EU AI Act at a glance

The EU AI Act is the most detailed AI rulebook in force for organisations that place systems on the EU market or whose output is used there. This note is a working map, not legal advice.

Who it tends to catch

• Providers who develop or substantially modify AI systems
• Deployers who put those systems into use inside their organisation
• Importers and distributors in the supply chain

If your tool touches people in the EU — customers, staff, or the public — assume you need a clear answer on role and risk tier, even if the company is based elsewhere.

Risk tiers that matter in practice

Exact classification depends on the use-case, not the marketing label on the model.

A sensible first pass

1. Inventory every AI-assisted workflow, including vendor tools and “shadow” copilots.
2. Name the role — provider, deployer, or both — for each entry.
3. Classify against the risk tiers with a written rationale.
4. Gap the evidence — technical docs, human oversight, data governance, logging.
5. Fix the highest gaps first; do not boil the ocean on low-stakes tools.

Note: Deadlines and guidance still move. Treat published dates as directional and keep a named owner for the inventory.

What “good” looks like

Good compliance work is boring on purpose: a living register, clear owners, and changes that stick when the product team ships the next release. Theatre binders that nobody opens do not count.

Related Lathestone work

If you want a structured pass with someone who also builds the systems, see AI governance & compliance.