rules defined by people falls outside it.
If you want a quick view of where your organization stands against these requirements, Opsio's free AI Act gap assessment scores your maturity across ten governance areas and drafts your first governance documents from your answers.
Non-compliance penalties under the EU AI Act scale by infringement type. Prohibited practice violations carry fines up to 35 million euros or 7% of global annual turnover. High-risk requirement violations carry fines up to 15 million euros or 3% of global turnover. Providing incorrect information to authorities carries fines up to 7.5 million euros or 1% of global turnover. For SMEs and start-ups, the lower of the two amounts applies. These penalty levels are comparable to GDPR enforcement and will be administered by national market surveillance authorities coordinated at EU level through the AI Office; see EU AI Act penalties and fines for the detail.
How Does EU AI Act Risk Classification Work?
The EU AI Act uses a four-tier risk pyramid to classify AI systems, with obligations proportionate to risk level (our explainer on EU AI Act risk classification walks through each tier). The classification framework is not self-executing. Organizations must actively assess where each of their AI systems falls within the framework and document that assessment, and many have not yet done so for their full AI portfolio despite the prohibited practice deadline already passing.
Unacceptable Risk: Prohibited AI Practices
The Act prohibits eight categories of AI practice outright, with no compliance pathway. These include: subliminal manipulation that bypasses conscious decision-making; exploitation of vulnerabilities of specific groups (age, disability, social or economic situation); real-time remote biometric identification in public spaces by law enforcement (except specific exemptions); biometric categorization inferring sensitive attributes like race, political opinions, or sexual orientation; social scoring by public or private actors; predictive policing based solely on profiling; untargeted scraping of facial images for facial recognition databases; and AI-inferred emotion recognition in workplaces or educational institutions. The Digital Omnibus adds bans on AI that generates non-consensual intimate imagery or child sexual abuse material, applying from 2 December 2026.
The prohibition on emotion recognition AI in workplaces is particularly significant for enterprise deployers. Many HR technology platforms incorporate sentiment analysis or engagement monitoring tools that could fall within this prohibition. Legal review of existing HR AI tools against this prohibition should already be complete, as the ban has applied since February 2025.
High-Risk AI: The Compliance-Intensive Category
High-risk AI systems are defined in Annex I (AI used as safety components in regulated products) and Annex III (standalone high-risk AI applications). Annex III covers eight areas: biometric identification and categorization; critical infrastructure management; education and vocational training; employment and worker management; access to essential private or public services; law enforcement; migration, asylum, and border control; and administration of justice. Any AI system falling within these categories requires full high-risk compliance procedures before deployment, from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.
High-risk requirements are substantial. They include: a risk management system maintained throughout the lifecycle (an AI risk assessment template is a practical starting point); data governance procedures ensuring training data is relevant, representative, and examined for possible biases; technical documentation completed before market placement; automatic logging of operations (audit trail); transparency to deployers sufficient to enable correct use; human oversight measures enabling intervention or override; and accuracy, robustness, and cybersecurity appropriate to the use case.
Limited and Minimal Risk: Lighter-Touch Requirements
Limited-risk AI systems (primarily chatbots and AI-generated content) face transparency obligations only: users must be informed they are interacting with an AI system, and synthetic content must be marked. These Article 50 duties apply from 2 August 2026 and were not delayed by the Digital Omnibus. Minimal-risk AI systems (spam filters, AI in video games, recommendation systems without significant effects on individuals) have no mandatory requirements under the Act, though providers are encouraged to adopt voluntary codes of conduct.
General Purpose AI Models: Special Rules for Foundation Models
The EU AI Act introduced a specific category for General Purpose AI (GPAI) models, defined as AI models trained on broad data at large scale that can serve multiple purposes. Since 2 August 2025, all GPAI providers must maintain technical documentation, put in place a copyright compliance policy, and publish a summary of training content; the Commission published a template for that summary and a voluntary GPAI Code of Practice in July 2025. GPAI models with systemic risk, presumed when training compute exceeds 10^25 FLOPs, face additional requirements including model evaluation with adversarial testing, serious incident reporting to the AI Office, and cybersecurity protections.
Organizations frequently misclassify their AI systems as minimal risk because they see no direct user interaction. Risk classification under the EU AI Act is about potential impact on people, not the sophistication of the user interface. An automated credit scoring model that runs invisibly in the background but determines loan eligibility is a high-risk system regardless of the fact that users never see the AI output directly.
Need expert help with ai governance framework: eu ai act compliance?
Our cloud architects can help you with ai governance framework: eu ai act compliance — from strategy to implementation. Book a free 30-minute advisory call with no obligation.
What Does Conformity Assessment Require?
Conformity assessment is the process by which providers demonstrate that a high-risk AI system meets the Act's requirements before placing it on the market. For most Annex III systems, assessment based on internal control by the provider is permitted, leading to an EU Declaration of Conformity. Third-party Notified Body involvement is required for AI systems that are safety components in regulated products already subject to third-party conformity assessment under sectoral legislation (medical devices, machinery, vehicles), and for certain biometric systems where harmonized standards have not been fully applied.
Self-assessment conformity assessment involves working through a checklist of technical requirements and documenting evidence of compliance. This is not a paper exercise. Each requirement demands engineering work: the risk management system must be implemented and maintained, not just described; the automatic logging system must be deployed and producing audit trails; the human oversight mechanisms must be built into the user interface and tested. Creating documentation to describe these systems without actually building them constitutes non-compliance.
Post-conformity assessment obligations continue throughout the system's lifecycle. Providers must report serious incidents involving high-risk AI to national market surveillance authorities. They must update their conformity assessment when making substantial modifications to the system. They must maintain a quality management system. And providers of Annex III systems must register them in the EU database set up by the European Commission before placing them on the market. Most of the database is publicly accessible, making non-registration visible to regulators and competitors alike.
Documentation Requirements for High-Risk AI
Technical documentation for high-risk AI is the most time-intensive compliance element. Expect a substantial, structured file per system. This is not unusual in regulated industries: medical device technical files and financial model documentation are similarly extensive. The challenge is creating processes to produce and maintain this documentation efficiently across an AI portfolio. Under the Digital Omnibus, SMEs and small mid-caps (fewer than 750 staff) can use simplified documentation.
Required documentation categories include: a general description of the AI system and its intended purpose; a description of the elements of the AI system and the process for its development; information on monitoring, functioning, and control of the AI system; a description of the risk management system; data governance and data management documentation; post-market monitoring information; and where applicable, standards applied and technical solutions to comply with those standards. The documentation must be kept up to date and retained for 10 years after the system is placed on the market or put into service.
In EU AI Act compliance work, organizations with existing ISO 9001 quality management systems and ISO/IEC 27001 information security management systems have a clear head start over organizations without these foundations. The EU AI Act's quality management system requirements align closely with ISO 9001 process documentation requirements, and ISO/IEC 42001, the AI management system standard, covers much of the governance layer. Our comparison of ISO 42001 vs the EU AI Act shows where they overlap and where they do not. Leveraging existing management system infrastructure significantly reduces compliance effort.
Harmonized standards under the AI Act are being developed by CEN-CENELEC. Organizations should monitor the AI standards development program and plan to adopt harmonized standards once published, as compliance with harmonized standards creates a presumption of conformity that simplifies assessment and audit.
How Do You Build an Enterprise AI Governance Framework?
An enterprise AI governance framework is the organizational infrastructure that makes AI Act compliance operationally sustainable rather than a one-time project per system. Without a framework, each AI system requires its own ad hoc compliance effort, duplicating work and creating inconsistent documentation quality. With a framework, compliance requirements become embedded in standard development and deployment workflows, dramatically reducing marginal compliance cost per system.
Governance Roles and Accountability Structures
Effective AI governance requires three distinct role types. Strategic oversight: typically an AI Ethics Board or AI Governance Committee composed of senior leaders from legal, technology, HR, risk, and business units. This body sets AI policy, approves high-risk AI deployments, and reviews AI incidents. Operational management: an AI Program Office or equivalent function that maintains the AI portfolio inventory, coordinates compliance activities, and manages the AI documentation library. Technical execution: AI risk management embedded within development teams through roles like AI Safety Engineers or ML Governance Leads who integrate compliance requirements into delivery workflows.
The AI Policy Layer
The AI policy layer defines the organizational rules within which AI is developed and deployed. It must cover: acceptable use policy (what AI can be used for, what's prohibited; see our AI acceptable use policy template); data governance policy for AI (sourcing, quality, retention, deletion); model development standards (documentation requirements, testing standards, approval gates); third-party AI procurement policy (vendor obligations, contract requirements); and incident management policy (classification, reporting, response). Policies should be concise, actionable, and directly reference EU AI Act requirements where applicable to create a clear traceability chain for auditors.
Operational Controls and Model Risk Management
Operational controls are the concrete checks and approvals that ensure policies are followed in practice. A model risk management framework covers the complete model lifecycle: development controls (code review standards, data quality checks), validation controls (performance testing, bias auditing, security review), deployment controls (staging environment sign-off, monitoring setup verification, rollback procedure test), and ongoing controls (drift monitoring thresholds, scheduled revalidation, incident triggers). Each control has an owner, an execution record, and a cadence. Bias auditing in particular is covered in our guide to responsible AI in the enterprise.
The most effective governance frameworks we've seen are not the most comprehensive ones. They're the most operational ones: governance where every requirement maps to a specific step in the development or deployment workflow with a named owner and a traceable record. Governance that lives in a separate document nobody reads during project execution is decorative. Governance embedded in JIRA ticket types and deployment pipelines is real.
Frequently Asked Questions
Does the EU AI Act apply to AI systems already on the market before the high-risk rules apply?
Only in limited cases. High-risk systems placed on the market before their applicable date (2 December 2027 for Annex III, 2 August 2028 for Annex I) fall under the high-risk rules only if they are significantly changed in design afterwards. High-risk systems used by public authorities must comply by 2 August 2030. Prohibitions and Article 50 duties apply regardless. Providers should still use the remaining time to assess their portfolio, because significant updates are common.
How are high-risk AI systems registered in the EU database?
Providers of high-risk AI systems listed in Annex III must register themselves and the system in the EU database set up by the European Commission before placing it on the market. Registration covers the system description, intended purpose, provider identity, contact details, and conformity status. Deployers that are public authorities or bodies acting on their behalf must also register their use. Systems for law enforcement, migration and border control go in a secure non-public section, and critical-infrastructure systems are registered nationally.
What is the difference between an AI provider and an AI deployer under the Act?
A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority for professional purposes. Providers carry conformity assessment and technical documentation; deployers must use systems as instructed, ensure human oversight, check input data relevance, monitor operation and keep logs. See provider vs deployer obligations.
Can an organization use GDPR compliance infrastructure for EU AI Act compliance?
Partially. Data Protection Impact Assessments, records of processing activities and data governance documentation required under GDPR give useful foundations. However, the Act's technical documentation, risk management system, post-market monitoring, and conformity assessment requirements go significantly beyond GDPR. An EU AI Act gap analysis comparing your GDPR program outputs against the Article 9-17 requirements is the right starting point.
Conclusion
The EU AI Act creates a significant new compliance obligation for any organization developing or deploying AI in the EU. The risk classification framework determines which systems require the most intensive compliance work. The conformity assessment process is substantial but manageable for organizations with good engineering documentation practices. And the governance framework is the organizational infrastructure that makes the whole system sustainable. The Digital Omnibus has given high-risk providers until December 2027 or August 2028, but transparency duties already apply, and organizations that start now have time to build systematically rather than under compressed timelines and elevated regulatory scrutiny.
Get Your AI Governance Documents Written
You can build every layer of this framework from scratch, or start from a draft. Opsio's free EU AI Act readiness assessment takes about 40 minutes of questions and produces four editable Word documents from your answers: an AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template, plus a maturity score across ten governance areas. No card, no obligation. If you want help turning the drafts into a working program, talk to our AI governance consulting team.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
Related reading: What Is the EU AI Act.
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.