On compliance strategy

Our view on compliance strategy

With key provisions of the EU AI Act beginning to apply from 2025 and 2026, businesses should treat compliance planning as an immediate operational priority, even in the absence of full regulatory clarity.

1. Begin with mapping your AI systems and legal context.
   Identify which of your systems are general-purpose or high-risk, and determine which existing EU frameworks already apply, such as the GDPR, DSA, and product safety rules. These form the foundation of your AI compliance strategy.
2. Use existing compliance processes as the base.
   Many AI Act obligations build on data protection (DPIAs, transparency), product law (conformity assessment), and platform regulation (risk management). Review and extend your current practices rather than building separate AI-specific processes in isolation.
3. Prepare for GPAI and high-risk system deadlines.
   For GPAI models, ensure that technical documentation and risk assessments are being developed now to meet the August 2, 2025 obligations. For high-risk AI systems, readiness should align with the August 2, 2026 timeline unless a system is modified earlier.
4. Preserve transitional exemptions through control.
   Avoid substantial modifications to GPAI or high-risk systems placed on the market before their compliance dates if you intend to rely on transitional provisions. Document all updates to prove stability.
5. Stay alert to supplementary documents and national enforcement rules.
   Several key documents, including the Code of Practice, post-market monitoring templates, and national penalty frameworks, are expected by early to mid-2026. Track publication dates and be ready to incorporate new requirements as they become available.

Taking action now, based on what is already known and binding under existing law, is the most effective way to reduce exposure to penalties and ensure future flexibility under the EU AI Act.