The Phased Timeline
February 2025
Prohibited practices enforceable
Social scoring, manipulative AI, real-time biometric identification
August 2025
GPAI obligations commence
Training data summaries, copyright rules, adversarial testing
August 2026
High-risk AI requirements apply
Conformity assessments, QMS, human oversight, technical documentation
The Risk Classification System
Unacceptable Risk (Banned)
Government social scoring, AI exploiting vulnerable groups, untargeted facial recognition, emotion inference in workplaces
High Risk
Biometric ID, critical infrastructure, employment, essential services access, law enforcement
Limited Risk
Chatbots, synthetic content, emotion recognition — transparency obligations required
Minimal Risk
Spam filters, search algorithms — no specific obligations
Five-Step Roadmap
- Build Your AI Inventory — Production AI, shadow AI, embedded AI in SaaS, vendor AI capabilities
- Classify Risk Ruthlessly — Map each system against risk tiers. When uncertain, classify upward.
- Gap Assessment for High-Risk — Evaluate against Articles 9–15: risk management, data governance, documentation, transparency, human oversight, cybersecurity
- Build Your QMS — Organisations with ISO 27001 can apply 60–70% of existing infrastructure. ISO 42001 bridges the gap.
- Operationalise Continuous Governance — Post-market monitoring, incident reporting, periodic re-assessment
Automating Compliance
AI governance agents enable shadow AI detection, automated risk classification, continuous documentation, drift and bias monitoring, and structured regulatory incident reporting. Organisations embedding governance agents reduce compliance overhead by 40–60%.
Need help implementing this?
First strategy session is complimentary. We typically respond within 4 hours.