Compliance walkthrough
How to comply with the EU AI Act: video walkthrough
A walkthrough of preparing for the EU AI Act: knowing your AI systems, your role for each and what the Act requires of them.
Key takeaways
- The EU AI Act regulates AI by risk tier and by your role for each system.
- Start with an inventory of every AI system, including AI inside purchased software.
- High-risk systems need documented controls, human oversight and a conformity assessment.
- There is no general AI Act certificate; high-risk systems carry a CE mark.
- Obligations apply in stages, so record the dates for each tier.
Risk-based rules for AI in the EU
The Artificial Intelligence Act, Regulation (EU) 2024/1689, is the European Union's horizontal law on AI. It regulates by risk: a short list of practices is banned; AI used in sensitive areas such as hiring, credit, education, essential services, biometrics and critical infrastructure, or built into regulated products, is high-risk and must meet detailed requirements before and after reaching the market; certain systems owe people transparency; and providers of general-purpose AI models carry duties of their own.
Obligations follow an organisation's role for each system, chiefly provider or deployer, and reach providers placing AI on the EU market from anywhere and organisations abroad whose system's output is used in the EU. No general AI Act certificate exists. This short film walks through how organisations prepare.
Know the systems, build the controls, show conformity
Start by mapping the AI, the roles and what applies: list every AI system the organisation develops, sells, embeds or uses, including inside purchased software; record its role for each; and classify each system's tier, whether prohibited, high-risk, subject to transparency duties or a general-purpose model. The Act applies in stages, so the dates for each tier are recorded too.
For high-risk systems, the requirements are built into governance and documentation: risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, and quality management for providers. Deployers have their own duties, such as using systems as instructed and assigning human oversight. High-risk systems pass a conformity assessment, usually the provider's internal control, then carry the provider's EU declaration of conformity and CE mark. Evidence is kept as the systems run, and internal audit checks it.
Sterling's expert and experienced consultants carry the AI inventory, classification, governance, documentation and evidence with your teams under Sterling OS™. Authorities and customers' assessors judge the result, and legal readings stay with your legal advisers. ISO/IEC 42001 can provide the management system around this work, but it is not an AI Act certificate.
EU AI Act at a glance
- Purpose
- Risk-based rules for AI in the EU: banned practices, strict requirements for high-risk systems, transparency duties and obligations for general-purpose AI models
- Relevant to
- Providers, deployers, importers and distributors of AI on the EU market, general-purpose AI model providers, and organisations abroad whose AI output is used in the EU
- Edition
- Regulation (EU) 2024/1689, in force since 1 August 2024 and applying in stages, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026
- Certification
- No general AI Act certificate exists. High-risk systems pass a conformity assessment, usually the provider's internal control, then carry the provider's EU declaration of conformity and CE mark
- Sterling's role
- AI inventory and classification, governance, documentation and evidence with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for an EU AI Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 10 months
EU AI Act: questions people ask
Is there an EU AI Act certification?
Not for most AI; the Act has no general certificate or seal. A high-risk provider shows conformity by the Article 43 route, usually internal control, then signs the EU declaration of conformity and affixes the CE mark. Notified bodies issue certificates only for certain biometric systems under Annex VII and for AI in products whose own legislation requires third-party assessment. Any other "AI Act certificate" is marketing.
Have the high-risk deadlines moved?
Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, set 2 December 2027 for Annex III high-risk systems and 2 August 2028 for AI in Annex I products, replacing 2 August 2026 and 2 August 2027. The original bans, AI literacy and general-purpose AI rules were not delayed, and transparency duties apply from 2 August 2026.
We are outside the EU. Does the Act apply to us?
It can. It covers providers placing AI systems or general-purpose models on the EU market from anywhere, and providers and deployers abroad whose AI output is used in the Union. A non-EU provider of a high-risk system first appoints an authorised representative in the Union by written mandate.
We only use AI tools such as chatbots and copilots. What applies?
As a deployer you take AI literacy measures, avoid prohibited uses and meet Article 50 where it applies, such as disclosing deep fakes. Using AI for an Annex III purpose, such as screening applicants, brings the high-risk deployer duties from 2 December 2027; rebranding, substantially modifying or repurposing a system into high-risk use makes you its provider.
Is ISO/IEC 42001 certification enough for the AI Act?
No. ISO/IEC 42001 is a voluntary, certifiable management system standard, not a harmonised standard under the Act, and the Commission has said its goals and definitions are not aligned with the Act's quality management system. EN 18286:2026 was written for Article 17, but gives a presumption of conformity only once its reference is published in the Official Journal. An AI management system is still a strong base for the governance the Act draws on.
Keep exploring
Related to this video
The complete guide
Everything on EU AI Act
Start with the EU AI Act page, or go straight to the guide you need.
On the EU AI Act page
- What are the main EU AI Act requirements?
- How do you become EU AI Act compliant?
- How much does EU AI Act compliance cost?
- How long does EU AI Act compliance take?
- Who needs to comply with the EU AI Act?
- How EU AI Act compliance supports trust, sales and control
- Frequently asked questions about the EU AI Act
Guides
Talk to a consultant
Plan your EU AI Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice