EU AI Act

The EU AI Act, formally Regulation (EU) 2024/1689, creates a legal framework for AI based on risks to health, safety, and fundamental rights. Its scope is not determined solely by where cloud infrastructure runs: organizations outside the EU can also be covered, including in specified circumstances where AI system outputs are used in the EU. Governance therefore starts with the business use case, affected people, deployment context, and organizational responsibilities, not the choice of cloud region.

A useful introductory framework distinguishes prohibited practices, high-risk systems, applications subject to specific transparency obligations, and other lower-risk uses. These are not four mutually exclusive technical labels. Transparency duties can overlap with high-risk requirements, and general-purpose AI models have a separate set of obligations, with additional requirements for models presenting systemic risk. A model’s size, use of generative AI, or deployment through a managed service does not by itself establish the risk classification of the resulting application.

Prohibited practices include certain forms of harmful manipulation, social scoring, and specified biometric uses. The precise conditions and exceptions matter. For example, inferring emotions in workplaces or educational institutions is generally prohibited, subject to exceptions for medical or safety reasons. A governance process should stop prohibited applications rather than approve them because encryption, monitoring, or human review has been added.

High-risk classification depends on the legal criteria and intended purpose. Certain AI-enabled regulated products and listed uses in areas such as employment, education, and access to essential services can qualify. An application that ranks job candidates is a practical example requiring careful high-risk assessment. An internal tool that summarizes equipment manuals generally has a different risk profile. Some listed uses have specific exceptions, so legal review should confirm the classification and document its rationale.

For high-risk systems, applicable obligations include risk management, data governance, technical documentation, record-keeping, human oversight, accuracy, robustness, and cybersecurity. Providers and deployers have different duties. Providers may need conformity assessment and registration, while deployers must follow applicable instructions, assign competent oversight, and monitor operation. Certain deployers must also perform a fundamental-rights impact assessment. Purchasing an AI API does not transfer all these responsibilities to the supplier, and substantial modification or a changed intended purpose can affect an organization’s role.

In a cloud environment, maintain an AI inventory that records intended purpose, owner, provider and deployer roles, affected populations, classification, model versions, data dependencies, and required approvals. Connect this inventory to deployment gates. For a recruitment system, retain evaluation results across relevant applicant groups, document training-data limitations, implement meaningful human review, and collect operational evidence with appropriate privacy controls. For a customer-facing chatbot, assess whether users must be informed that they are interacting with AI; synthetic content can trigger additional disclosure or machine-readable marking duties depending on the content and the organization’s role.

Risk classification must continue throughout the lifecycle. Reassess when a model is replaced, data changes materially, the system gains decision-making authority, or a summarization tool is repurposed to evaluate employees. Monitoring should support incident investigation, corrective action, and applicable reporting duties. Keep evidence of approvals, evaluations, changes, and oversight, but avoid indiscriminately logging sensitive prompts or personal data.

The trade-off is proportionality: stronger testing, documentation, oversight, and release controls consume time and resources, but insufficient governance can expose people to harm and organizations to enforcement. Neither a cloud certification nor a guardrail configuration establishes legal compliance. EU hosting is not a substitute for classification, and the AI Act does not replace GDPR or sector-specific obligations. Because requirements apply on a phased schedule with transitional provisions, implementation plans must confirm the applicable legal deadlines for each system and organizational role.