Glossary · AI governance
The EU AI Act sorts AI by the harm a use could cause.
The European Union's regulation on artificial intelligence. It sets duties by risk tier and by role, and its provisions apply in stages from February 2025.
Back to the glossary01 · In plain words
In plain words
The European Union's regulation on artificial intelligence. It sets duties by risk tier and by role, and its provisions apply in stages from February 2025.
The AI Act is a law, not a standard you choose to adopt. It bans a short list of practices, sets heavy duties for high-risk uses such as hiring and credit scoring, asks for transparency where people talk to AI or see generated content, and has a separate chapter for general-purpose AI models. Most AI in use falls in none of the heavy tiers.
Spelled out: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Reach is the reason an Indian company should care. The Act applies to providers placing AI on the EU market and, in some cases, to providers and deployers outside the EU whose AI output is used there. For the most serious breaches, fines can reach EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher (Article 99). European customers are already writing its categories into contracts and vendor reviews. A vendor that can say which tier each feature sits in, and which role it plays, closes those reviews faster than one that cannot.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Article 5
- The prohibited practices, such as social scoring and certain manipulative or exploitative uses.
- Article 6 and Annex III
- How a system becomes high-risk, and the list of sensitive use areas such as employment, education and credit.
- Article 50
- Transparency duties for chatbots, synthetic media and certain generated text published to inform the public.
- Article 113
- The staged dates on which each part of the Act starts to apply, as later amended for the high-risk rules.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an exam-proctoring tool sold to European universities
An edtech firm in Hyderabad licenses remote exam proctoring to universities in Ireland and Spain. Its software watches webcams and flags suspected cheating. Annex III names AI used to monitor students for prohibited behaviour during tests, so the feature is likely high-risk and the firm is its provider. That brings a risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness work, and a conformity assessment. The universities, as deployers, take on duties of their own. The firm's chatbot that answers student questions about exam timetables carries only a transparency duty: students must know they are talking to a machine.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- ISO/IEC 42001
- A voluntary, certifiable management-system standard. It can organise the work the Act demands, but a certificate is not compliance with the law.
- GDPR
- Governs personal data. An AI system that processes personal data must meet both laws; neither replaces the other.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Build an inventory of AI systems and models, and mark which ones reach EU users or customers.
- Place each in a tier: prohibited, high-risk, transparency only, or minimal.
- Record your role for each one: provider, deployer, importer or distributor.
- Track the application dates against your roadmap, and recheck them, since the high-risk dates were already moved once in 2026.
- GuideISO 42001 and the EU AI ActLaw vs standard, the risk tiers, dates, and the article-by-article map.
- GuideAI risk vs impact assessmentTwo assessments: inward risk and outward impact, and the register.
Sources: Regulation (EU) 2024/1689, Articles 2, 3, 4, 5, 6, 50, 99 and 113 and Annex III, as published on EUR-Lex.
Questions about EU AI Act
When does the AI Act apply?
In stages, from February 2025.
The Act entered into force on 1 August 2024. The prohibitions and the AI literacy duty applied from 2 February 2025, the general-purpose AI and governance rules from 2 August 2025, and the Act applies generally from 2 August 2026. The digital omnibus, in force since 27 July 2026, moved the high-risk rules back: to 2 December 2027 for the listed sensitive uses (Annex III) and 2 August 2028 for AI built into regulated products (Annex I). The dates have changed before, so check the Commission's AI Act page before planning around them.
Is there an AI Act certificate?
Not as a general badge.
High-risk systems go through a conformity assessment, in some cases with a notified body, and carry CE marking. There is no general certificate that a company complies with the AI Act. Auditify assesses and prepares; it does not certify.
We only use AI tools internally. Are we covered?
Possibly, as a deployer.
Using an AI system in a professional capacity makes you a deployer. For most internal tools the duties are light, starting with AI literacy for the staff who use them. Use in hiring, managing workers or another Annex III area brings more. Counsel should confirm how the Act applies to your contracts.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.