EU AI Act

Introduction: The World's First Horizontal AI Law

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, commonly known as the EU AI Act, is the world's first comprehensive, horizontal statute governing the development, placing on the market, putting into service and use of artificial intelligence systems. It was published in the Official Journal of the European Union on 12 July 2024 and entered into force on 1 August 2024, with obligations phasing in over a staggered timeline that runs to 2 August 2027. Unlike sector-specific rules, the AI Act applies across every economic sector and adopts a risk-based, product-safety architecture layered onto a fundamental-rights protection mission.

This CyberSigma Knowledge Center deep-dive is written for two audiences simultaneously: the auditor or conformity assessor who must evaluate an organisation's evidence against the Regulation's articles and annexes, and the implementer, CISO, Data Protection Officer or AI governance lead who must operationalise those obligations. The Act is a legal instrument, not a certifiable management-system standard like ISO/IEC 42001, so 'compliance' here means demonstrable conformity with directly applicable legal duties, backed by technical documentation, testing records and governance evidence that would withstand scrutiny from a national market surveillance authority or a notified body.

What is the EU AI Act

The EU AI Act is a directly applicable Regulation, meaning it takes legal effect in all 27 Member States without transposition into national law (though Member States must designate authorities and set penalty regimes). Its stated objective is to promote the uptake of trustworthy, human-centric AI while ensuring a high level of protection of health, safety and fundamental rights enshrined in the Charter of Fundamental Rights of the European Union, including democracy, the rule of law and environmental protection, against the harmful effects of AI systems.

The Act defines an 'AI system' (Article 3(1)) in alignment with the OECD definition: a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. This inference-based definition is deliberately technology-neutral and excludes simpler traditional software and purely rule-based systems that do not infer.

The Act's central innovation is a four-tier risk pyramid. Systems posing an unacceptable risk are prohibited outright (Article 5). High-risk systems (Articles 6-49 and Annexes I and III) are permitted subject to stringent ex-ante conformity requirements. Systems posing limited or transparency risk (Article 50) carry disclosure duties. Minimal-risk systems are largely unregulated. Layered orthogonally onto this pyramid is a dedicated regime for general-purpose AI (GPAI) models, including those with systemic risk (Chapter V, Articles 51-56).

Who Must Comply: Scope and Applicability

The Act assigns distinct obligations to a chain of operators. Correctly classifying your organisation's role is the first and most consequential scoping decision, because the same entity can hold multiple roles across different systems, and a deployer that substantially modifies a high-risk system or markets it under its own name can be re-classified as a provider (Article 25).

Territorial scope (Article 2)

• Providers placing AI systems on the market or putting them into service in the EU, irrespective of whether they are established in the EU or a third country.
• Deployers of AI systems that have their place of establishment or are located within the EU.
• Providers and deployers established in a third country where the output produced by the AI system is used in the EU, a deliberately broad extraterritorial hook.
• Importers and distributors of AI systems, and EU-based product manufacturers integrating AI.
• Affected persons located in the EU benefit from certain rights (e.g. Article 86 right to explanation of individual decision-making).

Key exclusions from scope

• AI systems developed and used exclusively for military, defence or national security purposes.
• AI systems used by public authorities in third countries or international organisations under international cooperation for law enforcement/judicial cooperation with the EU (subject to safeguards).
• AI systems and models specifically developed and put into service for the sole purpose of scientific research and development.
• Research, testing and development activity prior to placing on the market (except real-world testing).
• AI released under free and open-source licences, unless placed on the market or put into service as high-risk, prohibited, or subject to Article 50 transparency, or is a GPAI model with systemic risk.
• Purely personal, non-professional use by natural persons.

Structure of the EU AI Act

The Regulation comprises 113 Articles organised into 13 Chapters, supported by 180 recitals and 13 Annexes. The annexes are operationally critical: Annex III lists the eight high-risk use-case areas, Annex I lists Union harmonisation legislation, and Annexes IV, VII, VIII and XI define technical documentation, conformity assessment and registration content. The table below maps the principal chapters and the obligations they carry.

Implementation timeline (Article 113)

Master Assessment Checklist

This is the operational heart of the guide. Each subsection below corresponds to a distinct obligation cluster in the Regulation. For each, the assessor verifies the stated control and collects the typical evidence. No obligation area is omitted. Where the Regulation cross-references an annex, the annex is named so that documentation can be traced back to the legal source.

5.1 Prohibited AI practices (Article 5)

5.2 AI literacy (Article 4)

5.3 High-risk classification (Article 6, Annex I and III)

5.4 Risk management system (Article 9)

5.5 Data and data governance (Article 10)

5.6 Technical documentation (Article 11, Annex IV)

5.7 Record-keeping and logging (Article 12)

5.8 Transparency and information to deployers (Article 13)

5.9 Human oversight (Article 14)

5.10 Accuracy, robustness and cybersecurity (Article 15)

5.11 Quality management system (Article 17)

5.12 Conformity assessment, declaration and CE marking (Articles 43, 47, 48)

5.13 Registration in the EU database (Articles 49, 71)

5.14 Provider obligations (Article 16)

5.15 Deployer obligations (Article 26 and Fundamental Rights Impact Assessment Article 27)

5.16 Transparency obligations (Article 50)

5.17 General-purpose AI models (Articles 53-55)

5.18 Post-market monitoring and incident reporting (Articles 72, 73)

Scoping and Materiality / Tiering

Scoping under the AI Act is driven by the risk pyramid rather than by data volume or revenue thresholds. The materiality assessment answers two questions for every AI system in the inventory: what risk tier does it occupy, and what is our operator role for it. These two axes together determine the applicable obligation set.

The systemic-risk threshold for GPAI is presumed where the cumulative amount of compute used for training exceeds 10^25 floating-point operations (FLOP), or where the Commission designates a model based on capability criteria. Materiality for high-risk classification hinges on Annex III use-case fit and the Article 6(3) 'no significant risk' derogation, which cannot be claimed where the system profiles natural persons.

Implementation Approach

A defensible programme is delivered in phases. Each phase produces deliverables that later become audit evidence, so the sequence is designed to build the technical file and governance record incrementally rather than retrofitting documentation.

Phase 1: Discovery and AI inventory

• Activities: enumerate all AI systems and GPAI models across the organisation, including shadow AI and third-party embedded AI; capture purpose, data, operator role and lifecycle stage.
• Activities: establish AI governance sponsorship, an AI governance board and an accountable owner.
• Deliverables: authoritative AI system inventory/register; governance charter; RACI.

Phase 2: Classification and gap assessment

• Activities: classify each system against Article 5, Annex III, Annex I and GPAI criteria; document derogations under Article 6(3); assess operator role per system.
• Activities: perform a requirement-by-requirement gap analysis against Chapter III and Article 50.
• Deliverables: classification determinations; prioritised gap register with remediation owners and dates.

Phase 3: Control build-out

• Activities: implement risk management (Art. 9), data governance (Art. 10), logging (Art. 12), human oversight (Art. 14), accuracy/robustness/security (Art. 15); establish the QMS (Art. 17).
• Activities: conduct FRIAs (Art. 27) and DPIAs; embed transparency features (Art. 50).
• Deliverables: implemented controls; Annex IV technical documentation; QMS manual; FRIA/DPIA records.

Phase 4: Conformity and registration

• Activities: select and complete the conformity assessment route (Annex VI internal control or Annex VII notified body); draw up the EU declaration of conformity; affix CE marking.
• Activities: register high-risk systems and any exemptions in the EU database.
• Deliverables: conformity assessment records; signed declaration; CE marking; EU database registration confirmations.

Phase 5: Operate, monitor and improve

• Activities: run post-market monitoring per plan; operate serious-incident reporting with mapped deadlines; manage substantial-modification change control; deliver ongoing AI literacy.
• Activities: schedule periodic internal audits and management reviews; track KPIs.
• Deliverables: post-market monitoring reports; incident register; change-control records; audit reports and corrective actions.

Maturity / Capability Model

The Act does not define a maturity scale, but CyberSigma applies a five-level capability model to benchmark an organisation's AI governance readiness and to sequence investment. This model complements the ISO/IEC 42001 AI management system approach.

Assessment and Audit Approach

1. Confirm scope: identify all operator roles and territorial triggers, and freeze the AI system inventory to be assessed.
2. Verify prohibited-practice screening: test that no system falls under Article 5 and that screening is documented.
3. Validate classification: independently re-perform Annex III/Annex I classification and challenge any Article 6(3) derogations.
4. Examine technical documentation: trace each Chapter III requirement (Art. 9-15) to Annex IV documentation and test evidence.
5. Assess governance controls: review the QMS (Art. 17), risk management (Art. 9), data governance (Art. 10) and human oversight (Art. 14) in operation, not just on paper.
6. Test conformity artefacts: verify the conformity assessment route, EU declaration of conformity, CE marking and EU database registration.
7. Review deployer duties: confirm FRIAs (Art. 27), instructions-for-use compliance, affected-person notices and operational monitoring.
8. Evaluate transparency: sample chatbot disclosures, synthetic-content labelling and deepfake notices under Article 50.
9. Inspect GPAI obligations where relevant: documentation, copyright policy, training summary and, for systemic risk, evaluations and incident reporting.
10. Check post-market monitoring and incident reporting: test the plan, register and deadline adherence (2/10/15-day rules).
11. Report findings: rate conformity per obligation, log non-conformities with severity, and agree a remediation plan and re-test date.

Evidence Request List

• Governance: AI governance charter, RACI, management review minutes, AI literacy training records.
• Inventory and classification: AI system register, classification determinations, Article 6(3) derogation assessments, operator-role mapping.
• Risk and data: risk management plan and register, DPIAs, FRIAs, data governance policy, dataset datasheets, bias assessments, data lineage.
• Technical file: Annex IV technical documentation, requirement-traceability matrix, accuracy/robustness/security test reports, adversarial red-team results.
• Quality and operations: QMS manual and procedures, logging design and sample logs, human-oversight procedures and UI evidence.
• Conformity: conformity assessment records, notified-body certificates, EU declaration of conformity, CE-marking evidence, EU database registrations.
• Deployer artefacts: instructions for use, deployment SOPs, affected-person notices, operational monitoring logs.
• Transparency: chatbot/synthetic-content/deepfake labelling policies and samples, watermarking/provenance metadata.
• GPAI: model cards, downstream documentation (Annex XI/XII), copyright policy, published training-data summary, systemic-risk evaluations.
• Post-market: monitoring plan and reports, serious-incident register with timestamps, corrective action logs, change-control records.

Roles and Responsibilities

KPIs and Metrics to Track

• Percentage of AI systems inventoried and classified against the risk pyramid.
• Number of high-risk systems with a complete Annex IV technical file.
• Percentage of high-risk systems with valid conformity assessment, EU declaration and CE marking.
• Percentage of high-risk systems registered in the EU database before deployment.
• Number and severity of open non-conformities against Chapter III requirements.
• FRIA and DPIA completion rate for in-scope deployments.
• AI literacy training completion rate (Article 4).
• Mean time to detect and report serious incidents against the 2/10/15-day deadlines.
• Bias and accuracy metrics per high-risk model versus declared thresholds.
• Adversarial/robustness test coverage and pass rate.
• Shadow AI discovery rate and time to bring into governance.
• Percentage of GPAI usage with copyright policy and training-data summary evidence.

Readiness Checklist

• Complete AI system and GPAI inventory including third-party and embedded AI is maintained.
• Every system screened against Article 5 prohibited practices with documented outcomes.
• High-risk classification determinations and Article 6(3) derogations documented and registered.
• Risk management system (Art. 9) operating iteratively across the lifecycle.
• Data governance and bias controls (Art. 10) implemented with dataset documentation.
• Annex IV technical documentation drawn up and version-controlled.
• Automatic logging (Art. 12) enabled with retention aligned to intended purpose.
• Instructions for use and transparency to deployers (Art. 13) issued.
• Human oversight measures (Art. 14) designed, including stop controls and anti-automation-bias.
• Accuracy, robustness and cybersecurity (Art. 15) tested with adversarial evaluation.
• Quality management system (Art. 17) documented and operating.
• Conformity assessment completed, EU declaration signed, CE marking affixed.
• High-risk systems and exemptions registered in the EU database.
• FRIAs (Art. 27) completed for public and applicable private deployers.
• Article 50 transparency, watermarking and deepfake labelling implemented.
• GPAI documentation, copyright policy and training-data summary in place where relevant.
• Post-market monitoring plan and serious-incident reporting with mapped deadlines operating.
• AI literacy programme (Art. 4) delivered and tracked.

Common Gaps and Findings

• No authoritative AI inventory, leaving shadow AI and embedded third-party AI unclassified.
• Over-reliance on the Article 6(3) derogation without a documented justification, or claiming it despite profiling.
• Risk management treated as a one-off exercise rather than an iterative lifecycle process (Art. 9).
• Datasets used without provenance, representativeness or bias assessment evidence (Art. 10).
• Human oversight designed on paper but no effective stop/override control in the interface (Art. 14).
• Accuracy metrics undeclared and no adversarial/robustness testing against poisoning or evasion (Art. 15).
• Technical documentation incomplete against Annex IV headings and not version-controlled.
• Deployers not performing FRIAs or failing to notify affected persons of automated decisions.
• AI-generated content and chatbots not disclosed or watermarked under Article 50.
• GPAI integrated downstream without copyright policy or published training-data summary.
• No post-market monitoring plan and incident reporting not aligned to the 2/10/15-day deadlines.
• AI literacy obligation (Art. 4) unaddressed for staff operating AI systems.
• Confusing operator roles, leading to missed provider obligations after substantial modification (Art. 25).

EU AI Act Mapped to Other Frameworks

How CyberSigma Helps

Frequently asked questions

Need help with EU AI Act?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.