Artificial intelligence is moving fast and the regulation is finally catching up in the form of the EU AI Act.
This act is the first major attempt to put structure and accountability around how AI is developed and used. And yes, it’s an EU regulation, but its impact goes beyond Europe.
If your business builds, uses, or sells AI systems, or even uses tools powered by AI (which, let’s face it, most of us do at this point) you need to understand it.
What is the EU AI Act?
The EU AI Act is a legal framework which takes a risk-based approach to regulating the development and use of AI systems.
Instead of treating all AI the same, it splits the many different systems into categories depending on how much potential harm they could cause.
For businesses, this means the rules you need to follow depend on what your AI actually does.
The four risk levels for AI systems
The EU AI Act groups AI into four levels:
1. Unacceptable risk – banned outright
High-risk AI systems are those considered harmful to people’s rights or safety – for example:
- Social scoring systems (rating people’s behaviour)
- Manipulative AI that exploits vulnerability
- Certain types of biometric surveillance
2. High risk – strictly regulated
This is where most businesses need to pay attention, because systems categorised as high-risk include AI used in:
- Medical AI platforms like IDx-DR, used for diagnosing conditions
- Recruitment screening tools like HireVue, used for CV screening and candidate analysis
- Credit scoring systems used by banks (often proprietary, but similar in function to platforms like FICO Score)
- Insurance risk modelling tools used by providers
- AI supporting infrastructure decisions (energy grid optimisation, transport systems)
- Educational assessment platforms that influence grading or progression
If your AI sits in this category, you’ll need to have strong risk management processes and high-quality data governance with clear documentation and traceability. They’re also looking for ongoing monitoring of these processes, so it’s not a one-and-done situation.
3. Limited risk – transparency rules
The systems that fall into this category are allowed, but users need to be informed of the risks so they can choose whether to use them.
For example:
- Chatbots powered by tools like ChatGPT, Gemini, or Claude
- Customer service bots used on websites (e.g. Intercom AI assistants)
- AI image generators like DALL·E or Midjourney
- Voice assistants like Alexa or Siri.
Basically, you need to make sure it’s crystal clear that people are interacting with AI and not humans.
4. Minimal Risk – business as usual
Most everyday AI tools fall here. For example:
- Email filtering tools like Gmail Spam Filter
- Recommendation engines used by Netflix or Amazon
- AI productivity tools like Grammarly or Microsoft Copilot (for internal use)
- Calendar assistants and basic automation tools.
These aren’t heavily regulated, but good governance is still a must.
Key dates for AI act compliance
The EU AI Act is being phased in to allow organisations to adapt and stay compliant. Here are the key dates you need to know.
- June 2024 – The EU AI Act was formally adopted
- August 2024 – The act officially became law
- Early 2025 – Rules around banned (unacceptable risk) AI systems began to apply
- 2025–2026 – Requirements for general-purpose AI models (for example, large language models like ChatGPT and Claude) started to come in
- August 2026 – Most high-risk AI system obligations become fully enforceable
Does the EU AI Act Matters if you’re not based in the EU?
So why does it matter if you’re based outside of the EU? Well, many non-EU countries still sell into the EU, handle EU data, work with EU-based clients, or use third-party AI tools trained or deployed in the EU, so the act applies in all of these instances.
Plus, as the first legal framework of its kind in the world, it’s setting the tone for AI compliance, similarly to what GDPR did for data privacy, so it’s likely your clients, partners, and regulators will expect you to demonstrate AI act compliance anyway.
So what does it mean for your business?
The key takeaway is that AI is no longer just a tool, it’s something you’re expected to be held accountable for.
You don’t need to stop using AI, but you do need to start understanding it better and managing the risks it presents.
What if you don’t build AI?
A lot of businesses assume rules for AI don’t apply to them because they don’t develop AI systems, they simply use them – but you’re still responsible for managing the risk.
Risk still applies if you’re using AI in hiring tools, feeding sensitive data into ChatGPT, or relying on AI-driven analytics or automation.
What does good AI compliance look like in practice?
Good AI compliance means building processes and systems shaped around your organisational use of AI.
- Knowing where AI is being used across your business
- Understanding the level of risk attached to each use
- Putting guardrails around high-risk use cases
- Training your team on safe and responsible use
- Keeping records that stand up to scrutiny.
Where standards like ISO 42001 come into play
The EU AI Act tells you what you need to do. Standards like ISO 42001 help you work out how to actually do it.
They give you a structured way to manage AI risks and define responsibilities, embedding governance into your day-to-day operations so it becomes second-nature.
How iso360 can help
We help businesses move forward more confidently by turning AI regulation into a strength rather than a necessary evil.
Let’s begin with a chat about your business and how we could support you to understand your risk profile and build proportionate governance.