The Guide to the EU AI Compliance Act

Abstract

• The EU AI Act sets risk-based rules for developing, supplying, and using AI systems and models.
• Provider and deployer responsibilities differ, with distinct requirements for high-risk systems, transparency, and general-purpose AI models.
• Preparation involves identifying applicable deadlines and transitional provisions, assigning owners and documenting controls and supporting evidence.
• Ongoing review should track changes in purpose, models, access and behavior. For agents, this includes evaluating decisions and actions against business intent, policy and consequences, even when actions remain technically permitted.

Your organization’s EU AI Act obligations depend on its role, each AI system’s intended purpose and the risks involved. Security teams need to understand which decisions those systems support, what actions they take, and who is accountable for their use.

In the European findings of ISACA’s 2026 AI Pulse Poll, 92% of respondents believed employees were using AI in their organization, while 42% reported a formal, comprehensive AI policy.

Start by identifying the systems and agents in use and the people responsible for them. As agents take on new tasks, review whether their actions follow approved business processes and whether changes in their purpose or use call for a new regulatory assessment.

What Is the EU AI Compliance Act?

The EU AI Compliance Act is another term for the EU Artificial Intelligence Act, or EU AI Act: Regulation (EU) 2024/1689, as amended. The legislation establishes a risk-based framework for developing, supplying, and using AI, with different obligations for different systems and participants. 

Two roles matter for enterprise teams. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its authority in a professional context. An organization can occupy both roles across its AI portfolio. The Act also addresses importers, distributors, and other supply-chain actors. Article 3 defines these roles.

Its reach extends beyond EU-headquartered businesses. It covers providers supplying the EU market, deployers located in the EU, and certain providers and deployers outside the EU whose AI outputs are used within it. 

Once you have identified the obligations that apply, AI agent guardrails can help teams control agent access, require approvals for high-impact actions, and monitor whether behavior follows approved business processes.

How Does the EU AI Act Classify AI Risk?

Classification depends on the system’s intended purpose and deployment context. Two applications using the same underlying model can face different requirements.

Prohibited Practices

The Act bans specified practices, including harmful manipulation, certain social scoring, and emotion recognition in workplaces or education, subject to defined exceptions. Check the conditions in Article 5; a broad category label cannot settle whether a particular use is prohibited. 

High-Risk AI

There are two main routes. Annex III lists specified uses in employment, education, biometrics, critical infrastructure, essential services, law enforcement, migration, justice and democratic processes.

The product route under Article 6(1) covers AI systems that are products, or safety components of products, governed by the EU legislation listed in Annex I, where the relevant product must undergo third-party conformity assessment under that legislation.

Specific Transparency Obligations

A chatbot answering customer questions may need to tell users they are interacting with AI, even if it is not classified as high-risk. Article 50 explains when that notice is required and sets separate rules for marking or disclosing certain AI-generated or manipulated content. These duties can apply alongside the requirements for high-risk systems.

Minimal or No Risk

Most AI systems fall outside the high-risk regime. If your organization provides or deploys one of these systems, check which AI literacy and transparency obligations apply to its use. Include data protection and other relevant laws in that review.

 

What Are the Main EU AI Act Compliance Requirements?

Build your requirements list around four facts: your regulatory role, the system or model involved, its classification, and the applicable date. General-purpose AI (GPAI) models have a separate set of obligations. Keep the model provider’s responsibilities distinct from those attached to your organization’s use of an AI system. 

AI Literacy and Governance Ownership

Under amended Article 4, providers and deployers must take measures to support AI literacy among people who operate and use AI on their behalf. Those measures must reflect their experience, knowledge, and context of use. Organizations do not have to guarantee a particular literacy level for each individual.

In practice, maintain an inventory with named owners, intended purposes, and classification decisions. Use it to identify who needs training and who must supply evidence for each obligation.

Transparency For Relevant Uses

If your organization provides an AI system designed to interact directly with people, make sure users know they are dealing with AI, unless this is obvious in context. For systems that generate synthetic content, providers must meet the applicable machine-readable marking requirements.

Deployers have separate disclosure duties for deepfakes and certain AI-generated text published to inform the public on matters of public interest. Check Article 50 for the conditions and exceptions that apply to your role and use case.

Requirements For High-Risk Systems

Once the relevant requirements apply, providers of high-risk systems must address risk management and data governance. They must maintain technical documentation, provide instructions for use, and design systems that support logging and human oversight. The Act also sets requirements for accuracy, robustness, and cybersecurity.

Providers need a quality management system and must complete the applicable conformity assessment and registration steps. Their work continues after deployment through post-market monitoring and procedures for handling and reporting serious incidents.

If you deploy a high-risk system, follow the provider’s instructions and monitor its operation. Put competent, trained people with the authority to oversee it in charge, and give them the support they need. Keep automatically generated logs under your control for at least six months, unless applicable law provides otherwise. Depending on your role and use case, you may also need to notify affected workers and their representatives or carry out a fundamental rights impact assessment.

EU AI Act Compliance Timeline: What Applies Now?

The AI Omnibus amendments entered into force on July 27, 2026, changing the timetable. As of October 26, 2026, the main milestones are:

Date	Key requirement	Brief explanation
February 2, 2025	General provisions and original prohibitions	Chapters I and II began applying. Article 4’s AI literacy wording has since changed.
August 2, 2025	GPAI model obligations	Requirements began applying to relevant model providers, with a transition for existing models.
August 2, 2026	Transparency obligations	Article 50 began applying, subject to a limited transition for certain existing synthetic-content systems.
December 2, 2026	Additional prohibitions	New bans concerning non-consensual sexual content and child sexual abuse material begin applying.
December 2, 2027	Core requirements for Annex III high-risk systems	The relevant Chapter III requirements apply to systems classified under Article 6(2) and Annex III.
August 2, 2028	Core requirements for product-related high-risk systems	The relevant Chapter III requirements apply to systems classified under Article 6(1) and Annex I.

These high-risk dates concern Chapter III, Sections 1–3, excluding Article 6(5); other provisions and transitional rules have their own application dates. 

Article 111 provides two important transitions: providers of GPAI models placed on the market before August 2, 2025 have until August 2, 2027; providers of synthetic-content systems placed on the market before August 2, 2026 have until December 2, 2026 to meet Article 50(2)’s marking requirement. 

Check the latest consolidated regulation, including Article 113 and transitions for existing high-risk systems. Older checklists may contain superseded deadlines.

How to Prepare for EU AI Act Compliance

1. Inventory AI systems and agents

Include purchased products, internal developments, and AI embedded in existing applications. Record each system’s owner, intended purpose, users, affected people and connected systems. Reconcile business-team declarations with procurement and technical evidence to find gaps.

For agents, include non-human identities, such as service accounts, OAuth grants, delegated access and API connections. Record who can trigger the agent and which actions its permissions allow.

2. Determine your regulatory role

Assess each system separately. Buying a tool may make your organization a deployer, while putting an internally developed system into service can create provider responsibilities.

Reassess changes too. Under Article 25, rebranding or substantially modifying a high-risk system, or changing a system’s purpose so it becomes high-risk, can transfer provider obligations to another organization. 

3. Classify the use case

An assistant that retrieves an approved job description does a different job from one that ranks applicants. Record what the system is intended to do, which decisions it supports, and who could be affected.

Use that information to check for prohibited practices, assess both routes to high-risk classification, and identify any transparency duties. Ask your legal and governance teams to review the reasoning, including the basis for any exception you rely on.

4. Map controls and evidence

For each duty, specify the control, accountable owner, and evidence needed to show how you meet it. Depending on the requirement, that evidence might include training records, provider instructions, oversight procedures, logs, or incident escalation routes.

Use AI agent observability to trace who or what triggered an action, which identity the agent used, and what happened next. Review the relevant policy alongside that record. Compare the agent’s effective permissions and observed activity with the access you approved, then check whether it followed the intended business process.

5. Review what changes over time

Review how changes to the system’s purpose, models, permissions, integrations, or behavior affect your original assessment. Record who approved each change and whether it calls for a new regulatory assessment. For agents, changes to permissions or integrations may also warrant an AI vulnerability assessment to check for security weaknesses.

Suppose a procurement agent has approval to prepare recommendations but begins placing orders without the required sign-off. Its existing permissions may allow those transactions. The procurement owner and security team should examine the action history and approval process, assess the consequences, and correct the workflow. The skipped approval calls for investigation; it does not establish an AI Act violation on its own.

Turn AI Compliance Requirements Into Operational Governance

The final takeaway is to keep your AI inventory and records of applicable obligations up to date. As agents gain access to more systems or take on new tasks, security teams need evidence linking their actions to business purpose and accountable owners.

WithWings is the control layer for AI agents. It helps teams understand agent decisions in the context of their business and evaluate behavior against business intent and policy. Teams can use evidence from agent discovery, ownership, access mapping, and action traces to investigate deviations, assess business impact, and decide what to fix.

Use that evidence within your legal, GRC, and security processes. Formal classification, conformity assessment, and regulatory reporting remain responsibilities for the relevant organizational teams.

Request a demo to see how WithWings helps you understand agent decisions, identify deviations from business intent and policy, and prioritize what to fix.