Compliance in Practice

Knowing your obligations is half the job; sequencing them against the clock and producing the right evidence is the other half. This lesson covers the staged timeline, the documents you must be able to show, the management systems behind them, and who is watching.

The Staged Timeline

The Act does not switch on all at once. It phases in over three years, with the riskiest practices regulated first:

The AI-Literacy Duty (Easy to Miss)

Since February 2025, providers and deployers must take measures to ensure their staff and others operating AI on their behalf have a sufficient level of AI literacy - appropriate to their role, the systems involved, and the people affected. It is one of the cheapest obligations to meet (training and awareness) and one of the easiest to forget. Document what you do: a short internal training programme and an attendance record go a long way.

The Documentation You Must Be Able to Show

Compliance under the Act is evidenced by documents. For a high-risk system, expect to maintain:

• Technical documentation - the full description of the system and the proof it meets the seven requirements (Lesson 4), ready before market entry.
• Risk-management records - the living log of risks identified, evaluated, and mitigated across the lifecycle.
• Data-governance documentation - dataset provenance, preparation, and representativeness.
• Automatically generated logs - retained for traceability.
• Instructions for use - the transparency pack handed to deployers.
• EU declaration of conformity and evidence of the CE marking.
• Post-market monitoring plan and incident records.

The Management Systems Behind the Documents

Two systems turn one-off documents into ongoing compliance:

1. Risk-management system - the continuous process that keeps the risk picture current as the model, data, and usage evolve.
2. Quality-management system - the organisational backbone that ensures compliance is built into design, development, testing, and change-management, rather than bolted on at release.

Plus two events that gate the market: the conformity assessment (mostly self-assessment for Annex III systems) and registration in the EU public database before placing the system on the market.

Who Enforces It

A layered governance structure backs the Act:

• The European AI Office - oversees GPAI models at EU level and coordinates implementation.
• The European Artificial Intelligence Board - coordinates national authorities for consistent application across member states.
• National competent authorities - market surveillance and enforcement within each member state.
• Notified bodies - independent assessors for the high-risk systems that require third-party conformity assessment.
• A scientific panel of independent experts - advises on GPAI and systemic risk.

Post-Market: Compliance Does Not End at Launch

Shipping a high-risk system is the start of the obligation, not the end. Providers must run post-market monitoring, keep the risk-management system current, retain logs, report serious incidents and malfunctions to authorities, and take corrective action (including withdrawal) when a system no longer conforms. Build these feedback loops into operations from day one rather than treating launch as the finish line.