The EU AI Act: the architecture choices that produce defensible compliance by 2 August 2026.

The EU AI Act is Regulation (EU) 2024/1689, the world's first comprehensive horizontal regulation of AI. It classifies AI systems by risk into four tiers — prohibited, high-risk, limited risk, minimal — and applies obligations proportionate to risk. The Act entered into force on 1 August 2024 with staggered enforcement: prohibitions from February 2025, GPAI rules from August 2025, high-risk Annex III systems from 2 August 2026, and Annex I systems from August 2027.

The headline deadline is 2 August 2026, when the high-risk-system obligations in Articles 9–15 become enforceable for AI systems falling under Annex III categories — biometric identification, critical infrastructure, education, employment, essential services, law enforcement, migration, justice. Prohibited practices have been enforceable since 2 February 2025. GPAI obligations have applied since 2 August 2025. Annex I high-risk systems (product-safety components) become enforceable on 2 August 2027.

Yes. The Act applies extraterritorially under Article 2(1)(c) — to any provider or deployer whose AI system outputs are used in the EU, regardless of where the provider or deployer is established. If your AI-driven decision affects an EU resident (a credit score, an HR shortlist, an insurance quote), the Act applies. Your headquarters can be anywhere; the relevant question is where the output is used.

Prohibited (Article 5) — social scoring, untargeted facial scraping, emotion recognition in workplaces, real-time biometric ID with narrow exceptions. High-risk (Annex III) — biometric ID, critical infrastructure, education, employment, essential services, law enforcement, migration, justice. Limited risk (Article 50) — chatbots, deepfakes and synthetic content require disclosure. Minimal risk — everything else, no specific obligations beyond voluntary codes.

Article 9: risk management system across the AI lifecycle. Article 10: data governance including bias detection. Article 11: technical documentation per Annex IV. Article 12: automatic logging and record-keeping. Article 13: transparency to deployers. Article 14: human oversight measures. Article 15: accuracy, robustness and cybersecurity. Plus parallel obligations including quality management system (Article 17), conformity assessment (Article 43), CE marking (Article 48), EU database registration (Article 49), post-market monitoring (Article 72) and serious-incident reporting (Article 73).

Maximum administrative fines under Article 99: up to €35 million or 7% of global annual turnover for prohibited practices; up to €15 million or 3% for high-risk non-compliance; up to €7.5 million or 1% for misleading information. Beyond financial penalties: market withdrawal of non-compliant systems, prohibition of specific uses, public disclosure of non-compliance, and a presumption of causation in civil liability under the proposed AI Liability Directive.

Yes. Articles 53–55 establish a parallel regime for general-purpose AI models — broad-capability models like LLMs and large multimodal models. Baseline obligations include technical documentation, downstream-provider documentation, EU copyright compliance and a public summary of training data. Systemic-risk GPAI models (training compute above 10²⁵ FLOPs) face additional obligations including adversarial testing, EU-level risk assessment, serious-incident reporting and cybersecurity protection.

MindMap Digital delivers EU AI Act compliance through a four-phase engagement model. Phase 1 (Assess, 4–6 weeks): portfolio inventory, risk-tier classification, gap analysis, board-ready remediation plan. Phase 2 (Architect, 2–4 weeks): reference architecture design, integration with the customer's GRC/SIEM/ITSM stack. Phase 3 (Implement, 6–24 weeks per workload): sovereign-cluster build, model serving, eval harness, Annex IV documentation, conformity assessment workflow. Phase 4 (Operate, ongoing): continuous risk management, drift monitoring, incident reporting, quarterly compliance review.

Article 9 (risk management) — risk-tier classification baked into every engagement, continuous cycle. Article 10 (data governance) — sovereign architecture keeps data inside the perimeter, lineage tracked, bias detection on every fine-tuning. Article 11 (technical documentation) — Annex IV documentation auto-generated as code in customer Git. Article 12 (record-keeping) — Langfuse in-perimeter, every prompt and tool call streamed to the customer's SIEM. Article 13 (transparency to deployers) — operator manuals shipped with every deployment. Article 14 (human oversight) — bounded-autonomy tool registry, permission gates, low-confidence routing. Article 15 (accuracy/robustness/cybersecurity) — eval harness gating every change, adversarial testing including prompt-injection red-teaming, namespace-level egress blocking.