What is the AI Act?
What is the AI Act?
The European regulation on artificial intelligence explained to IT and EA decision-makers
The European regulation on artificial intelligence explained to IT and EA decision-makers
As the world's first regulatory framework dedicated to artificial intelligence, the European AI Regulation redefines the rules of the game for all companies that develop, deploy, or use AI systems in the European Union.
As the world's first regulatory framework dedicated to artificial intelligence, the European AI Regulation redefines the rules of the game for all companies that develop, deploy, or use AI systems in the European Union.
What you'll find
What you'll find
in this guide
in this guide
This guide covers six key chapters: the context and goals of the regulation, its scope, implications for your organization, a timeline of requirements, risk classification, and a 7-step action plan. Here’s what you need to know to establish the framework; the rest is in the guide.
This guide covers six key chapters: the context and goals of the regulation, its scope, implications for your organization, a timeline of requirements, risk classification, and a 7-step action plan. Here’s what you need to know to establish the framework; the rest is in the guide.
What is the AI Act and what are its goals?
What is the AI Act and what are its goals?
Adopted by the European Parliament on June 13, 2024, and published in the Official Journal of the European Union on July 12, 2024, the AI Act (or Artificial Intelligence Act) entered into force on August 1, 2024. It is the first European regulation dedicated to governing the use of AI.
The AI Act has two main objectives: ensuring the safety and protection of the fundamental rights of people exposed to AI systems, while preserving Europe's competitiveness and technological innovation in a global context.
This regulation, designed to make artificial intelligence in Europe trustworthy, is built on a trust-based approach. It does not aim to ban AI, but to govern its uses according to their level of risk.
Its scope extends beyond the borders of the Union: any organization whose AI systems affect users located in Europe is subject to it, regardless of its geographic location. The text is published and available on EUR-Lex, the European Union's law portal.
To understand how this text relates to the GDPR, check out our post on the AI Governance Act and GDPR.
The difference between the AI Act and the GDPR
The GDPR governs the processing of personal data at the company level. The AI Act applies system by system, use case by use case. As a result, the same organization can have very different obligations depending on the tools it deploys.
The two regulations overlap as soon as an AI system processes personal data. Data protection remains governed by the GDPR; transparency and trust in AI systems fall under the AI Act.
The AI Act also includes provisions on copyright applicable to generative AI models.
If your organization is already GDPR-compliant, your records of processing activities provide a reusable foundation for the AI Act, but they are not sufficient on their own.
Ce qui distingue l'AI Act
The GDPR governs the processing of personal data at the company level. The AI Act applies system by system, use case by use case. As a result, the same organization can have very different obligations depending on the tools it deploys.
The two regulations overlap as soon as an AI system processes personal data. Data protection remains governed by the GDPR; transparency and trust in AI systems fall under the AI Act.
The AI Act also includes provisions on copyright applicable to generative AI models.
If your organization is already GDPR-compliant, your records of processing activities provide a reusable foundation for the AI Act, but they are not sufficient on their own.
Which organizations are concerned?
Which organizations are concerned?
Supplier
Develops or markets an AI system
Develops or markets an AI system
Is responsible for the compliance of its system throughout its lifecycle. Obligations for providers include technical documentation, training data quality requirements, and registration with the relevant national authorities.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Deployer
Uses an AI system in a professional context
Uses an AI system in a professional context
Including through a third-party SaaS tool. The requirements for deploying companies cover risk assessment, technical documentation, and human oversight. This includes machine learning tools integrated into existing products or services.
Governance only works when people truly understand each other. Smoteo doesn’t impose a predefined model: we adapt to your reality, your frameworks, your processes and your language. By fitting naturally into your environment, Smoteo creates alignment across teams, regardless of your maturity level.
Importer / Distributor
Sells AI solutions (developed outside of the EU)
Sells AI solutions (developed outside of the EU)
This is a common scenario for IT departments that integrate language models developed outside the European Union. The GPAI requirements have been in effect since August 2025.
Innovation never stops - but value only emerges when organizations are ready. Smoteo helps you build foundations today to capture tomorrow’s value. With clear governance and trusted information, uncertainty becomes opportunity.
Please note the IT department cannot delegate its AI Act compliance responsibilities to its vendors. Even when purchasing a third-party solution, it remains responsible for its deployment, from risk assessment to human oversight.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Is your organization ready for the AI Act?
Is your organization ready for the AI Act?
Our practical guide details the specific steps each type of entity (supplier, deployer, importer) needs to take, and includes an actionable checklist to ensure nothing is overlooked.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
What are the challenges of the AI Act for organizations?
What are the challenges of the AI Act for organizations?
The impact of the AI Act goes well beyond regulatory compliance. It exposes a governance problem that many organizations already know all too well: AI is being deployed faster than the ability to oversee it.
In practical terms, the AI Act raises three key challenges for businesses.
A visibility challenge: most organizations don't know exactly which AI systems are operating within their IT ecosystem, on what data, or with what level of decision-making autonomy.
An accountability challenge: the European regulation introduces an explicit accountability logic, system by system.
A competitiveness challenge: organizations that structure their regulatory framework today are building a lasting advantage in the development and use of AI. Compliant companies will notably benefit from better access to public markets and European tenders.
70 %
70 %
of leaders believe business units are adopting more SaaS applications than IT they are aware of.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
The questions every CIO must be able to answer
The questions every CIO must be able to answer
What AI use cases are active in my IT ecosystem?
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
On what data? With what level of autonomy?
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Who is responsible for them within the organization?
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Are they supervised by humans, and how?
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Is their storage environment and cybersecurity setup documented?
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
When does the AI Act come into effect? The full timeline of obligations
When does the AI Act come into effect? The full timeline of obligations
The implementation of the AI regulation is progressive. The AI Act timeline rolls out in successive waves through December 2027. This gradual approach is an opportunity - as long as it isn't mistaken for extra time to do nothing.
The steps of mapping, qualifying AI systems, and setting up technical documentation take an average of 4 to 6 months in a structured organization.
Organizations that start now will reach compliance with confidence. Those that wait will risk a last-minute scramble.
Organizations that start now will reach compliance with confidence. Those that wait will risk a last-minute scramble.
August 1st, 2024
Entry into force
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
The regulation becomes law across the entire European Union.
The regulation becomes law across the entire European Union.
February 2nd, 2025
Unacceptable risk prohibitions (Art. 5)
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Social scoring, subliminal manipulation, facial recognition in public spaces: banned. AI literacy obligation applicable.
Social scoring, subliminal manipulation, facial recognition in public spaces: banned. AI literacy obligation applicable.
August 2nd, 2025
GPAI obligations - general-purpose models
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Verify and contractually formalize supplier compliance (OpenAI, Google, Mistral, Anthropic...). These obligations are also tied to the transparency requirements set out for general-purpose AI models.
Verify and contractually formalize supplier compliance (OpenAI, Google, Mistral, Anthropic...). These obligations are also tied to the transparency requirements set out for general-purpose AI models.
August 2nd, 2026
Full applicability - transparency (Art. 50)
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Any user interacting with a chatbot or AI assistant must be informed of it. This measure applies to all digital services and products deployed within the territory of the Union.
Any user interacting with a chatbot or AI assistant must be informed of it. This measure applies to all digital services and products deployed within the territory of the Union.
December 2nd, 2026
Watermarking of synthetic content
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Images, videos, and AI-generated audio: mandatory labeling.
Images, videos, and AI-generated audio: mandatory labeling.
December 2nd, 2027
Standalone high-risk systems (Annex III)
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Full compliance. Penalties: up to €15 million or 3% of global annual turnover.
Full compliance. Penalties: up to €15 million or 3% of global annual turnover.
Ready for every deadline?
Ready for every deadline?
This timeline tells you when to act. Our guide tells you how — with, for each deadline, a list of concrete actions to take, documents to produce, and the most common interpretation mistakes observed in the field.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
What risks does the AI Act cover? The 4 risk levels explained
What risks does the AI Act cover? The 4 risk levels explained
The AI Act tailors requirements based on the risk level of each use case: an approach based on proportionality, not a one-size-fits-all regulation. Identifying the correct category is the first operational requirement.
Unacceptable risk: banned since Feb. 2025
Focus on What Matters
Social scoring, subliminal manipulation, facial recognition in public spaces
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Uses purely prohibited under Article 5 of the regulation. Unacceptable risk directly concerns few companies, but certain behavioral profiling or surveillance systems can come closer to this category than it first appears. It's necessary to review all your AI-related activities, including ongoing experiments.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
High risk: the core of the obligations (Annex III)
Focus on What Matters
Resume screening, credit scoring, AI-assisted medical diagnosis, critical infrastructure, border control
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
8 domains identified in Annex III of the regulation. High-risk AI systems are subject to a documented risk management system (Art. 9), compliant technical documentation, human oversight built in by design (Art. 14), and CE marking. Penalties: up to €15 million or 3% of global annual turnover.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Limited risk: transparency obligation
Focus on What Matters
Chatbots, AI assistants, deepfakes, generative content
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
No heavy documentation requirements, but a strong transparency obligation starting August 2, 2026: any user interacting with an AI system must be informed of it. Watermarking of synthetic content comes into force in December 2026.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Minimal risk: no specific obligation
Focus on What Matters
Anti-spam filters, AI in video games, non-decisional recommendations
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Voluntary codes of conduct encouraged. Some caution is still warranted: a recommendation tool that influences an HR or business decision can shift into a different category.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Remember: you're not classifying software, but use cases.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Traceability of the qualification process is in itself a compliance requirement. Documenting why a system was classified in a given category matters as much as the classification itself.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Not sure exactly which AI systems are in use within your IT infrastructure?
Not sure exactly which AI systems are in use within your IT infrastructure?
This is the essential starting point, and it’s primarily a governance issue - not just a matter of regulatory compliance. Our guide details how to conduct this inventory, step by step.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
How to comply with the AI Act? Your 7-step action plan
How to comply with the AI Act? Your 7-step action plan
Complying with the AI Act isn't a one-off project with an end date. It's a capability to build, with the same rigor as a complex project portfolio. For standalone high-risk AI systems, the first four steps take an average of 4 to 6 months in a structured organization.
Here, you'll find the key steps of your action plan.
Here, you'll find the key steps of your action plan.
Want to discover the pitfalls to avoid, the precise variables to document for each system identified, or the elements your Annex IV technical documentation must cover? Head to our full guide.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
1
1
Build the team and set up governance
Build the team and set up governance
Appoint an AI compliance officer with a clear mandate. Form a cross-functional committee: IT, DPO, Legal, Security, business units. This governance must be connected to existing governance bodies (executive committee, IT steering committee) and not remain confined to an isolated administrative unit.
Appoint an AI compliance officer with a clear mandate. Form a cross-functional committee: IT, DPO, Legal, Security, business units. This governance must be connected to existing governance bodies (executive committee, IT steering committee) and not remain confined to an isolated administrative unit.
2
2
Comprehensively map AI systems
Comprehensively map AI systems
Internal systems, SaaS, third-party applications, projects in development. Combine AI audits, business unit surveys, and application portfolio analysis.
Internal systems, SaaS, third-party applications, projects in development. Combine AI audits, business unit surveys, and application portfolio analysis.
3
Qualify the risk level of each use case
Use case by use case. Document and justify each qualification: traceability is in itself a regulatory requirement. Don't forget tools recently adopted by business teams without IT validation.
3
Qualify the risk level of each use case
Use case by use case. Document and justify each qualification: traceability is in itself a regulatory requirement. Don't forget tools recently adopted by business teams without IT validation.
4
Produce the technical documentation (Annex IV)
For each high-risk system, technical documentation is the cornerstone. Any substantial modification triggers a mandatory update. This deliverable must hold up before supervisory authorities: build it as such from the start.
4
Produce the technical documentation (Annex IV)
For each high-risk system, technical documentation is the cornerstone. Any substantial modification triggers a mandatory update. This deliverable must hold up before supervisory authorities: build it as such from the start.
5
5
Implement risk management (Art. 9)
Implement risk management (Art. 9)
Deploy a continuous process, not a one-off assessment. Build on existing IT risk management processes.
Deploy a continuous process, not a one-off assessment. Build on existing IT risk management processes.
6
Formalize human oversight (Art. 14)
Identify who oversees, how often, and according to what criteria. By design, not in post-production.
6
Formalize human oversight (Art. 14)
Identify who oversees, how often, and according to what criteria. By design, not in post-production.
7
Build continuous oversight
Dashboards, regular portfolio reviews, integration into the lifecycle of every new project. A system deployed without prior qualification is a certain regulatory problem. Also include a reporting line on AI compliance within your national and group governance bodies.
7
Build continuous oversight
Dashboards, regular portfolio reviews, integration into the lifecycle of every new project. A system deployed without prior qualification is a certain regulatory problem. Also include a reporting line on AI compliance within your national and group governance bodies.
How to comply with the AI Act?
How to comply with the AI Act?
A 32-page must-read written by experts in IT governance and regulatory compliance. In it, you’ll find, among other things, the mandatory elements of your Annex IV technical documentation, the pillars of operational AI governance, and a comprehensive 20-point compliance checklist.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
How does the AI Act impact organizations beyond compliance?
How does the AI Act impact organizations beyond compliance?
Achieving AI Act compliance isn't a project running parallel to existing IT governance: it builds on it, or it exposes its gaps. Organizations that have already structured their application portfolio start out 6 to 12 months ahead. Investing in an AI governance framework isn't a compliance cost: it's a strategic asset.
It's also, in a context of accelerated digital transformation, a lever of trust with customers, partners, and regulatory authorities.
AI Use Registry
Centralized, continuously updated inventory of all active AI systems by department, including application context, data used, assigned owner, and qualified risk level.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
>80%
>80%
of the IT ecosystem mapped
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
AI Value Stream Map
-30%
reduction in pre-production non-compliance risk
AI Value Stream Map
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
-30%
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Epic Cards & Continuous Oversight
Structured scoping of every AI initiative from the outset. The documentation base for Annex IV, built progressively as scoping happens - not scrambled together under pressure ahead of a regulatory deadline.
-40%
reduction in response time to unforeseen events
Epic Cards & Continuous Oversight
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
-40%
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.
Compliance can't be improvised - it has to be actively managed.
Smoteo brings together everything the AI Act requires in a single platform: usage registry, agent mapping, technical documentation, and continuous oversight.
Compliance can't be improvised - it has to be actively managed.
Smoteo is powerful, but always purposeful: its goal is to do exactly what you need it to do. he platform lets you focus first on your most critical governance challenge - whether it’s Architecture Consistency, Capacity Management, or Portfolio & Product Management. You decide where to begin, to create value where it matters most.