AI compliance is no longer optional. Since February 2025, the EU AI Act has required every company deploying an artificial intelligence system to meet the training obligation (Article 4). The transparency obligations in Article 50 apply from 2 August 2026, and compliance for the Annex III high-risk systems has been postponed to 2 December 2027. Human control, human oversight, risk level: here is what the European Union's AI Act actually requires of your organisation.
What is AI compliance? Definition and what is at stake for businesses
Definition: AI compliance vs AI governance
AI compliance means meeting the regulatory compliance requirements that apply to artificial intelligence systems: the AI Act, the GDPR, ISO standards. Its development rests on trust: stakeholders must be able to verify that your agents follow the rules in force.
AI governance goes further. It also covers the responsible use of agents in production and the continuous assessment of risk.
In practice, the two cannot be separated.
Why AI compliance became critical in 2026
The European AI regulatory framework has been coming into force in stages since 2024. It is no longer a distant prospect. The first legal obligations already apply.
For organisations deploying autonomous AI agents in France and across Europe, the risk is immediate. The "wait until the regulation is fully enforced" approach no longer holds: AI literacy training has been a legal obligation since February 2025. Laws and regulations keep changing: you need the right tools to comply with each new rule.
The AI Act, GDPR and ISO/IEC 42001: which frameworks apply to you?
Three frameworks stack up for any company or client organisation that develops or deploys an artificial intelligence system in Europe. Your compliance needs triple as soon as these texts overlap.
The European regulation EU 2024/1689 (AI Act) applies to the AI system itself: its design, its development, its deployment. The GDPR applies as soon as the system processes personal data: it sits alongside the AI Act without replacing it. ISO/IEC 42001, a voluntary AI management standard, offers a complementary structuring framework to demonstrate a proactive compliance approach, especially towards partners and large prime contractors.
Data protection becomes doubly demanding when the first two frameworks apply to the same system.
AI Act, GDPR and regulatory framework: risk classification and overlapping obligations
Unacceptable-risk AI systems (banned since August 2024)
Some uses of AI have been banned outright since 2 August 2024, with no exceptions. The "unacceptable" risk level covers artificial intelligence systems that undermine fundamental rights or human dignity.
Prohibited practices include:
- Social scoring of citizens by public authorities
- Real-time facial recognition in public spaces (except for strictly regulated exceptions)
- Subliminal manipulation systems or systems that exploit people's vulnerabilities
- Emotion inference systems in the workplace or in educational institutions
High-risk AI systems (stricter obligations, December 2027 deadline)
High risk is the most demanding category in the AI Act. The systems concerned operate in sensitive sectors where a failure can affect fundamental rights or people's safety.
Sectors concerned (non-exhaustive list):
- Recruitment and human resources management
- Access to essential services (credit, insurance, housing)
- Justice and law enforcement
- Critical infrastructure (energy, water, transport)
- Health and medical devices
For these systems, the AI Act requires: complete technical documentation, a continuous risk management system, effective human oversight, automatic logging of interactions and an EU declaration of conformity. The compliance deadline for Annex III high-risk systems has been postponed to 2 December 2027: fines reach €15 million or 3% of global turnover.
Limited-risk AI systems (transparency obligations)
AI systems in direct contact with users (chatbots, conversational agents, generative systems) fall under the limited risk level. The main obligation is transparency: users must know they are interacting with an artificial intelligence system.
AI-generated content (text, images, audio) must also be identified as such. This regulatory framework applies to companies that deploy AI assistants, automated customer support agents or content generators.
Minimal-risk AI systems (self-regulation recommended)
The vast majority of everyday AI tools fall under minimal risk: spam filters, content recommendation systems, AI productivity tools with no direct involvement in sensitive decisions. These systems are not subject to any specific legal obligation under the AI Act, which is good news for organisations at the start of their journey.
Who does the AI Act apply to? Providers, deployers, importers
The AI Act distinguishes four roles, each with its own legal obligations. The provider develops an AI system and places it on the market. The deployer uses an AI system in a professional context: this is the case for most companies that build AI tools into their workflows. Importers and distributors have lighter but real obligations.
In practice: if you deploy Copilot, a LangGraph agent or an AI assistant built by a vendor, you are a deployer, with your own concrete obligations for oversight and documentation, independent of the provider's.
The AI Act timeline in 5 key deadlines
- August 2024: the bans take effect. Unacceptable-risk AI systems (manipulation, social scoring, real-time facial recognition in public spaces) are banned with no exceptions.
- February 2025: the AI literacy obligation (Article 4). Teams that deploy or use artificial intelligence systems must be trained to a level suited to their role.
- 2 August 2026: transparency obligations (Article 50). Systems in direct contact with users and AI-generated content must be identified as such.
- August 2027: EU Regulation 2024/1689 applies to AI systems embedded in regulated products.
- 2 December 2027: compliance for Annex III high-risk systems (postponed deadline). Technical documentation, human control and registration in the EU AI Act database become mandatory. Fines of up to €15 million or 3% of global turnover.
Where the AI Act and GDPR overlap
The AI Act and the GDPR coexist without either one replacing the other. The same AI system can be subject to both at once. The main overlap: any artificial intelligence system that processes personal data triggers both the AI Act obligations (because of what the system is) and the GDPR obligations (because of the data it processes).
In practice, GDPR records of processing must be updated to include the AI systems you deploy. The AI system's lifecycle must be documented on both sides, data protection included.
Protecting personal data in AI systems
When an AI agent processes personal data, the 7 GDPR principles apply in full: lawfulness, minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
The right to object to automated decisions (Article 22 GDPR) applies as soon as an agent makes a decision based solely on automated processing that has a legal or similarly significant effect on the person.
Specific obligations for AI agents that process data
Autonomous AI agents carry the obligations of both regulations. On the AI Act side: effective human oversight, technical documentation, logging of interactions. On the GDPR side: an identified legal basis for each processing operation, respect for users' rights, guaranteed data security.
The practical difficulty: an autonomous AI agent can process personal data in every interaction, in real time, without the user always being aware of it. Bringing AI into existing workflows requires a full review of the records of processing. Human oversight cannot stay theoretical: it has to be built into the system's architecture from the design stage.
How do you assess your AI system's risk level?
The deciding criteria for classifying your system
Classifying an artificial intelligence system against the AI Act risk levels rests on 4 cumulative criteria:
- Sector of use: recruitment, health, justice, critical infrastructure → high risk by default
- Type of decision: automated with no human intervention → higher risk
- Data processed: biometric data, health data, judicial data → high classification
- Target population: minors or vulnerable people → stricter requirements
The combination of these criteria sets the final risk level. The same tool can be minimal risk in one context and high risk in another: the deployment context matters more than the technology.
Mapping your AI systems: method and tools
Mapping your AI systems is the first concrete obligation: you cannot comply with a regulation if you do not know which systems you use. According to the DGE, 70% of SMEs in France still have no AI system inventory to date. This new reality requires every organisation to secure visibility over its agents in production.
The method runs in 3 stages: (1) a full inventory of every AI tool deployed, including unrecorded uses (Copilot, ChatGPT, SaaS tools with built-in AI that IT has not approved), (2) documentation of each AI system (provider, type, data processed, use case), (3) qualification of the risk level against the AI Act criteria.
Assess your AI system's AI Act risk level in 5 questions
To assess your own risk level, go through these five criteria. A single "unacceptable" answer classifies the system as banned; one "high" answer is enough to classify it as high risk; otherwise, the system is limited or minimal risk.
- Question 1: decisions affecting natural persons. If your AI system makes decisions that directly affect access to credit, employment, essential services or justice, you are in high risk. If a human always validates the final decision, you fall into limited risk. If the system only makes recommendations or is used solely for internal productivity, it is minimal risk.
- Question 2: sector of activity. Health, medical devices, critical infrastructure (energy, water, transport) → high risk by default. Standard commercial sector → limited risk. Internal company use only → minimal risk.
- Question 3: biometric, emotional or behavioural recognition. Real-time facial recognition in public spaces → unacceptable risk (banned). Biometrics or emotion analysis in a professional context → high risk. Voice or text analysis for customer service → limited risk. No biometric analysis → minimal risk.
- Question 4: generating content shown to users. A visible chatbot, assistant, speech synthesis or virtual character → limited risk (transparency obligation). Internal processing only, or an automated agent with no user interface → minimal risk.
- Question 5: your role with respect to the system. Provider (you develop and sell the system) or deployer (you integrate and use a third-party system) → stricter obligations, potentially high risk depending on context. Importer or distributor on the EU market → limited risk. Internal end user with no placing on the market → minimal risk.
The special case of autonomous AI agents and GPAI models
Autonomous AI agents, those that carry out sequences of actions without intermediate human validation, along with general-purpose models (GPAI: GPT-4, Gemini, Mistral, Copilot), are subject to specific rules in the AI Act. The intelligence built into these systems can change risk category depending on the context in which it is deployed.
A LangGraph agent deployed in production to automate decisions in a regulated sector (HR, finance, health) can tip into the high-risk category even if the underlying LLM is classified as "general purpose". Generative artificial intelligence is not exempt: generating content that feeds into decisions is still subject to classification. It is the deployment context, not the model, that determines the classification.
Mandatory technical documentation by risk level
The risk level determines exactly which technical documentation is required:
| Risk level | Mandatory documents |
|---|---|
| High risk | Technical documentation (Articles 11-16), instructions for use, event register (logs), EU declaration of conformity, registration in the EU AI Act database |
| Limited risk | Informing users that the system is AI |
| Minimal risk | No specific documentation obligation |
The safeguards for high-risk systems also include an ongoing compliance process: the documents are not static, they must evolve with the system. Any substantial change in the system's development or deployment triggers a reassessment.
The 5 steps to AI Act compliance
Step 1: Raise team awareness and appoint an AI compliance lead
The AI literacy obligation (Article 4 of the AI Act) has been in force since February 2025. Every organisation that uses or deploys an artificial intelligence system must make sure the people involved have the appropriate level of competence.
Three types of profile need training, each at the right level:
- Decision-makers (COO, CIO, DPO): regulatory stakes, risk classifications, governance
- Technical teams: AI Act technical requirements, documentation obligations, security
- Business users: the rights and obligations that come with using AI tools day to day
Appoint an AI compliance lead, not necessarily a lawyer: ideally a cross-functional person who can drive the project across the business, IT and legal. Your teams' trust in using AI tools comes from this structured awareness effort.
Step 2: Map every AI system you have deployed
Before assessing risks, you need to know what you are deploying. Mapping your AI systems means listing every artificial intelligence system used in the organisation, including those that teams adopted without going through the IT department.
Include in the inventory: SaaS tools with built-in AI (Copilot, Salesforce Agentforce, AI recruitment tools), agents built in-house or by vendors, and the GPAI models used in your workflows.
Step 3: Classify risks and identify the applicable obligations
For each AI system on the list, apply the AI Act classification grid: unacceptable, high risk, limited risk, minimal risk. This risk classification work produces a prioritised list of the systems that need immediate action.
Most everyday SaaS AI tools will end up as minimal or limited risk, which is generally good news. The high-risk systems you identify take all the attention and the compliance resources. Every client or internal user needs assurance that the agents affecting them are correctly classified. Classification is also a chance to spot the risk levels that shift with the context of use.
Step 4: Implement safeguards and human oversight
For high-risk systems, the AI Act sets 7 cumulative technical requirements:
- Risk management system: continuous identification, analysis and mitigation
- Governance of training and test data
- Complete, up-to-date technical documentation
- Transparency and provision of information to deployers
- Effective human oversight (not just a stop button)
- Accuracy, robustness and cybersecurity of the system
- Automatic logging of interactions and decisions (traceable human control)
Implementing these safeguards is the operational core of compliance. An external audit by a specialist provider is a useful starting point to size the effort.
Step 5: Build an action plan and stay compliant over time
AI Act compliance is not a one-off project: it is a lifecycle. Obligations evolve with the regulation, with system updates and with newly deployed features. Any substantial change to a high-risk system triggers a reassessment.
The action plan must include: an AI literacy training schedule, procedures for reviewing AI systems at major updates, ongoing governance (an annual review at minimum) and updates to the GDPR records. Implementation is a continuous effort: structure it as a programme, not as a one-off project.
Native governance of AI agents: the technical approach DPOs do not cover
A legal-only approach vs native technical governance: the limits
DPOs and specialist lawyers cover documentary regulatory compliance: records of processing, DPIAs, declarations of conformity, contracts with providers. In France, as everywhere in the European Union, this work is essential. But for organisations deploying autonomous AI agents, the intelligence of your technical teams is just as necessary: documents do not replace real-time oversight.
Technical governance handles what documentation cannot manage in real time: the management system for active agents, the guardrails that block non-compliant behaviour before it happens, the traceability of the decisions each agent makes in production. When it comes to stakeholder trust and the use of agents in production, the intelligence of the platform matters more than that of the document register. This is precisely what purely legal approaches cannot cover.
Auditable traces, kill switch and human oversight: AI Act requirements for agents
The AI Act sets three requirements that a documentation-only approach cannot meet for autonomous agents: (1) effective human oversight, with a real ability to intervene, not just a theoretical one; (2) complete logging of the interactions and decisions of each agent in production; (3) traceability of configuration changes (prompts, tools, scope of action).
For a CISO or a COO, this comes down to three practical questions: "Can I stop this agent in under 5 seconds?" (kill switch), "Can I produce the auditable traces of a disputed decision within 24 hours?" and "Do I have the complete list of every active agent in my organisation?"
3 approaches to AI Act compliance compared
| Criterion | Legal-only approach | Generic GRC tool | Native technical governance |
|---|---|---|---|
| Real-time auditable traces | No | Partial | Native |
| Per-agent kill switch | No | No | Built in |
| Automated human oversight | No | Manual | Automatic |
| Auto-generated technical documentation | Manual | Partial | Automatic |
| Detection of unregistered agents | No | No | Centralised |
| Coverage of agents in production | No | Limited | Yes |
| Agent behaviour anomaly alerts | No | Partial | Real time |
| On-premise / sovereign deployment | N/A | Optional | Native |
| Reversibility from the cloud | N/A | No | Yes |
| Adoption without overhauling your IT systems | Yes | Slow | Yes |
Native technical governance relies on an agent deployment and governance platform: you plug in the agents, built for example on LangGraph or Google ADK, and it provides traces, kill switch and human oversight aligned with the AI Act requirements.
Technical governance in practice
The features to expect from such a platform, directly aligned with the AI Act requirements:
- Agent registry: a central inventory of every deployed agent (meets the mapping obligation)
- Policy engine: rules applied automatically to every agent (human oversight built into the architecture)
- Kill switch: emergency stop in production, with no delay
- Real-time observability: full logs, auditable traces, per-agent metrics
- Multi-tenant RBAC: role-based access control, one workspace per team
Idun Group, an AI consultancy with its own tooling, measures the real use of the AI already deployed in companies with its tool, Idun Cockpit. Our AI support engagement structures this approach around value. A 30-minute discovery call is enough to scope your most urgent priorities.
What Idun Group brings to an AI Act effort
The AI tools that teams adopt without going through the IT department are the first blind spot of any compliance effort. Autonomous AI agents can be running in your organisation without appearing in any register.
A compliance effort starts with knowing which AI tools the company uses, and for what. Idun Group's audit of real AI usage answers that for the tools the company makes available: Idun Cockpit reads their logs, interviews with the teams give the context, and the resulting inventory also serves the compliance effort. Employees' personal accounts on consumer AI stay outside what we measure; we address them through the question of the internal offer. No Idun product is ever recommended in our deliverables. A 30-minute discovery call with Idun Group is the first step.
