European AI Act shifts focus to understanding

The European AI Act requires companies to show they truly understand their AI systems, not just complete compliance checklists. This means knowing which systems are in use, their purposes, the risk levels involved, and who is responsible for them.

Inventory reveals hidden AI use

An initial step in complying with the AI Act is to create an inventory of all AI tools in use. This often uncovers AI applications that legal or IT departments were unaware of, such as tools for screening job candidates or analyzing documents. These discoveries highlight the widespread and sometimes unexpected use of AI in organizations.

Risk classification depends on clear inventory

Classifying AI systems by risk levels, from prohibited to minimal, is only effective if companies have a clear inventory of their AI tools. The AI Act imposes different obligations based on a company's role—supplier, deployer, importer, or distributor—and these roles must be clearly defined in the supply chain. For example, a company using AI to support recruitment without automating final decisions must be able to justify why this is not a high-risk use or prove it meets the requirements.

AI literacy is a key requirement

The AI Act also stresses the importance of AI literacy, requiring users to understand the limitations, potential biases, effects on personal data, and their own responsibilities regarding AI systems. This is about fostering a shared culture around AI rather than simply learning how to use tools. The AI Act aligns with the GDPR, which still applies when AI systems process personal data, ensuring that legal bases, data minimization, informing individuals, and impact assessments remain relevant.

AI Act aims for ongoing governance

The AI Act is seen as a governance tool rather than just a regulatory burden. Understanding AI systems' usage, purposes, guarantees, and responsibilities is crucial for making informed decisions about AI deployment. Compliance is an ongoing process, requiring continuous qualification with each new AI tool, supplier change, or integration of a general-purpose model into a product. Success in compliance will depend on making inventory and governance a reflex rather than a one-time project.