The EU AI Act Compliance Guide: Best Practices for Enterprises

Key Takeaways

• The EU AI Act is the world’s first comprehensive AI law, with extraterritorial reach and fines of up to €35 million or 7% of annual turnover.
• EU AI Act compliance includes classifying AI systems into risk levels from Minimal Risk to Unacceptable and following regulations based on that risk tier. 
• Prohibited practices like social scoring by governments and the use of real-time remote biometric identification by law enforcement, except in narrow circumstances, are already in effect. 
• Organizations should start by identifying and classifying all AI systems used, building governance infrastructure, and monitoring continually. 

On August 2, 2026, the EU AI Act’s transparency obligations went into full effect. If your organization uses chatbots, generates synthetic content, or deploys any AI system that interacts with European citizens, EU AI Act compliance is now a legal requirement. This includes disclosing and labeling AI-generated content, ensuring proper data governance, and documenting everything behind decisions made by AI systems. While the compliance deadline for high-risk systems is being pushed to December 2027 under the Digital Omnibus Agreement, it’s close enough that organizations need to take action now or face severe financial penalties. 

In this guide, we’ll explain the EU AI Act and its risk tiers, compliance requirements, and penalties for non-compliance. Plus, we’ll cover best practices for organizations in scope. 

‍

What Is the EU AI Act?

The EU AI Act is the very first comprehensive legal framework that regulates the development and use of artificial intelligence. It was adopted by the European Parliament in March 2024, but affects organizations around the world. The EU AI Act takes a risk-based approach to craft the regulations: i.e., the more risk an AI system poses to people’s safety, health, or fundamental rights, the stricter the rules its providers and deployers must follow. 

The EU AI Act compliance applies to any organization that develops, deploys, or imports AI systems used in the EU, no matter where the company is based. That means if your AI touches EU users, you’re in scope. Enforcement is phased, but most of the requirements are enforceable as of August 2, 2026. The Omnibus agreement, which hasn’t been fully adopted yet, proposes to postpone requirements for high-risk AI until December 2027. 

What Are the Four EU AI Act Risk Tiers?

The Act sorts AI systems into four risk tiers, with varying degrees of regulation based on the risk to individuals and society as a whole. Organizations must classify each of their AI systems based on the risk tiers and follow the specific regulations. 

The four risk tiers are:

• Unacceptable Risk
• High Risk
• Limited Risk
• Minimal Risk

What Are the Risks?

1. Unacceptable Risk: AI systems in this category are prohibited, with steep fines for non-compliance. Prohibitions took effect February 2, 2025, and include: social scoring by governments, untargeted facial-image scraping, emotion recognition in workplaces and schools, real-time remote biometric identification in public spaces by law enforcement except in specific circumstances, subliminal manipulation or deception, predictive policing based only on profiling, biometric categorization of sensitive traits like race, religion, or sexual orientation, and exploitation of vulnerabilities of children and other protected groups. Additionally, the Digital Omnibus proposes the explicit prohibition of AI use to create non-consensual sexual images, video, audio, or similar material and child sexual assault material (CSAM), with a compliance deadline of December 2, 2026. 
2. High Risk: This is the tier that demands the most work, including detailed documentation, AI risk management, data governance, logging, human oversight, accuracy, and more. High-risk status occurs when AI is used as a safety component, such as in medical devices, machinery, and vehicles. It also applies to AI used in sensitive areas like biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, border control, and administration of justice. 
3. Limited Risk: AI systems in this tier have lighter obligations that focus on transparency and disclosure. Limited risk AI systems typically include chatbots and generative AI content. Chatbots must inform users they are talking to AI, while Generative AI content has to be marked as AI-generated.
4. Minimal Risk: Most AI systems, like spam filters, AI-enabled games, inventory optimizers, or recommendation engines, fall here. There are no specific regulatory obligations, but the Act does encourage voluntary codes of conduct.  

How to Be Compliant

EU AI Act compliance requires more than just an old-fashioned, annual review. Organizations need to implement ongoing AI governance, continual documentation, and total transparency. Whether you’re a provider, deployer, or distributor, you are subject to the EU AI Act if your AI systems affect EU citizens. 

So how can you comply with the Act? Here’s a roadmap to get you started:

1. Begin by identifying every AI system you develop, deploy, or use. Document who owns each system, what it does, how it works, what data it processes, what groups it affects, and what decisions it influences.  
2. Classify each system by risk tier. For example, an AI chatbot on your website would likely fall under Limited Risk while an AI system that makes loan approval decisions would fall under High Risk. 
3. Create a gap analysis, comparing your current practices to EU AI Act compliance. Identify gaps and prioritize based on risk tiers. For example, you may already have transparency disclosures but need technical documentation and human oversight mechanisms. 
4. Create a compliance roadmap with deadlines to help you close the gaps. Focus first on ensuring that your systems avoid prohibited practices. For the others, make a plan to make changes to your systems to be compliant.
5. Provide AI literacy training to your staff, based on their roles and level of AI use. For example, engineers need more in-depth training than customer-facing staff members. Maintain training records to show who received what training and when. Create a cadence of training sessions so that new staff get the appropriate training.
6. Create an AI governance framework. Begin by defining your AI governance principles, establishing roles and responsibilities for oversight, and building an inventory and risk system. AI governance is an ongoing process that requires regular monitoring, detailed documentation, and human oversight. Ensure it is integrated with the corporate and IT governance framework.

Deadlines and Timelines

The EU AI Act was adopted in March of 2024 and follows a phased implementation timeline, with obligations rolling out progressively. 

• August 1, 2024: EU AI Act entered into force. 
• February 2, 2025: Prohibited practices and AI literacy obligations began. 
• August 2, 2025: GPAI model obligations and AI governance obligations began. 
• August 2, 2026: Article 50 transparency obligations began.
• Dec 2, 2027: Annex III (standalone systems) high-risk AI obligations go into effect, per the Omnibus agreement.
• August 2, 2028: Annex I (embedded systems) high-risk AI obligations go into effect, per the Omnibus agreement. 

Although the high-risk AI obligations were deferred until 2027 or 2028, the time to act is now. Transparency compliance is active, and businesses using high-risk systems should begin preparing now rather than waiting for the 2027 deadline. 

What are the Best Practices for Enterprises?

Whether you’re preparing for the December 2027 deadline for high-risk systems or already operating under transparency rules today, these best practices will help you as you work towards EU AI Act compliance: 

• Start with high-risk AI systems, which carry the heaviest compliance burden. Prioritize risk management, technical documentation, automated logging, human oversight, conformity assessment, and registration, as these are the systems regulators will look at first. 
• Build AI governance into your systems and governance frameworks. Don’t treat it as an afterthought, waiting until the system is deployed to produce documentation. Instead, integrate risk assessment, document generation, and logging during development. 
• Create an AI literacy program for your team. From February 2025, all organizations deploying AI must train their staff in AI literacy, understanding capabilities, limitations, and risks. Once isn’t enough. This should be an ongoing program that scales with your AI footprint. 
• Prepare for conformity assessments early. For high-risk systems, you’ll need to complete a conformity assessment before placing it on the market. Annex I systems–those embedded within regulated products like toys, machinery, or medical devices–may require a third-party auditor. For Annex III systems–standalone use cases such as biometrics or critical infrastructure–self-assessment is usually sufficient, but you’ll need to ensure the documentation can withstand scrutiny. 
• Utilize existing compliance frameworks to accelerate EU AI Act compliance. The Act overlaps substantially with GDPR, ISO 27001, SOC 2, NIST AI RMF, and other industry-specific regulations. You don’t need to overhaul your compliance processes. Instead, document where each EU AI Act control is already addressed by an existing framework, where it partially overlaps, and where it’s generally new. 
• Use confidential computing for verifiable audit trails. Confidential computing isolates data while it is actively being processed by isolating workloads inside a hardware-based Trusted Execution Environment (TEE), or secure enclave.  The technology also gives you tamper-proof, attested logs of AI system behavior, which is exactly what regulators want to see. It also protects training data during processing, directly supporting the Act’s data governance and transparency requirements with cryptographic proof. 

What are the Penalties for Non-Compliance?

The EU AI Act carries some of the steepest fines in tech regulation. The table below lists the type of violations and the associated fines.

Turnover-based fines are calculated based on the global annual turnover of the preceding year, not just EU revenue. For a multinational enterprise, 7% can easily reach hundreds of millions of Euros. Penalties for SMEs and startups are subject to more proportionate caps, but the upper limits are still significant. 

How does Anjuna help with EU AI Act Compliance?

The EU AI Act demands verifiable proof that your AI systems are operating within the rules, not just policy documents. Anjuna’s confidential computing ensures organizations provide just that. 

• Cryptographic attestation: Anjuna’s trusted execution environment (TEE) technology delivers hardware-level attestation that auditors can verify cryptographically. 
• Tamper-proof audit trails: High-risk systems must maintain automated logs of system behavior. With Anjuna, those logs are generated and stored within a hardware-enforced enclave, which keeps them secure for regulatory inspection without the risk of tampering. 
• Protect sensitive data and autonomous workloads during processing: Anjuna ensures that data and apps remain isolated and attested during processing, even from the infrastructure provider. This is critical for organizations running AI apps using biometric data, health information, or other sensitive categories that fall under Annex III. 
• Built for regulated environments: Anjuna is already deployed in financial services, healthcare, and government sectors where the EU AI Act’s high-risk obligations map directly to existing regulatory frameworks. Our platform integrates with your existing infrastructure without application rewrites. 

With most of the EU AI Act deadlines active, the time for compliance is now. The organizations that will navigate it smoothly are the ones that treat compliance as an ongoing effort as well as a competitive advantage. 

Anjuna helps enterprises deploy AI in regulated environments with hardware-grade confidential computing. Contact us today to learn how we can support your EU AI Act compliance journey.  

‍

FAQs

How does the EU AI Act affect US companies?

While the EU AI Act is enforced by European agencies, it directly impacts US companies whose AI systems affect people in the European Union. Essentially, if your company has EU customers, users, or employees whose data or decisions are touched by AI, you’re in scope. 

When did the EU AI Act go into effect?

The Act entered into force on August 1, 2024, but obligations have rolled out in phases. High-risk compliance, which is the most consequential deadline for enterprises, goes into effect in December 2027. 

What does the EU AI Act regulate?

The Act regulates the development, placement on the market, and use of AI systems within the EU. It uses a risk-based framework, placing more stringent regulations on high-risk systems. Some key aspects of EU AI Act compliance include transparency, documentation, data governance, and avoidance of prohibited practices. 

Who needs to comply with the EU AI Act?

Providers, deployers, importers, and distributors of AI systems that affect citizens of the EU are required to comply. For example, a bank based in the US that serves European citizens must comply if they deploy AI systems in the course of its activities within the EU. 

How does Anjuna help with EU AI Act compliance?

Anjuna provides confidential computing technology that keeps data isolated and attested during processing. This provides cryptographic proof that autonomous apps are operating as documented, that training data was properly handled, and that logs haven’t been tampered with.