How do you comply with the AI Act?

Compliance follows 5 key steps: build AI literacy across your teams, map every artificial intelligence system you have deployed (your AI system inventory), classify risks under the AI Act, implement technical measures for high-risk systems and set up an action plan for ongoing governance. A governance tool can automate much of this monitoring. Prioritise the Annex III high-risk systems for 2 December 2027.

What are the AI compliance obligations for companies?

Since February 2025, under European law, AI literacy (Article 4) has been mandatory for every organisation in France and across Europe that uses an AI system. For high-risk systems, the legal obligations include technical documentation, effective human oversight, logging of interactions and an EU declaration of conformity. Fines reach €15 million or 3% of global turnover. Training your teams is the first lever.

What risks are associated with artificial intelligence systems?

The AI Act defines 4 risk levels: unacceptable (banned systems such as social scoring), high risk (recruitment, health, justice, with stricter obligations), limited risk (mandatory transparency) and minimal risk (self-regulation). The protection of fundamental rights is the central classification criterion. The more a system affects sensitive decisions, the higher its risk level.

How do you assess whether your AI is compliant?

Assessing an AI system's compliance starts with mapping your AI systems and classifying them against the AI Act criteria (sector, type of decision, data processed). A formal AI Act audit then checks the technical documentation, the logs and the safeguards in place. The compliance process must be documented and repeatable so that inspections by the authorities run smoothly.

What are the steps to AI Act compliance?

The key steps are: (1) awareness and appointing a lead, (2) mapping your AI systems, (3) classifying risks and identifying the concrete obligations, (4) implementing measures for high-risk systems (human oversight, documentation, logs), (5) ongoing governance with an annual review and team training. The action plan must be under way before the 2026 deadline (transparency) and the 2 December 2027 deadline (high risk, Annex III).

How do you build AI into regulatory compliance?

Bringing AI into an existing compliance approach starts with updating your GDPR records to include the artificial intelligence systems you deploy. Using these systems responsibly means meeting both the AI Act regulatory framework and the GDPR data protection obligations. Treating compliance as a competitive advantage rather than a constraint is the mark of a mature organisation.

Which tools help ensure AI compliance in the enterprise?

AI compliance tools work at two levels: the documentation level (GRC software, DPO as a service) and the technical level (a management system for agents in production). For organisations deploying autonomous AI agents, an agent deployment and governance platform such as the Idun open source platform (GPL v3, public and auditable code) helps meet the AI Act requirements: agent registry, kill switch, auditable traces and real-time data protection.

AI compliance: AI Act obligations, steps and tools in 2026

TL;DR: The AI Act has been coming into force in stages since 2024. Since February 2025, AI literacy training (Article 4) has been mandatory. The transparency obligations (Article 50) apply from 2 August 2026, and compliance for the Annex III high-risk systems has been postponed to 2 December 2027. Fines reach €35 million or 7% of global turnover. Mapping your AI systems, classifying risks, human oversight and auditable traces are the pillars of a structured approach.

AI compliance is no longer optional. Since February 2025, the EU AI Act has required every company deploying an artificial intelligence system to meet the training obligation (Article 4). The transparency obligations in Article 50 apply from 2 August 2026, and compliance for the Annex III high-risk systems has been postponed to 2 December 2027. Human control, human oversight, risk level: here is what the European Union's AI Act actually requires of your organisation.

What is AI compliance? Definition and what is at stake for businesses

Definition: AI compliance vs AI governance

AI compliance means meeting the regulatory compliance requirements that apply to artificial intelligence systems: the AI Act, the GDPR, ISO standards. Its development rests on trust: stakeholders must be able to verify that your agents follow the rules in force.

AI governance goes further. It also covers the responsible use of agents in production and the continuous assessment of risk.

In practice, the two cannot be separated.

Why AI compliance became critical in 2026

The European AI regulatory framework has been coming into force in stages since 2024. It is no longer a distant prospect. The first legal obligations already apply.

Did you know: According to the Direction Générale des Entreprises (DGE), 70% of European SMEs are not ready for the AI Act, with no AI inventory, usage charter or training to date. The fines set by Article 99 of EU Regulation 2024/1689 reach up to €35 million or 7% of global turnover for the most serious violations.

For organisations deploying autonomous AI agents in France and across Europe, the risk is immediate. The "wait until the regulation is fully enforced" approach no longer holds: AI literacy training has been a legal obligation since February 2025. Laws and regulations keep changing: you need the right tools to comply with each new rule.

The AI Act, GDPR and ISO/IEC 42001: which frameworks apply to you?

Three frameworks stack up for any company or client organisation that develops or deploys an artificial intelligence system in Europe. Your compliance needs triple as soon as these texts overlap.

The European regulation EU 2024/1689 (AI Act) applies to the AI system itself: its design, its development, its deployment. The GDPR applies as soon as the system processes personal data: it sits alongside the AI Act without replacing it. ISO/IEC 42001, a voluntary AI management standard, offers a complementary structuring framework to demonstrate a proactive compliance approach, especially towards partners and large prime contractors.

Data protection becomes doubly demanding when the first two frameworks apply to the same system.

AI Act, GDPR and regulatory framework: risk classification and overlapping obligations

Unacceptable-risk AI systems (banned since August 2024)

Some uses of AI have been banned outright since 2 August 2024, with no exceptions. The "unacceptable" risk level covers artificial intelligence systems that undermine fundamental rights or human dignity.