EU AI Act: what it asks, and where it lands in your management system.

The EU AI Act is the first comprehensive horizontal AI law. It sorts AI by risk: prohibited practices, high-risk systems, transparency duties for systems that interact with people or generate content, and minimal risk, where nothing is asked. It assigns duties by role. The provider has to build the system right and the deployer has to use it right, and Article 25 moves the line: a deployer that puts its own name on a high-risk system, substantially modifies it, or changes its intended purpose so that it becomes high-risk takes on the provider's duties. The Act reaches organizations outside the EU whose systems are used in the EU. Penalties reach up to 7% of global turnover for the most serious breaches.

The obligations apply in stages. Prohibited practices and the AI-literacy duty have applied since 2 February 2025; after the Digital Omnibus on AI, literacy is a duty to support staff's AI literacy, not to guarantee it. The general-purpose AI obligations have applied since 2 August 2025 and have been enforceable since 2 August 2026, alongside the Article 50 transparency duties. The high-risk obligations of Chapter III apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in regulated products under Annex I. Those are application dates, moved by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which left the requirements themselves largely as they were.

That timetable is the reason to start rather than the reason to wait. Inventory, classification, data governance, logging and oversight take longer to design and build than the runway allows, and the supervision machinery, the notified bodies and the standards are already in motion. The full timetable, the roles, and who supervises you in the DACH region and in Canada are on the map.

Which AI systems do you run, bought or built? In which processes? In which role: provider, deployer, or both? In which tier? Nothing in the Act can be answered before that. An inventory also catches the systems that never arrived as AI: a feature switched on in a platform, a model inside a supplier's product, an assistant a team adopted on its own.

This is the first output of Process & AI Mapping: the AI systems in the connected model, each with its process, its data, its owner and a classification. Everything below starts from it.

The effort tends to go into reading clauses, writing policies and waiting for the harmonised standards. Each is understandable, and none of them produces evidence that a system meets a requirement.

It should go into four things. The inventory and the classification, because every other obligation is scoped by them. The controls where they can be enforced, in the systems, rather than asserted in a document. The evidence trail per system, since conformity is shown per system and not per organization. And the management system you already run, extended rather than duplicated.

On the standards: EN 18286, the harmonised standard for the Article 17 quality management system, was cited in the Official Journal on 14 October 2026. The rest, on risk management, logging, cybersecurity, bias, datasets and conformity assessment, are still drafts, expected in 2027. The obligations apply regardless of when their standards arrive.

The EU AI Act is a regulation the practice applies. No certification of conformity with the Act exists for an organization, and we claim none. Professional certifications on the Act, such as PECB’s Certified EU AI Governance Professional, attest a person’s competence; what we hold is on the About page, stated with its grade.

The record is enterprise architecture and controls in operational systems, and the qualifications on the About page, stated there with their grades.