The EU AI Act entered full enforcement in 2025 and is now reshaping how every enterprise with European operations builds, deploys, and audits AI systems. EU AI Act governance is no longer a compliance checkbox for a future date. It determines which AI systems can stay in production today and which must be pulled. This guide breaks down what a compliant framework looks like in practice.
Key Highlights
- The EU AI Act classifies AI systems into four risk tiers: unacceptable, high, limited, and minimal risk
- High risk systems include credit scoring, CV screening, biometric identification, and critical infrastructure controls
- Enterprises must register high risk AI systems in the EU AI Act database before deployment in the EU
- Fines for noncompliance reach up to 30 million euros or 6% of global annual revenue, whichever is higher
- General purpose AI models above 10^25 FLOPs of training compute face additional systemic risk obligations
How the EU AI Act Risk Tier Structure Works
The EU AI Act does not regulate all AI uniformly. It assigns obligations based on the risk the system poses to individuals and society. At the top sits the unacceptable risk category: AI systems that manipulate behavior, exploit psychological vulnerabilities, enable mass surveillance, or create social credit scoring. These are banned outright in the EU.
High risk systems carry the most compliance weight. They include AI used in hiring, credit decisions, education assessment, healthcare, law enforcement, border control, and critical infrastructure. These systems require conformity assessments, full technical documentation, human oversight mechanisms, and registration in a public EU database before deployment. Limited risk systems such as chatbots require transparency disclosures. Minimal risk systems face no specific obligations under the Act.
What a Compliant EU AI Act Governance Framework Requires
A governance framework built to meet EU AI Act requirements needs six components. First, an AI system inventory. Every AI system in production must be catalogued with its risk classification, intended purpose, training data sources, and accountable owner. Without an inventory, compliance gap assessment is impossible and demonstrating due diligence to regulators is equally impossible.
Second, a formal risk classification process applied to each system against the Act’s criteria. Third, full technical documentation packages for every high risk system, covering system architecture, training data characteristics, accuracy benchmarks, and known limitations. Fourth, human oversight mechanisms for every high risk deployment. A qualified person must be able to review, override, or halt the system at any point during operation.
Fifth, incident logging and anomaly monitoring in production. The Act requires enterprises to track AI system behavior postdeployment and report significant incidents. Sixth, a supplier due diligence process. If a third party AI tool is high risk, the enterprise deploying it shares compliance obligations with the provider. The European Commission publishes the authoritative guidance and implementation standards through the European AI Office.
The Shadow AI Compliance Problem
Most large enterprises that began EU AI Act compliance programs in 2025 discovered the same uncomfortable fact: dozens of AI tools were already running in the business, deployed by individual teams outside IT visibility. Shadow AI is a real legal risk under the Act because obligations apply regardless of how or when a system was deployed.
Solving this requires a governance model that extends beyond IT. Business unit leaders need to understand their obligation to declare AI tools to a central governance function. The compliance team needs an intake process that does not create enough friction to push teams further underground. The balance between control and practicality is where most enterprise governance programs are still struggling in 2026.
General Purpose AI Models and the Systemic Risk Tier
The EU AI Act introduced a separate category for general purpose AI models. Any foundation model made available in the EU must meet baseline transparency and copyright compliance requirements. Models above 10^25 FLOPs of training compute face a higher tier of systemic risk obligations: adversarial testing, incident reporting to the European AI Office, and cybersecurity assessments.
For enterprise teams building on third party foundation models, this creates a specific due diligence step.
If you are deploying a general purpose AI model via API in a high risk context, you need to confirm the model provider’s compliance status before deploying. NIST’s AI Risk Management Framework offers a complementary structure that many enterprises are running alongside EU AI Act compliance to manage both US and EU regulatory exposure simultaneously.
Frequently Asked Questions
What is the EU AI Act and how does it affect companies with European operations
The EU AI Act is a regulation that entered full enforcement in 2025 and is reshaping how companies build, deploy, and audit AI systems, it determines which AI systems can stay in production and which must be pulled due to noncompliance.
How does the EU AI Act classify AI systems
The EU AI Act classifies AI systems into four risk tiers: unacceptable, high, limited, and minimal risk, with high risk systems including credit scoring, CV screening, and critical infrastructure controls.
What are the consequences of noncompliance with the EU AI Act
Fines for noncompliance with the EU AI Act can reach up to 30 million euros or 6% of global annual revenue, whichever is higher, making it a significant concern for companies operating in the EU.
What types of AI systems are banned outright in the EU under the EU AI Act
AI systems that manipulate behavior, exploit psychological vulnerabilities, enable mass surveillance, or create social credit scoring are considered unacceptable risk and are banned outright in the EU.
The TCB View
Our read: the EU AI Act is forcing a governance discipline that enterprise AI programs should have built two years ago. The compliance burden is real, but enterprises that approach this as a framework building exercise rather than a penalty avoidance exercise will be better positioned. A well structured AI inventory and risk classification process improves deployment quality independent of any regulation.
Watch for the European AI Office to begin its first major enforcement actions before the end of 2026. Companies that have not completed high risk AI system registrations will face significant financial and reputational exposure.
