7 Regulation and Compliance
Regulating AI now requires teams to think in terms of both legal scope and operational evidence. The chapter explains that the EU AI Act is the main reference point because it is comprehensive and extraterritorial, but it is rarely the only law that matters; privacy, product safety, copyright, and sector-specific rules can all overlap. It also stresses that good governance is not just about the model itself, but about the full system, the intended purpose, and the documentation needed to show what the system does, how it is used, and why a given classification was reached.
The core of the chapter is a practical method for classifying systems and assigning responsibility. It distinguishes between AI systems and non-AI software, then walks through prohibited practices, high-risk use cases, transparency duties, and the special case of GPAI models. Classification depends on intended purpose, not the underlying technology alone, so the same model can be low-risk in one deployment and high-risk in another. The chapter also shows how RAG pipelines, agents, and chained systems are assessed as whole applications, and how organizations can shift between provider and deployer roles depending on branding, modifications, and whether they put a system into service under their own name.
For high-risk systems, the chapter emphasizes that compliance is a living process, not a one-time review. Providers need risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and cybersecurity controls, post-market monitoring, and incident reporting. Deployers have their own duties: they must use systems as intended, maintain logs, assign real oversight, notify affected people where required, and report serious incidents quickly. The main message is that existing governance frameworks help, but they do not replace AI Act-specific evidence, contractual protections, or ongoing monitoring; the compliance file must be built early, kept current, and ready for regulatory scrutiny.
A GenAI system can pass every security and privacy certification and still produce harmful outputs. Governance must check what the system does, not only how it is built.
Providers of high-risk systems carry heavier obligations than deployers. Section 7.3.1 covers when you end up in both roles.
Classification and role decision tree. The tree produces a risk classification output
Guest trustworthiness scoring by a home sharing platform. A system may fall within the AI Act’s social scoring prohibition if it uses irrelevant behavioral signals, inferred traits, or social associations to create a broad trustworthiness score and then uses that score to deny bookings or impose other unfavorable treatment.
AI-assisted targeting of vulnerable policyholders. An insurance system flags elderly policyholders showing signs of cognitive decline and prompts agents to sell a complex retirement-income product using urgency-based scripts. If significant harm is likely, the use may fall within the EU AI Act’s prohibition on exploitative AI practices.
An AI chatbot pushing a high-interest loan by referencing the user’s children, manufacturing urgency. The user can read every message, but cannot recognize the manipulation calibrated to their stated emotional priorities.
The eight Annex III domains where AI systems are classified as high-risk. Any system whose intended purpose falls within one of these areas owes the full compliance obligation set.
A potential high-risk system because it recommends promotion directly
A potentially low-risk system, because it only provides information on policies.
How to obtain legally required information from a GPAI provider.
Four questions that determine whether you are the provider of a given AI system under the EU AI Act. Any “Yes” makes you the provider. Four “No”s leave you a deployer only if you use the system under your own authority; otherwise, you may be an importer, a distributor, or hold no role under the Act at all.
Llama 4’s model card on Hugging Face.
Classification and role decision tree. The tree produces two outputs: a risk classification and a role assignment. Together, they determine which obligation set applies and which evidence pack you need.
EU AI Act incident reporting tiers. Clock starts at reasonable likelihood of a causal link, not confirmed root cause.
Summary
The EU AI Act is more straightforward than its length suggests. Two questions decide your exposure: what does your system do, and what do you do with it. The first sets your classification: minimal risk, limited risk, high risk, or banned outright. The second sets your role: provider if you built the system, deployer if you operate someone else’s. Building your application on a third-party model still makes you the provider of that application; the upstream party remains the provider of the model. If you operate the system, you carry deployer duties even when your vendor’s terms say otherwise.
The hardest part is the lag between what your system does and what your organization knows about it. A new feature is delivered. The system gets pointed at a new kind of decision. A vendor pushes a model update that subtly changes how the system behaves. Each looks like an engineering decision. Each can quietly shift what the Act requires of you.
Most of what the Act asks for is documentation of practices the previous chapters already covered. Risk assessment, data governance, human oversight, logging, monitoring: these exist because they make systems safer, not because a regulator demands them. ISO 42001 and NIST AI RMF cover the organizational scaffolding. They do not produce the product-level paperwork regulators expect for each AI system, and that paperwork is the actual new lift.
If your governance practices generate traceable artifacts, your evidence pack assembles itself. If they do not, you are building it from memory, and memory is not evidence. Most of the Act’s deadlines are closer than they look, and the technical work takes months. Start with the system that would do the most damage if it failed.
AI Governance ebook for free
