EU AI Act · Regulation (EU) 2024/1689 on artificial intelligence
EU AI Act compliance consulting for AI systems you can classify, document and defend.
Know which of your AI systems the Act reaches, your role for each and what applies from which date, then build the controls and evidence to match. Sterling's expert and experienced consultants screen out prohibited uses, put AI literacy in place and prepare high-risk systems and deployer duties with your product, data, legal and risk teams, in 60+ countries, and stay with you as each deadline arrives. We ensure a successful EU AI Act compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced AI governance consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling prepares the governance, the documentation and the evidence; conformity is assessed under the Act's own procedures and enforced by the market surveillance authorities
8,100+ client engagements in 60+ countries.
EU AI Act client experience
What it is
What is the EU AI Act and what does it require?
The Artificial Intelligence Act, Regulation (EU) 2024/1689, is the European Union's horizontal law on AI. It regulates by risk: a short list of practices is banned; AI used in sensitive areas such as hiring, credit, education, essential services, biometrics and critical infrastructure, or built into regulated products, is high-risk and must meet detailed requirements before and after reaching the market; certain systems owe people transparency; and providers of general-purpose AI models carry duties of their own. Obligations follow your role for each system, chiefly provider or deployer, and reach providers placing AI on the EU market from anywhere and providers and deployers abroad whose system's output is used in the EU.
For most AI there is no certificate to obtain: an Annex III high-risk provider usually shows conformity through internal control (Annex VI), and a notified body takes part only for certain biometric systems and, for AI in Annex I products, through the product's own assessment. Market surveillance authorities enforce the rules, the AI Office supervises general-purpose AI models, and Article 99 fines reach €35 million or 7% of total worldwide annual turnover, whichever is higher, for prohibited practices.
Current text. Regulation (EU) 2024/1689 of 13 June 2024 was published on 12 July 2024 and entered into force on 1 August 2024, applying in stages from 2 February 2025. The Digital Omnibus on AI, proposed on 19 November 2025 and adopted as Regulation (EU) 2026/1744 of 8 July 2026 (Official Journal of 24 July, in force 27 July 2026), moved the high-risk rules to 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products, added bans on AI that generates non-consensual intimate imagery or child sexual abuse material from 2 December 2026, gave generative systems already on the market until that date to mark synthetic content, and recast the AI literacy duty.
Who it is for
Who needs to comply with the EU AI Act?
The bans and AI literacy apply to all providers and deployers, so almost every organisation using AI has some obligation; the rest depends on tier and role. You become the provider of a high-risk system by developing and marketing it under your name, and also by putting your brand on someone else's, substantially modifying one or turning a general-purpose system to a high-risk purpose (Article 25). Four starting points bring organisations to Sterling:
- You build or sell AI that reaches the EU. A SaaS feature, a model behind an API or a scoring engine offered to European clients makes you a provider: for a high-risk system, the technical file, quality system and conformity assessment and, from outside the Union, an authorised representative inside it by written mandate (Article 22).
- You use AI in decisions about people. Screening job applicants, monitoring workers' performance, scoring credit, pricing life or health insurance and assessing eligibility for public benefits are Annex III uses. Deployers owe oversight, log retention, information to workers and affected people and, in some cases, a fundamental rights impact assessment; a BPO running such tools for EU clients is caught when the output is used in the EU.
- Your product carries a CE mark and contains AI. AI that is, or is a safety component of, a medical device, in vitro diagnostic, radio equipment, lift or pressure equipment is high-risk where the product needs third-party conformity assessment, and meets the Act through that assessment, with one technical file, from 2 August 2028.
- A customer, investor or board wants to know your AI exposure. Procurement questionnaires now ask for an AI inventory, a prohibited-practice screen, literacy evidence and transparency notices. One governed record answers them all.
Business benefits
How EU AI Act compliance supports trust, sales and control
Authorities enforce the Act, but most organisations first meet it through customers and staff: a procurement team asking for an AI inventory, a works council asking about monitoring software, a distributor asking for the declaration of conformity.
- A clear map of your AIEvery system with its owner, your role, its tier and dates, including AI inside purchased software and tools staff use.
- Prohibited uses caught earlyEach system screened against Article 5 before launch, not a banned practice found through a complaint.
- High-risk systems ready for the marketRisk files, logging, instructions and oversight designed in, so conformity, declaration and CE mark follow from work already done.
- Decisions about people you can explainOversight by competent staff, logs kept, people informed and explanations available under Article 86.
- Procurement answered from one recordAI questionnaires answered from one inventory and evidence base, so governance questions stop holding up sales.
- One model for several regimesThe AI Act, the GDPR, ISO/IEC 42001 and the NIST AI RMF on one set of roles, assessments and records.
Track a few numbers: systems classified, high-risk systems with a complete technical file, oversight staff trained, incidents decided on time. Page counts measure paperwork, not control.
Requirements
What are the main EU AI Act requirements?
Obligations depend on a system's tier and your role for it. The first table shows the tiers and when each starts; the second maps the high-risk requirements to practice. Legal readings are for your legal advisers.
| Tier | What the Act requires | Applies from |
|---|---|---|
| Art. 5 Prohibited practices | No AI for harmful manipulation or deception, exploiting vulnerabilities, social scoring, predicting crime solely from profiling, untargeted facial-image scraping, emotion recognition at work or in education (medical and safety uses aside), biometric categorisation to infer sensitive traits, or real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions | 2 February 2025; bans on non-consensual intimate imagery and child sexual abuse material from 2 December 2026 |
| Art. 6(2), Annex III · High-risk by use | Biometrics, critical infrastructure, education, employment and worker management, essential private and public services (such as credit scoring and life and health insurance pricing), law enforcement, migration and border control, justice and democratic processes; Article 6(3) exempts systems posing no significant risk, never those profiling people | 2 December 2027 (was 2 August 2026) |
| Art. 6(1), Annex I · High-risk in products | AI that is a product, or a safety component of one, under Annex I legislation such as that on medical devices, in vitro diagnostics, radio equipment, lifts or pressure equipment, where the product needs third-party conformity assessment | 2 August 2028 (was 2 August 2027) |
| Art. 50 Transparency | Tell people they are dealing with AI unless obvious; mark synthetic audio, images, video and text in a machine-readable, detectable way; inform people exposed to emotion recognition or biometric categorisation; disclose deep fakes, and AI-generated text on public-interest matters unless under human editorial control | 2 August 2026; marking by generative systems already on the market from 2 December 2026 |
| Art. 51 to 55 General-purpose AI models | Documentation for the AI Office and downstream providers, a copyright policy and a public training-content summary; with systemic risk, presumed above 1025 floating-point operations of training compute, also adversarial testing, risk mitigation, incident reporting and cybersecurity | 2 August 2025; models already on the market by 2 August 2027 |
| Art. 4 AI literacy | Providers and deployers take measures to support the AI literacy of staff and others operating or using AI for them; minimal-risk AI carries no further specific duty unless Article 50 applies | 2 February 2025, reworded in July 2026 |
High-risk requirements, article by article
| Article | What it requires of you | What it looks like in practice |
|---|---|---|
| Art. 9 Risk management system | A continuous, iterative lifecycle process: identify and evaluate known and reasonably foreseeable risks to health, safety and fundamental rights, including under foreseeable misuse and from post-market data; adopt targeted measures; test against predefined metrics and probabilistic thresholds | A risk file per system with misuse scenarios, measures, test results and the residual-risk decision |
| Art. 10 Data and data governance | Governed training, validation and test data: origin, preparation, assumptions, bias examination and mitigation, gaps; data relevant, sufficiently representative and, as far as possible, free of errors and complete | A data sheet per data set: provenance, labelling, bias checks, gaps and the model version it trained |
| Art. 11 and 12 Technical documentation and record-keeping | Annex IV documentation drawn up before release and kept current, one file with the product's under Annex I; automatic event logging over the system's lifetime | A versioned technical file kept for ten years, and a logging specification |
| Art. 13 and 14 Information to deployers and human oversight | Instructions for use covering purpose, accuracy, limits, risks, oversight and logs; a design that lets competent people understand the system, resist automation bias, override its output and stop it | Usable instructions, oversight measures per system, override and stop functions tested |
| Art. 15 Accuracy, robustness and cybersecurity | Declared accuracy, resilience to errors and faults, limits on biased feedback loops, resistance to data or model poisoning, adversarial examples and confidentiality attacks | Accuracy metrics, robustness and fail-safe tests, AI-specific security testing |
| Art. 17 Quality management system | Thirteen documented aspects, from compliance strategy, design and testing to data, risk, post-market monitoring, incident reporting, records, resources and accountability, proportionate to the provider's size | Procedures and records per aspect, inside an existing sector quality system where there is one; EN 18286:2026 was written for this article |
| Art. 16, 43 and 47 to 49 Conformity, declaration, CE mark, registration | Before market placement: internal control (Annex VI), or Annex VII with a notified body where required; the EU declaration of conformity; the CE mark; registration of most Annex III systems in the EU database; a new assessment after any substantial modification | A conformity file with the assessment record, the signed declaration and the registration entry |
| Art. 26 and 27 Deployer obligations | Use as instructed; oversight by people with competence, training and authority; relevant input data; monitoring and incident reporting; logs kept at least six months; workers and affected people informed; a fundamental rights impact assessment before first use for public-law bodies, private providers of public services and deployers of credit-scoring or life and health insurance pricing systems | A procedure per system, trained overseers, log settings, notices, and impact assessments notified to the authority alongside the DPIA |
| Art. 72 and 73 Post-market monitoring and serious incidents | A monitoring plan in the technical documentation; serious incidents reported to the market surveillance authority within 15 days of awareness, 10 days after a death, 2 days for a widespread infringement or serious and irreversible disruption of critical infrastructure | An incident procedure with the clocks built in and a register recording each reportability decision |
What does useful EU AI Act evidence look like?
An inventory giving every system an owner, role, tier and reasoning; an Article 5 screen; literacy records; for high-risk systems, the risk file, data sheets, Annex IV file, logging specification, instructions, oversight tests, quality system and conformity record; for deployers, oversight assignments, log settings, notices and impact assessments. We build them from your real systems and keep them in Effivity from the first workshop.
EU AI Act requirements explained, article by articleCompliance process
How do you become EU AI Act compliant?
Know the systems, build the controls, operate them, then demonstrate conformity by the route the Act sets. Sterling prepares the governance, documentation and evidence with your teams; conformity follows the Act's own procedures, and authorities and customers' assessors judge the result.
- 01Map the AI, the roles and what applies.List every AI system you develop, sell, embed or use, including inside purchased software; record your role, its tier under Articles 5, 6 and 50 or as a general-purpose model, and when each obligation starts.
- 02Gap analysis: test each system against the obligations that apply to it.The gap analysis compares practice, documentation and contracts with the relevant articles, keeps what works, such as an ISO/IEC 42001 system or GDPR assessments, and agrees actions, owners and dates.
- 03Build the controls and the file, and put them to work.Risk management, data governance, documentation, logging, instructions, oversight and the quality system for high-risk systems; deployer procedures, impact assessments, notices and literacy everywhere.
- 04Audit, review and close the findings.An internal audit, a management review and a mock conformity assessment of each high-risk system find the gaps before an authority does; we raise findings first and close them with evidence.
- 05Complete the conformity assessment and the external reviews.Providers complete internal control or the notified-body route, sign the declaration, affix the CE mark and register; deployers notify impact assessments where required; customer and regulator requests draw on evidence in place.
- 06Monitor, report and reassess.Post-market monitoring, log review, incident decisions on the Article 73 clocks, reassessment after substantial modification, literacy for new staff and a watch on guidelines, standards and amendments.
Judge an offer by what it leaves behind, not by its badge: the Act provides for certificates only from notified bodies in specific high-risk routes. Ask who classifies your systems, whose name goes on the declaration, what your people will learn and where the evidence will live. How to choose a credible EU AI Act provider · The certification buyer's checklist
Cost
How much does EU AI Act compliance cost?
Cost follows the number of AI systems, your role for each and their tier: a company using a chatbot and a copilot needs literacy, transparency and an inventory; a provider of a hiring or credit-scoring model needs a quality system, a technical file and a conformity assessment. What never varies in a Sterling proposal: every component visible, one fee fixed.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | AI systems in scope, roles and tiers, what already exists, entities and countries, and how much of the work your team takes on (Design™ or Drive™) |
| Conformity assessment and testing | Internal control costs time, not fees; a notified body is paid only where Annex VII or product legislation requires one; accuracy, robustness, bias and security testing shown separately |
| Internal resources and legal | Time from product, engineering, data, HR and risk teams; design changes for logging or oversight; legal review; an authorised representative for non-EU providers |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Monitoring and incident reviews, reassessment of changed systems, internal audits, regulatory watch and refreshers under Sustain™ |
What moves the price
- How many AI systems exist, and how many are high-risk
- Provider, deployer or both, and whether you modify or rebrand others' AI
- Models built in-house, fine-tuned from open models or supplied by general-purpose model providers
- Whether ISO/IEC 42001, ISO/IEC 27001 or a GDPR programme already runs
- The binding date: 2 December 2026, 2 December 2027, 2 August 2028 or a customer's deadline
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Notified body, testing and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does EU AI Act compliance take?
Plan on four to ten months. A deployer with a few systems, no high-risk use and an ISO/IEC 42001 or GDPR programme in place sits at the short end; a provider taking a high-risk system through its first conformity assessment sits at the long end, because its files wait on engineering decisions and test results, and logs and monitoring records take time to build. We plan backwards from your binding date, with milestones in Effivity.
| Phase | What determines the pace |
|---|---|
| Inventory, classification and gap analysis | How visible AI use is across departments and suppliers, and access to system owners |
| Build and implementation | Design changes for logging and oversight, testing cycles, supplier contracts, approvals and internal capacity |
| Evidence and review | Logs, oversight and monitoring records accumulating, assessments signed off, then internal audit and management review |
| Conformity assessment, regulator or customer review | Internal control or a notified body's schedule, registration, and the timing of customer or regulator reviews |
If a customer date, a launch or an Act deadline drives the work, bring it to the first call; we will say what can be ready. The high-risk dates have moved once already; a plan that depends on them moving again is not a plan.
Challenges
Common EU AI Act implementation challenges
AI Act programmes tend to stall on the same five problems. Each has a practical answer.
Nobody has a complete list of the AI in use.
We build the inventory with each department and procurement: models you develop, AI inside purchased software, tools staff use and AI suppliers run on your data, each with an owner, a role and a tier, the reasoning recorded.
Nobody is sure whether you are the provider or the deployer.
Roles are decided per system, and they move: your brand on another company's high-risk system, a substantial modification or a new high-risk purpose makes you the provider (Article 25). We record each role, what would change it and who is contractually responsible.
The model comes from someone else.
Many high-risk systems sit on third-party models. General-purpose model providers owe downstream providers the information in Annex XII; we specify what to request, record what arrived and document how your testing covers the rest.
The harmonised standards are not finished.
EN 18286:2026, for the quality management system, is published; the other standards are still in development, and presumption of conformity begins only when a reference appears in the Official Journal. We build to the Act's text now, using ISO/IEC 42001, ISO/IEC 23894 and the published standard as method, and align as references are cited.
The AI Act and the GDPR pull on the same data and the same people.
One assessment path serves both: the fundamental rights impact assessment complements the DPIA, deployers use the provider's information for their DPIA, and special-category data for bias detection is processed only exceptionally, under Article 4a safeguards.
Your engagement
What your EU AI Act engagement includes
Your agreed scope brings the inventory, decisions, documents, software, training and internal review together, from one team under one all-inclusive proposal.
Inventory, classification, gap analysis and plan
Every AI system with its role, tier and dates; each obligation tested against practice; actions, owners and deadlines agreed before work starts.
Governance, controls and documentation
AI policy and roles, the Article 5 screen, literacy measures, risk and data files, the Annex IV file, instructions, oversight design, the Article 17 system, deployer procedures and impact assessments, on Sterling's template sets.
Effivity ISO & GRC software
Your programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, system by system, with findings closed with evidence before an authority, a notified body or a client looks.
Conformity and review readiness
Conformity file, declaration, CE marking and registration prepared for providers, notified-body support where needed, and evidence packs for customer and regulator requests.
Conformity is assessed under the Act's own procedures and enforced by the market surveillance authorities. Sterling provides consulting; it does not give legal advice.
How we deliver
How Sterling supports your EU AI Act implementation
Every EU AI Act engagement runs on Sterling OS™, our delivery operating system: five phases with set deliverables, decision owners and evidence. You choose how much work your people carry; the method stays constant.
- 01Design™Guided implementation: your AI, product and compliance leads build the programme with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the inventory, assessments, documentation and conformity preparation.
- 03Sustain™After go-live: monitoring and incident reviews, reassessment of changed systems, the annual internal audit, literacy refreshers and new-hire training.
- 04Automate™The programme in Effivity: inventory, risk and data files, technical documentation, assessments, incidents, training, audits and reviews in one workspace.
- 05Revise™Change in the rules and in your AI: newly cited standards, Commission guidelines and implementing acts, further amendments, new systems and new roles.
The first working week settles who leads, when the team meets, what is delivered and who signs off; later reviews measure progress against those four, so a missing test result surfaces in week five, not in front of an assessor.
How Sterling OS™ worksOften combined with
Standards organisations pair with EU AI Act
- ISO/IEC 23894ISO 23894 AI risk management made practical: the ISO 31000-based guidance, its structure, no certificate, and how Sterling builds it, with a route to ISO 42001.
- ISO/IEC 38507ISO 38507 AI governance and requirements explained: the 2022 guidance for boards on AI use, why no certificate exists and how Sterling puts it into practice.
- ISO/IEC 42001ISO/IEC 42001 certification consulting for AI governance: risks and impacts assessed, treated and evidenced, then supported through the certification audit.
- ISO/IEC 42005ISO 42005 guidance on AI system impact assessment: what ISO/IEC 42005:2025 covers, its structure, how to put it into practice and how Sterling helps.
- ISO/IEC 42006ISO 42006 explained: the requirements for bodies that audit and certify ISO/IEC 42001 AI management systems, how accreditation works and what to check.
- ISO/IEC 5338ISO/IEC 5338 AI life cycle processes explained: the 2023 process groups, what they ask of AI teams, why there is no certificate and how Sterling helps.
Effivity · EU AI Act programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the EU AI Act, Regulation (EU) 2024/1689.
Every Sterling EU AI Act engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Much of the Act is management-system work, so your consultant configures Effivity's registers, document control, risk, audit and action modules within the agreed scope, with every record in one place. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
The AI inventory, with role and tier per system
A register configured for you: each system with its owner, supplier, your role, its Annex III area or Annex I legislation, any Article 6(3) reasoning, and its dates.
Risk files that follow the system's life
Risks to health, safety and fundamental rights per system, misuse scenarios, measures, test results and the residual-risk decision, reviewed on schedule and after change.
Data sets with provenance and checks
A record per training, validation and test set: origin, preparation, representativeness, bias examination and gaps, linked to the model version.
The Annex IV file, versioned and approved
Design, data, testing, oversight and monitoring documents with versions, approvals and ten-year retention, beside the declaration and registration details.
Oversight roles, competence and interventions
Who oversees each system, their training and the overrides, stops and escalations they record: oversight evidenced as practice.
The Article 17 system, aspect by aspect
Each of the thirteen aspects mapped to its procedure, owner and records, with accountability visible to management.
Deployer duties and impact assessments
Checks against the instructions for use, log retention settings, notices to workers and affected people, and impact assessments with their notification record.
Literacy, incidents, audits and review
Literacy records linked to Sterling Academy, a serious-incident register with the 15-, 10- and 2-day clocks, monitoring results, audits and management review; forms adapted without code.
What this means at the audit
An authority, a notified body or a customer's assessor will ask for the inventory and classification reasoning, a sampled technical file, the oversight and logging arrangements, literacy records and the incident register. In Effivity each is a screen with dates, owners and attachments, and Sustain™ keeps it current.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your inventories, registers and records migrated, not retyped
- Admin and user training for your team
- ISMS, QMS and other modules ready when you integrate more standards
EU AI Act client experience
Client letters on file, available on request.
Signed client letters for EU AI Act are available on request. The client feedback wall lists every letter by standard.
Programmes with the EU AI Act in scope
How the Act fits a wider AI governance programme.
- 01Integrated management systems
Technology, BPO and financial services: AI governance, privacy and security as one programme
How a programme of this kind runs: ISO/IEC 42001 supplies the management system (policy, roles, assessments, audit and review); each AI system is mapped to its AI Act role and tier, with the Article 17 quality system, technical file and oversight added for high-risk systems; GDPR DPIAs and fundamental rights impact assessments share one assessment path; ISO/IEC 27001 carries the security controls Article 15 draws on; and questionnaires draw on one evidence base.
Sterling Academy · EU AI Act e-learning
Build AI literacy across the workforce, not just in the data team.
Article 4 asks providers and deployers to support the AI literacy of the people who operate and use their AI. Sterling Academy supplies video lessons with checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- EU AI Act awareness for every employee, the base of the literacy measures Article 4 expects
- Practitioner courses for system owners, oversight staff and assessors
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Completion by department and a training report for any assessor
- New hires trained as they join, so literacy evidence stays current
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about EU AI Act
Watch a video on how to comply with EU AI Act here.
Watch a video on EU AI Act requirements here.
Why Sterling
Want successful EU AI Act compliance? Come to Sterling.
Whether you sell software into Europe, use AI in HR, credit or customer service, or run AI-assisted processes for European clients, Sterling builds one programme that answers the Act system by system.
Governance programmes in 60+ countries since 2003
Management systems for technology firms, BPOs, banks, insurers, manufacturers and public bodies, now applied to AI, with one engagement team accountable wherever your AI runs.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with notified body, testing and legal fees identified separately. No surprises, ever.
Controls that fit how AI is built
Risk files, data sheets, oversight and logging designed with the engineers who run them, so compliance is part of release, not a report written after it.
Expert and experienced consultants
Consultants who have advised on management systems across sectors and countries since 2003 and work from the Act's text, article by article, so the evidence holds when tested.
The Sterling Promise
What our EU AI Act compliance success guarantee means
We stay with you until the agreed EU AI Act outcome is achieved: the inventory complete, each system classified with reasons, controls and documentation operating, high-risk systems ready for conformity assessment and your team able to answer an assessor unaided. Clear explanations, practical delivery, included software and workforce learning make the investment a lasting capability rather than a binder.
The engagement defines the AI systems, roles, scope, outcome and responsibilities. Your organisation supplies accurate information about its systems, data and suppliers and operates the agreed controls. Conformity is assessed under the Act's own procedures and enforced by market surveillance authorities and the AI Office; legal readings are for your legal advisers. Our commitment covers the agreed programme support, not legal advice, a notified body's decision or error-free AI output.
After the programme is in place
What happens after EU AI Act compliance?
The obligations last as long as the systems run: providers monitor performance, report serious incidents on the Article 73 clocks, keep documentation for ten years and reassess after substantial modification; deployers keep logs, oversight and notices current; and the rules move as standards are cited and guidelines issued.
Sterling OS™ Sustain™ runs that cycle with you: periodic inventory reviews, change screening for retrained or repurposed systems, incident and monitoring reviews, the annual internal audit, literacy refreshers and a regulatory watch, so the programme matches the AI in production.
FAQs
Frequently asked questions about the EU AI Act
Is there an EU AI Act certification?
Not for most AI; the Act has no general certificate or seal. A high-risk provider shows conformity by the Article 43 route, usually internal control, then signs the EU declaration of conformity and affixes the CE mark. Notified bodies issue certificates only for certain biometric systems under Annex VII and for AI in products whose own legislation requires third-party assessment. Any other "AI Act certificate" is marketing.
Have the high-risk deadlines moved?
Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, set 2 December 2027 for Annex III high-risk systems and 2 August 2028 for AI in Annex I products, replacing 2 August 2026 and 2 August 2027. The original bans, AI literacy and general-purpose AI rules were not delayed, and transparency duties apply from 2 August 2026.
We are outside the EU. Does the Act apply to us?
It can. It covers providers placing AI systems or general-purpose models on the EU market from anywhere, and providers and deployers abroad whose AI output is used in the Union. A non-EU provider of a high-risk system first appoints an authorised representative in the Union by written mandate.
We only use AI tools such as chatbots and copilots. What applies?
As a deployer you take AI literacy measures, avoid prohibited uses and meet Article 50 where it applies, such as disclosing deep fakes. Using AI for an Annex III purpose, such as screening applicants, brings the high-risk deployer duties from 2 December 2027; rebranding, substantially modifying or repurposing a system into high-risk use makes you its provider.
Is ISO/IEC 42001 certification enough for the AI Act?
No. ISO/IEC 42001 is a voluntary, certifiable management system standard, not a harmonised standard under the Act, and the Commission has said its goals and definitions are not aligned with the Act's quality management system. EN 18286:2026 was written for Article 17, but gives a presumption of conformity only once its reference is published in the Official Journal. An AI management system is still a strong base for the governance the Act draws on.
What are the penalties?
Article 99 caps fines at €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for most operator and transparency obligations, and €7.5 million or 1% for misleading information to authorities, whichever is higher; for SMEs and start-ups, whichever is lower. The Commission can separately fine general-purpose AI model providers up to 3% or €15 million, whichever is higher.
How do we know whether an AI system is high-risk?
Two routes. Under Article 6(1), AI that is a product or a safety component under Annex I legislation is high-risk when the product needs third-party conformity assessment. Under Article 6(2), AI used for an Annex III purpose is high-risk unless Article 6(3) applies because it poses no significant risk, as with a narrow procedural task; systems that profile people always are. Record the reasoning before release.
Does Sterling give legal advice or act as a notified body?
No. Sterling builds the inventory, controls, documentation and evidence with your teams and trains your people. Legal interpretation sits with your legal advisers, and Sterling is neither a notified body nor an authorised representative.
What do you need to prepare an EU AI Act proposal?
The AI systems involved, whether you develop, sell, embed or use each, the countries and entities, whether any touches an Annex III area or a CE-marked product, what exists today, and your date. From that we can scope an all-inclusive proposal; the inventory need not be complete.
Before the first call
Prepare a useful EU AI Act readiness brief
No finished AI inventory is needed before the first discussion. Seven questions cover it:
- What prompted this: a customer questionnaire, a contract clause, an EU product launch, a regulator's letter or a board question?
- Which AI systems do you develop, sell, embed in products or use, and for which are you the provider, the deployer, or both?
- Does any of them support decisions on hiring, staff management, credit, insurance, education, public services or biometric identification?
- Is AI part of a product you place on the EU market with a CE mark, such as a medical device or radio equipment?
- Where do the models come from: in-house, open-source or a general-purpose model provider, and what documentation do you hold?
- What exists already: ISO/IEC 42001 or ISO/IEC 27001, GDPR DPIAs, AI literacy training, model documentation?
- Which date binds you: 2 December 2026, 2 December 2027, 2 August 2028 or a customer's deadline?
These answers set the scope and a realistic all-inclusive proposal. They prepare a conversation; they are not a classification decision or legal advice.
Don’t be fooled by certification scams
If it takes ten days, it is not EU AI Act compliance.
The Act has no general certificate, so the market sells substitutes: "AI Act certified" badges, "compliance certificates" from bodies nobody has notified under the Act, a one-hour webinar sold as the whole literacy duty and template policies naming another company's systems. They cost less, until someone asks for the technical file.
How to choose a credible EU AI Act provider
- Ask what the offered "certificate" actually is. Outside the notified-body routes for specific high-risk systems the Act issues none; a badge is marketing, whatever its logo.
- Where a notified body is required, check it is notified under the AI Act for that activity on the Commission's published list; the declaration of conformity is always the provider's own.
- Ask how each system will be classified, by whom, with what reasoning recorded, and how your role will be decided.
- Identify who carries each task, which notified body, testing and legal costs are separate, and what support exists when evidence is requested.
- Ask what your people will be trained to do and which system holds the records. Evidence kept on a consultant's laptop walks out with them.
- Walk away from "AI Act compliant in a week", literacy certificates sold as the whole programme and a CE mark promised for an unassessed system. Controls must operate before conformity can be shown.
Keep exploring
More on EU AI Act and related standards
Every EU AI Act guide
More in AI governance & digital trust
Talk to a consultant
Plan your EU AI Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice