EU AI Act: Compliance Steps for Security and Technology Firms

The EU AI Act Framework

The EU AI Act entered into force in August 2024 and is being implemented in phases through 2026 and 2027. It establishes the world's first comprehensive legal framework for artificial intelligence, applying a risk-based approach: AI systems are classified by risk level, with compliance obligations that scale with assessed risk.

Risk Classification

Prohibited AI Practices

Certain AI applications are prohibited outright: social scoring systems rating individuals based on behaviour, real-time biometric surveillance in public spaces (with narrow law enforcement exceptions), manipulation that subverts individuals' free will. These prohibitions applied from February 2025.

High-Risk AI Systems

High-risk AI systems face the most demanding compliance requirements. Annex III defines the categories, including AI in critical infrastructure management, AI-assisted employment decisions (CV screening, performance assessment), AI in law enforcement and judicial contexts, and AI in credit scoring and insurance underwriting.

Security firms providing AI systems that assist in consequential decisions — fraud detection affecting account access, systems assisting insider threat identification — should assess whether their products fall within high-risk categories.

Limited and Minimal Risk AI

Most AI applications fall into limited or minimal risk categories, subject primarily to transparency obligations: chatbots must disclose their AI nature, AI-generated content must be labelled, deepfakes must be identified.

Compliance Requirements for High-Risk Systems

Providers of high-risk AI systems must:

Implement a risk management system covering the full AI lifecycle from design through deployment and monitoring.

Maintain technical documentation covering system purpose, design decisions, training data, accuracy metrics, and foreseeable misuse scenarios.

Enable human oversight — high-risk systems must allow humans to monitor, intervene in, and override system outputs. Fully automated decision-making without human oversight is not permissible.

Achieve conformity assessment before placing high-risk systems on the EU market, involving third-party assessment by a notified body for many categories.

Register in the EU database — a public registry of high-risk AI systems enabling regulatory oversight.

Compliance Steps for Security Firms

Inventory your AI systems. Map all AI systems you provide to customers and use internally. Assess each for intended use and downstream deployment context.

Assess high-risk classification. Apply Annex III criteria. Where classification is uncertain, err toward treating the system as high-risk for compliance planning.

Gap assessment against high-risk requirements. For systems assessed as high-risk, evaluate current documentation, risk management processes, and human oversight provisions.

Monitor GPAI codes of practice. Firms developing general purpose AI models face specific requirements around transparency, copyright compliance, and for GPAI models with systemic risk, adversarial testing and incident reporting.