.svg){kind=icon}
.svg){kind=icon}
What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive regulation of artificial intelligence. It entered into force in August 2024 and will become fully applicable in phases by 2027. Objective: Safety, fundamental rights, and trust in AI applications within the EU.
The approach is risk-based: AI systems are classified into four categories—ranging from unacceptable risk (prohibited) to high-risk AI (subject to strict requirements), transparency obligations, and minimal risk (freely usable).
The EU AI Act applies to both providers (who develop or place AI systems on the market) and operators (who use AI in their businesses). For small and medium-sized enterprises, this means that almost every company is affected as soon as it uses AI in a productive capacity.
Important: The EU AI Act does not replace the GDPR. It supplements it with AI-specific requirements such as training data governance, risk analysis, monitoring, and transparency toward users.
Best Practices for Implementing the AI Act
Based on prodot projects preparing for the AI Act, six principles have proven effective in making the difference between panic and planning:
- Take stock: First, identify which AI systems are in use—including “shadow AI” such as the use of ChatGPT in Teams.
- Classify risks: Determine the AI Act class for each system—high risk or subject to transparency requirements?
- Establish governance: Document roles, approvals, and responsibilities—integrated with GDPR and IT compliance.
- Train in AI literacy: Employees who use AI must understand how to handle it—mandatory starting in February 2025.
- Set up monitoring: Continuously measure and document hallucinations, bias, and drift.
- New Vendor Standard: Contractually require AI-Act compliance for AI acquisitions.
Common Mistakes in AI Act Preparation
In many companies, preparations for the AI Act are just getting underway. We see these mistakes time and time again—and they’re avoidable:
- Starting too late: If you wait until August 2026, you won’t have enough time to establish robust processes—especially for high-risk AI.
- Ignoring “shadow AI”: Individual use of ChatGPT by employees is covered by the AI Act—but is rarely tracked.
- Treating it as an IT-only issue: The EU AI Act is a compliance, HR, legal, and business issue—not just an IT one.
- No classification: If you don’t know whether a system is high-risk, you can’t fulfill your obligations.
- Forgetting the GDPR: The AI Act and the GDPR are intertwined—separate silos lead to duplicate work and gaps.
EU AI Act vs. GDPR vs. ISO 42001
Three sets of regulations—which together form the compliance framework for AI in Europe:
- EU AI Act: Regulatory, mandatory. Focus: Safety and fundamental rights in AI systems.
- GDPR: Regulatory, mandatory. Focus: Protection of personal data—applies in addition to the AI Act.
- ISO 42001: Voluntary certification. Management system standard for AI—useful as a framework for demonstrating compliance with the AI Act.
EU AI Act: Setting the Course Now
In a free initial consultation, we’ll work with you to assess the extent to which your company is affected by the EU AI Act—and identify the areas requiring the most urgent action.
As an AI partner for small and medium-sized businesses, we’ll guide you through the entire process—from conducting an initial assessment and classification to ensuring your AI systems operate in compliance with regulations.
What We Offer
- AI Readiness Check — a quick assessment of your current systems, classification, and areas requiring action.
- AI Monitoring — Ongoing quality and compliance measurement of your AI systems.
- AI Literacy Training — Mandatory component for employees starting in February 2025.
- AI Strategy Guide — free download from the media library.
