EU AI Act: Is Your Organisation Ready for the Next Phase?

The EU AI Act is not relevant only to technology companies. It affects organisations that develop, integrate, procure or use artificial intelligence — including systems supplied by third parties.

AI may already be present in recruitment tools, customer-service platforms, fraud detection, productivity software, medical devices or decision-support systems. An organisation cannot govern what it has not identified. The first practical step is therefore an inventory of AI use cases, owners, suppliers, data and decisions affected.

A risk-based framework

The Act applies different requirements according to the role of the organisation and the risk created by the system:

• Prohibited practices are not permitted in the European Union.
• High-risk systems are subject to detailed obligations for governance, documentation, data, oversight and monitoring.
• Transparency-risk systems, including some conversational and synthetic-content tools, must meet specific disclosure duties.
• Lower-risk uses remain subject to wider law, internal controls and good governance even where the Act imposes no extensive system-level duties.

What changed from August 2025

From 2 August 2025, important provisions on governance, enforcement, confidentiality and general-purpose AI became applicable. This phase followed the February 2025 application of prohibited-practice rules and the duty to ensure an appropriate level of AI literacy.

For organisations using general-purpose models — whether through a public interface, an API or software that embeds one — the practical questions include supplier documentation, known limitations, data handling, systemic-risk information and the ability to report significant incidents.

AI literacy is an operating requirement

AI literacy is not satisfied by a generic awareness video. People need enough understanding for the decisions they make. A procurement team should know what to ask a supplier. A manager should understand when human review is essential. A developer should recognise evaluation, bias and prompt-injection risk. A board should know where accountability sits.

A practical readiness plan

1. Map AI use. Record systems, purpose, owner, supplier, affected people and data.
2. Classify obligations. Determine the organisation’s role and the likely risk category of each use case.
3. Control procurement. Add AI-specific due diligence, contract terms and evidence requirements.
4. Assign accountability. Define who approves, monitors, changes and retires AI systems.
5. Document oversight. Make human review meaningful, trained and traceable.
6. Prepare for incidents. Extend security, privacy and operational response plans to AI-specific failure modes.

The organisations best placed for the EU AI Act will not be those producing the largest policy document. They will be those able to explain, with evidence, which systems they use, why they use them, what can go wrong and who is responsible for acting.