EU AI Act Compliance

If you use AI assistants for internal productivity (emails, summaries, code suggestions) and they don’t make decisions that affect people’s rights, you are likely in the minimal risk category — no obligations beyond general transparency.

However, if AI assistants are used for HR decisions (screening CVs, evaluating employees), credit scoring, or customer-facing decisions, those specific use cases may be classified as high-risk and require a risk management system, documentation, and an inventory.

Credit scoring and fraud detection models used in financial services are explicitly listed as high-risk AI in Annex III of the EU AI Act. You need:

• A risk management system (Art. 9)
• Technical documentation for each model (Annex IV)
• A quality management system (Art. 17)
• Registration in the EU database (Art. 49)
• Human oversight measures (Art. 14)

Step zero: you need an inventory of all these models. You can’t document, register, or manage what you haven’t catalogued.

It depends on what the agent does, not what it is. An AI agent that automates document processing is likely minimal risk. But an agent that makes or influences decisions about people — hiring, loan approvals, insurance claims, medical triage — falls under high-risk.

The key question: does the AI output affect someone’s rights, safety, or access to services? If yes, you need to treat it as high-risk regardless of whether it’s called an “agent”, “model”, or “automation”.

Yes. The EU AI Act has extraterritorial reach, similar to GDPR. If the output of your AI system is used in the EU — even if your company is headquartered in the US, UK, or elsewhere — you are in scope as a “deployer” or “provider”.

Start with an AI inventory — a single, structured register of every AI system in your organization. For each system, capture: what it does, who owns it, what data it uses, its risk classification, and its EU AI Act category.

If your team already uses Jira, Model Inventory for Jira gets you from zero to a working registry in an afternoon — including EU AI Act risk classification and compliance checklists.

You are a “deployer” under the EU AI Act. Deployers of high-risk AI systems have obligations too — you must ensure proper use, human oversight, and monitor the system in operation (Art. 26). You still need to know what AI you’re using and document it.

The provider (vendor) handles conformity assessment and technical documentation. But you can’t outsource accountability — if the AI makes a harmful decision in your context, you share responsibility.