EU AI Act: prohibited practices and the AI literacy duty already apply. High-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Find verified AI talent→Run a system analysis→Get your board report→

EU AI Act guide

The EU AI Act, explained for the people who have to act on it.

Whether you build AI, buy it or simply use it at work, the Act asks the same four things of you: who are you in the chain, how risky is the system, what can you show, and who keeps it current. Here is how to answer each one, in order.

Check where you stand How ISO 42001 helps you run it

Start with your role, because it sets your duties.

One company can hold several roles at once. A software team that builds a model and also uses it internally is both a provider and a deployer.

Provider

You develop an AI system, or have it developed, and put it on the market under your name.

Deployer

You use an AI system in your own work, for example in hiring, credit, support or operations.

Importer and distributor

You bring a system into the EU market or make it available further down the chain.

Product manufacturer

You embed AI in a regulated product and place that product on the market.

Then classify the system, because risk decides how much work follows.

Prohibited

Practices the Act bans outright. If your use case sits here, the answer is to stop, not to document.

High-risk

Systems in listed areas such as employment, education, essential services or safety components. These carry the heaviest obligations.

Transparency

Systems such as chatbots and synthetic media, where people need to know they are dealing with AI.

General-purpose models

Foundation models have their own obligations for the providers who release them.

AI literacy is the part every team can start this month.

Article 4 asks organisations to make sure the people who work with AI have enough understanding to do it responsibly. Read the exact wording in the amended Regulation on EUR-Lex. The Commission's AI literacy Q&A and its living repository of practices show how other organisations approach it, and are best used as implementation guidance.

  • Map who uses AI, and how deeply
  • Match training to role, not to job title alone
  • Keep a simple record of what was delivered
  • Revisit when tools or use cases change

Evidence is what turns good intentions into something you can show.

For each system that matters, keep these in one place, with a named owner and a review date.

01

Intended use and risk classification

02

Data governance and quality checks

03

Human oversight and escalation steps

04

Monitoring, incidents and change history

The operating system

One working system for the Act, so nothing lives in a spreadsheet nobody owns.

Alive Assist reads your existing documents, maps them to the requirements that apply, shows what is present, partial or missing, and turns the gaps into a prioritised action list. It supports readiness. It does not give legal advice or guarantee compliance. Alive helps you prepare through its analyses and expert pool, and is not certified to implement the Act for you. Hands-on implementation is delivered only with selected business partners or experts.

See Alive AssistESG & AI compliance readinessThe full operating model

Who can execute, depending on what you need next.

You know your business, and we can help with the rest. Pick the pathway that matches where you are today.

I need a clear baseline

Upload your documents and get a requirement-level view of what is covered and what is open.

Get the readiness report

I need an expert to do the work

Describe the mandate and meet vetted ESG and AI specialists who fit it.

Meet matched specialists

I need to be ready for review

Organise your evidence for an internal check or an independent assessor.

Prepare for audit

Questions people ask us about the EU AI Act

Does the EU AI Act apply to my company if we are outside the EU?

It can. The Act looks at where an AI system is placed on the market or used, and where its output is used, not only where your company is based. Check your role and use cases against the Regulation text, and take legal advice for borderline cases.

Where should I read the legal wording?

On EUR-Lex, in Regulation (EU) 2024/1689 as amended. Commission Q&A pages are helpful for implementation but they do not replace the Regulation, and earlier passages may predate the amendment.

What is the first practical step?

Make an inventory of the AI systems you build, buy or embed, write down who owns each one, and note what it is used for. Role and risk classification both depend on that list.

Is the EU AI Act the same as ISO/IEC 42001?

No. The Act is law, with obligations that depend on role and risk. ISO/IEC 42001 is a voluntary management-system standard that gives you a way to run the work. Many teams use the standard to hold the evidence the Act asks for.

Sources behind this guide

Legal wording comes from EUR-Lex. Commission Q&A material is implementation guidance only.

Inside Alive Assist

Nine layers in every report, one structure across EU AI Act, ISO/IEC 42001 and NIST

Each assessment opens as a summary and goes down layer by layer: requirement coverage, gaps with their sources, prioritised actions, a control matrix, a risk register, evidence confidence, exposure scenarios and a board decision pack. Because the structure is identical for every framework, results line up side by side.

Regulation (EU) 2024/1689

EU AI Act readiness

8%

readiness in this sample run

Reflects the evidence supplied, so it rises as gaps are closed.

The nine layers

  • Executive summary
  • Requirement coverage
  • Gap analysis with sources
  • Prioritised actions
  • Control matrix
  • Risk registerShown
  • Evidence confidence
  • Exposure scenarios
  • Board decision pack
Alive Assist EU AI Act readiness report showing 8% readiness and nine collapsed report layers
EU AI Act risk register listing five risks with likelihood, impact, rating and treatment

Risk register, layer by layer. Open the risk register and every obligation for high-risk AI systems appears with likelihood, impact, a rating and a treatment: risk management system, data governance, technical documentation per Annex IV, transparency to deployers, and record-keeping.

Screens are from Alive Assist sample runs. Readiness reflects the evidence supplied in that run and is not an assessment of any organisation. Alive does not give legal advice or certify compliance.

Continue with the connected guides