EU AI Act Sets Risk Tiers and New Duties for AI Developers and Businesses

The EU AI Act’s practical effect will depend on how its risk categories are applied and how organizations prepare for the duties that follow. It reaches beyond AI developers: businesses that use or distribute systems may also need to assess their role, document their practices and show that safeguards are in place.

The legislation was presented as the first comprehensive legal framework for AI from a major global regulator. At the time of the source article, it still awaited approval by EU member states, expected in early 2025. Its passage marked a shift from voluntary guidance toward enforceable requirements, though experts questioned how clearly the rules define the systems they cover.

Risk categories determine the obligations

The Act groups AI applications into three broad levels: unacceptable, high and minimal risk. Systems classified as unacceptable risk, including social scoring that discriminates against demographic groups, would be banned. High-risk uses include facial recognition, credit scoring, financial services and recruitment. Minimal-risk systems face fewer requirements under this structure.

For high-risk applications, the Act calls for risk management, attention to data quality and fairness, and clear information about how a system works. It also requires human oversight: people should be able to review algorithmic decisions and, where needed, override them. Documentation is intended to make system behavior and decisions more transparent and help organizations identify bias.

These categories have direct consequences for product teams. A company may need to understand not only what a model does, but how it is used in a particular setting and which responsibilities apply to its role. The source describes obligations that could reach organizations involved with AI systems, rather than developers alone. That makes use-case inventories, ownership and governance processes relevant early in deployment planning.

Yet the line between covered and non-covered technology may be difficult to draw. Alois Reitbauer, Dynatrace’s chief technology strategist, questioned how enforcement could work without a clear definition of an AI model. He raised practical examples: whether machine learning in a mobile phone or a connected thermostat would count as an AI system. The answer could affect which products and teams must meet the rules.

“It’s impossible to see how organizations will be able to comply if they aren’t first clear on what constitutes an AI model,” Reitbauer said.

Preparation extends beyond model builders

Organizations should begin by mapping where AI appears in their operations and identifying which systems could fall into higher-risk categories. Hogan Lovells’ analysis said the Act could impose governance and compliance duties on a wide range of organizations involved with AI. It advised businesses to assess the legislation’s operational impact and build compliance into an AI governance program with standards, policies and procedures for appropriate use.

That advice points to a practical challenge: classification comes before implementation. Teams need enough information about a system’s purpose, data and deployment context to judge which requirements may apply. Businesses using third-party tools may also need to clarify what information and documentation suppliers can provide. The source does not spell out a single checklist, but it makes clear that organizations should be ready to demonstrate how they approach their obligations.

For firms operating across borders, the Act could affect work outside the EU as well. Jonas Jacobi, CEO of ValidMind, said large US companies with international operations already handle differing requirements and may choose to apply one set of standards across their business. He urged small and midsize companies that are adopting or considering AI to keep track of how the Act develops.

Jacobi’s distinction matters: a global company may have established compliance teams, while a smaller organization may need to build that capacity alongside product development. The source doesn’t estimate costs or specify which firms will face which obligations. It does suggest that the burden will vary by company size, international reach and AI use.

Cost, thresholds and safeguards remain concerns

Neil Serebryany, founder and CEO of CalypsoAI, described the requirements as potentially complex and costly for businesses, especially at the outset. He also argued that clearer safeguards and transparency could help build trust among customers and other stakeholders, supporting longer-term adoption. That potential benefit depends on organizations being able to meet the requirements without losing sight of how their systems perform in practice.

Daniel Christman, Cranium’s director of AI programs and co-founder, pointed to uncertainty around the different compliance thresholds. One classification cited in the source is “high-impact models with systemic risk,” tied to training compute above 10²⁵ FLOPs, or floating-point operations. For organizations developing or selecting models, that threshold makes compute history relevant to classification. Christman’s concern was that businesses could struggle to determine how their specific AI use maps to the rules.

Christman also criticized the Act for not including red teaming, the practice of probing a system for weaknesses. He argued that basic safeguards can be circumvented, leaving security and safety issues if testing is inadequate. His comment highlights a distinction between formal compliance and technical resilience: documentation and oversight may be required, while teams still need to test how a system behaves under adversarial or unexpected inputs.

The source describes transition periods of generally two years, one year for high-risk ventures and six months for unacceptable-risk ventures. Those periods give organizations time to prepare, but they don’t remove the need to determine which category applies or what evidence will demonstrate compliance. The variation in timelines also makes early classification useful for prioritizing work.

A possible reference point for other markets

The Act arrives amid broader concern about algorithmic bias, privacy and opaque decision-making. The source notes that other regions have pursued AI guidelines and governance frameworks, including US and UK efforts and a framework released by China in 2022. Those approaches differ, and the source characterizes the EU framework as placing more compliance responsibility on developers than some alternatives.

Adnan Masood, chief AI architect at UST, said that assigning responsibility to application developers could influence future rules elsewhere. For companies building products for multiple markets, that possibility makes the EU’s approach worth tracking even when a product is developed outside the bloc. Whether other jurisdictions adopt similar duties remains uncertain.

The Act’s reach will ultimately turn on definitions, enforcement and how risk categories translate into concrete obligations. Businesses can start by documenting their AI use, reviewing system purpose and data practices, and setting clear responsibility for oversight. Those steps won’t resolve every ambiguity, but they can expose classification questions early and give teams a firmer basis for adapting as the requirements take effect.