AI governance
EU AI Act
The EU AI Act
The EU AI Act is the European Union's regulation for artificial intelligence, applying obligations based on the risk an AI system presents. We help you classify your systems, meet the obligations that apply, and demonstrate compliance.
What EU AI Act is
The EU AI Act is European Union law that regulates artificial intelligence using a risk-based approach. It prohibits certain uses outright, places substantial obligations on high-risk AI systems, sets transparency obligations for others, and includes specific rules for general-purpose AI models. Obligations fall differently on providers and on deployers of AI systems.
The AI Act is a regulation you demonstrate compliance with, not a standard an accredited body certifies you against, although some high-risk systems require a conformity assessment before they can be placed on the market. Its obligations apply in phases over time, and they can reach organisations outside the EU where their AI systems are used or their output is used within the EU.
The four risk tiers and what each demands
Tier 1 · Unacceptable risk
A short list of AI practices, such as social scoring by public authorities and certain manipulative or untargeted biometric uses, is banned outright and may not be placed on the market or used at all.
Tier 2 · High risk
Systems used in areas such as critical infrastructure, employment, essential services, law enforcement and medical devices carry the heaviest obligations, including risk management, data governance, logging, human oversight, accuracy and a conformity assessment before market entry.
Tier 3 · Limited risk
Systems that interact with people or generate content, such as chatbots and synthetic media, mainly carry transparency obligations so that users know they are dealing with AI or with artificially generated or manipulated output.
Tier 4 · Minimal risk
The large majority of AI systems, such as spam filters and recommendation features, fall outside specific obligations, though voluntary codes of conduct are encouraged.
Cross-cutting · General-purpose AI models
Providers of general-purpose AI models face their own documentation, copyright and transparency duties, with stricter obligations where a model is judged to carry systemic risk.
Cross-cutting · Roles and governance
Obligations are split between providers and deployers, with oversight shared across national authorities, the European Commission and the AI Office that supervises general-purpose models.
Who needs it
- Providers that develop or place AI systems on the EU market, wherever they are based
- Deployers that use AI systems in the EU, especially in higher-risk contexts
- Companies with general-purpose AI models, or products that rely on them, serving EU users
What you get
- An AI system inventory with provider or deployer roles and risk classification
- Risk management, data governance and technical documentation aligned to the applicable tier
- Transparency and human oversight measures with supporting evidence
- Readiness for conformity assessment and a compliance documentation pack
Timelines depend on how many AI systems you run, their risk classification and the phase-in dates that apply to them. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The EU AI Act entered into force on 1 August 2024 and applies in phases rather than all at once. The prohibitions on unacceptable-risk practices and the AI literacy duty applied from February 2025, obligations for general-purpose AI models from August 2025, and the bulk of the high-risk and governance obligations fall due through 2026, with certain high-risk systems embedded in regulated products given until 2027. The Commission is still issuing guidance, delegated acts and harmonised standards that fill in the detail, and the voluntary General-Purpose AI Code of Practice sits alongside the legal text, so the practical compliance picture is still settling. The sensible transition approach is to classify your systems now, track which phase-in date applies to each, and build evidence against the obligations that are already live while watching the ones still to come.
What it costs
The EU AI Act is a law, not a scheme you get certified against, so there is no certificate to buy and no accredited badge at the end. The costs that sit side by side are our scoped advisory and implementation fee, quoted up front once we understand how many AI systems you run and where you are starting from, and any independent input you choose to add, such as a conformity assessment body for certain high-risk systems, external testing, or legal and data-protection advice on how the Act applies to you. tr3labs is never the certifier, auditor or regulator; those are separate parties on their own schedules. We would rather scope it with you than quote blind.
How tr3labs gets you there
Scope and classification
We inventory your AI systems, establish whether you are a provider or deployer for each, and classify them under the Act's risk categories so you know which obligations apply.
Build the controls and documentation
We help you implement the risk management, data governance, technical documentation, transparency and human oversight measures the applicable risk tier requires.
Test and prove
We bring security testing and reviews to the systems serving your AI and help evidence the robustness, accuracy and oversight the Act expects.
Conformity and readiness support
We prepare you for any conformity assessment that applies to high-risk systems and assemble the documentation that demonstrates compliance to customers and regulators.
EU AI Act and ISO 42001 side by side
The two get confused because both govern AI, but one is a binding EU law you must comply with and the other is a voluntary management-system standard you can be certified against.
| EU AI Act | ISO 42001 | |
|---|---|---|
| Covers | AI systems and general-purpose AI models on the EU market | An organisation-wide AI management system |
| Who asks for it | EU regulators, by force of law | Customers, boards and partners, voluntarily |
| Core idea | Obligations scaled to the risk a system poses | A managed programme that keeps AI governed over time |
| Audit model | No certificate; conformity assessment only for some high-risk systems | Certified by an accredited body against the standard |
| Reach | Binding across the EU, including some organisations outside it | International, adoptable anywhere by choice |
| Often held with | ISO 42001, GDPR, ISO 27001 | EU AI Act, ISO 27001, SOC 2 |
EU AI Act FAQ
- How much does EU AI Act compliance cost?
- The EU AI Act is a law, not a certification scheme, so there is no badge to buy. You pay our scoped advisory and implementation fee, quoted up front, plus any independent input you choose, such as a conformity assessment body for certain high-risk systems, external testing, or legal advice on how the Act applies.
- How long does EU AI Act readiness take?
- It depends on how many AI systems you run, their risk classification and the phase-in dates that apply to them. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Does the EU AI Act apply to us if we are outside the EU?
- It can. The Act reaches organisations outside the EU where their AI systems are placed on the EU market, used within the EU, or where the output produced is used in the EU. We help you determine whether and how it applies during scoping.
- What are the risk categories under the EU AI Act?
- The Act takes a risk-based approach: some uses are prohibited, high-risk systems carry substantial obligations, certain systems have transparency obligations, and there are specific rules for general-purpose AI models. Classifying your systems correctly is the foundation of compliance.
- Is the EU AI Act a certification?
- No. It is a regulation you demonstrate compliance with, not a certifiable standard, although certain high-risk systems must undergo a conformity assessment before being placed on the market. We prepare you for that process and build the evidence that supports compliance.
The services that get you there
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read