The EU AI Act regulates the use of artificial intelligence in businesses through a risk-based system with graduated obligations: the higher the risk potential of an AI system, the stricter the requirements for documentation, transparency, and human oversight. Companies that develop, place on the market, or deploy AI systems in the EU are affected. The following sections answer the most important questions that businesses have when dealing with the EU AI Act.<\/p>\n\n\n\n
In principle, all companies that develop, offer, import, distribute, or use AI systems in the European Union are affected by the EU AI Act. This applies regardless of company size or registered location: providers from third countries also fall under the regulation as soon as their AI systems are deployed on the EU market.<\/p>\n\n\n\n
The regulation distinguishes between different roles a company can take on. A provider<\/strong> is anyone who develops an AI system and places it on the market. An operator<\/strong> is anyone who deploys a third-party AI system in their own business context. Both roles come with different obligations, with providers generally having to meet far more extensive requirements.<\/p>\n\n\n\n The regulation does provide certain relief for small and medium-sized enterprises, but this does not exempt them from the fundamental requirements. Anyone using AI-powered tools for personnel selection, credit assessment, customer communication, or process automation is obliged to check which risk category the systems in use fall into.<\/p>\n\n\n\n The EU AI Act divides AI systems into four risk levels: unacceptable risk, high risk, limited risk, and minimal risk. This classification directly determines which compliance requirements a business must meet.<\/p>\n\n\n\n AI systems classified as posing an unacceptable risk are completely prohibited. These include, among others, systems for real-time biometric surveillance in public spaces, systems for social scoring of individuals, and AI that enables subliminal manipulation of people. These prohibitions apply from the first day of application.<\/p>\n\n\n\n AI systems used in sensitive areas are classified as high-risk: employment and personnel management, education, critical infrastructure, law enforcement, border control, the administration of justice, and access to essential services such as credit or social benefits. Extensive obligations apply to these systems, which are explained further below. AI systems with limited risk, such as chatbots, are subject primarily to transparency obligations. Systems with minimal risk, such as simple spam filters, are largely unregulated.<\/p>\n\n\n\n Businesses deploying high-risk AI systems must establish a comprehensive risk management system, provide technical documentation, ensure human oversight, and subject their system to a conformity assessment before market entry. These obligations apply to providers and, in a graduated form, to operators as well.<\/p>\n\n\n\n In practical terms, this means the following for day-to-day operations:<\/p>\n\n\n\n Operators who use a high-risk system from another provider must ensure that they deploy the system only for its intended purpose, follow the operating instructions, and notify the provider of any irregularities. The ISO 42001 audit<\/a> offers a structured framework for systematically verifying conformity.<\/p>\n\n\n\n Employers who use AI systems in the HR domain \u2014 for example for application screening, performance evaluation, or working-hours management \u2014 are under particular scrutiny from the EU AI Act. Such systems generally fall into the high-risk category and are therefore subject to the strictest requirements.<\/p>\n\n\n\n In addition to the requirements of the EU AI Act, employers must also keep data protection law in mind. The GDPR sets clear requirements for the processing of personal data: lawfulness, purpose limitation, data minimisation, and transparency are fundamental principles that also apply when using AI. Automated decisions that significantly affect employees may generally not be made without human review.<\/p>\n\n\n\n Furthermore, employers have an obligation to inform affected employees. Anyone who is assessed, monitored, or classified by an AI system has the right to know that such a system is in use. Internal AI policies that govern the development, procurement, operation, and use of AI systems are a central instrument of AI governance within the organisation<\/a>. These policies should be aligned with existing data protection and information security policies.<\/p>\n\n\n\n Violations of the EU AI Act can result in fines of up to \u20ac35 million or 7 percent of global annual turnover, whichever is higher. The specific fine range depends on the nature of the violation.<\/p>\n\n\n\n The penalty tiers are graduated as follows:<\/p>\n\n\n\n In addition to fines, authorities may also order the recall or prohibition of AI systems. For companies that additionally violate unfair competition law \u2014 for example through misleading statements made by an AI chatbot \u2014 injunctive relief and claims for damages may also arise.<\/p>\n\n\n\n Businesses prepare for the EU AI Act by first taking an inventory of all AI systems in use within the organisation, determining their risk level, and then building the necessary governance structures. This process follows a clear step-by-step approach.<\/p>\n\n\n\n A proven approach includes the following steps:<\/p>\n\n\n\n ISO\/IEC 42001 provides an internationally recognised framework for building an AI management system. It defines minimum requirements for governance, risk management, AI policies, and internal organisation, and complements the statutory requirements of the EU AI Act with a structured management instrument.<\/p>\n\n\n\n We at mITSM support professionals, managers, and organisations in understanding the requirements of the EU AI Act and implementing them in their operations. Our training portfolio covers all the key topic areas needed for compliant AI governance:<\/p>\n\n\n\nHow does the EU AI Act classify risk levels for AI systems?<\/h2>\n\n\n\n
Prohibited AI systems with unacceptable risk<\/h3>\n\n\n\n
High-risk AI with strict requirements<\/h3>\n\n\n\n
What obligations apply to businesses when deploying high-risk AI?<\/h2>\n\n\n\n
\n
What do employers need to consider when using AI in the workplace?<\/h2>\n\n\n\n
What penalties are imposed for violations of the EU AI Act?<\/h2>\n\n\n\n
\n
How can businesses prepare concretely for the EU AI Act?<\/h2>\n\n\n\n
\n
How mITSM supports businesses with AI compliance<\/h2>\n\n\n\n
\n