The EU AI Act Is Here. Is Your Business Ready?

If you build, deploy, or use AI systems in your business, new rules now apply to you. The EU AI Act became law in August 2024 and is now rolling into force in stages. For many organisations, the first meaningful deadlines have already passed or are approaching fast.

This isn’t something to leave to the legal team and come back to later. It touches product decisions, procurement, data practices, and how you govern AI across your organisation. The sooner you understand what it means in practice, the better placed you’ll be.

What the Act Actually Does

The EU AI Act takes a risk-based approach. It doesn’t regulate all AI equally. Instead, it categorises AI systems by the risk they pose, and applies stricter rules to higher-risk uses.

At the top are systems that pose unacceptable risk, things like real-time biometric surveillance or social scoring. These are banned outright. Below that, high-risk AI covers areas such as credit scoring, recruitment, medical devices, critical infrastructure, and certain uses in education and law enforcement. These systems face the most significant compliance obligations: conformity assessments, human oversight requirements, transparency measures, and robust data governance.

Most business AI, chatbots, recommendation engines, analytics tools, falls into lower-risk categories with lighter obligations. But those obligations still exist, and the high-risk definitions are broader than many organisations expect.

The Timeline Is Already Moving

February 2025 saw the first provisions take effect, covering prohibited AI practices. August 2025 brings obligations for general-purpose AI models and governance rules for providers. By August 2026, the full framework for high-risk AI systems applies.

That might sound like plenty of time. In our experience, it isn’t. Getting your AI inventory documented, assessing risk classifications, updating procurement processes, and establishing the right oversight mechanisms all take longer than anticipated, especially in larger organisations where AI is embedded across multiple teams and systems.

Where Organisations Are Getting Caught Out

We’ve been working through this with clients, and a few challenges come up repeatedly.

The first is knowing what you actually have. Many organisations have more AI in production than they realise, spread across departments, vendors, and homegrown tools. You can’t classify risk or assign oversight to systems you haven’t catalogued.

The second is third-party risk. If you’re using an AI product from a vendor, compliance responsibilities are shared, but they don’t disappear on your side. You need to understand what your suppliers are doing and whether their systems meet the requirements for your use case.

The third is documentation. High-risk AI systems require significant technical documentation, evidence of testing, and records of human oversight. For teams that have been moving fast, this kind of rigour can feel unfamiliar. Building it in retrospectively is much harder than designing for it from the start.

A Practical Starting Point

You don’t need to solve everything at once. A sensible starting point is to map your current AI systems, identify which fall into high-risk categories, and understand what obligations apply. From there, you can prioritise the gaps that need addressing most urgently.

This is also a good moment to look at your data governance practices. The EU AI Act places real weight on data quality, bias management, and traceability. Organisations that already have strong data foundations will find compliance considerably more straightforward.

Responsible AI as a Business Advantage

It’s easy to see regulation as a burden. But businesses that approach the EU AI Act thoughtfully are also building something valuable: demonstrable trust. For enterprise clients, regulated industries, and public sector customers, being able to show that your AI is well-governed, transparent, and auditable is becoming a real differentiator.

We’ve helped clients navigate complex data and AI challenges for years, and the organisations that use moments like this to strengthen their foundations tend to come out ahead.

If you’re working through what the EU AI Act means for your business, we’d love to help you think it through.