DigitalXForce

Menu
Request Demo
Menu
Home » Frameworks » EU AI Act

What does the EU AI Act require, and from when?

DigitalXForce wrote this page.

The EU AI Act, Regulation (EU) 2024/1689, sets risk-based rules for AI. It has applied since 2 August 2026, after bans took effect in February 2025 and general-purpose AI rules in August 2025. The AI Omnibus moved the high-risk rules to 2 December 2027 and 2 August 2028. DigitalXForce inventories AI and evidences its controls, and classification stays yours.

An enterprise that uses AI systems built by others meets the Act as a deployer, and one that builds AI and offers it under its own name is also a provider. Both roles carry duties for high-risk systems, and both start with knowing which AI is in use.

What the EU AI Act requires

The 4 levels of risk

The Act sorts AI systems by the risk they pose.

  • Unacceptable risk is banned. The Act lists 10 prohibited practices, and 2 of them apply only from 2 December 2026. They include harmful manipulation and deception, exploitation of vulnerabilities, untargeted scraping of the internet or CCTV footage to build facial recognition databases, and emotion recognition in workplaces and schools.
  • High risk covers AI used in areas such as critical infrastructure, education, employment, access to essential services such as credit, biometrics, law enforcement, migration and the administration of justice, and AI that serves as a safety component of a regulated product.
  • Transparency risk covers systems such as chatbots, where people must be told they are dealing with a machine, and generated content, which must be identifiable, with deep fakes labeled.
  • Minimal risk, such as spam filters, carries no new rules, and the Commission says most AI in use in the EU falls here.

Providers and deployers

Article 3 defines a provider as one that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is one “using an AI system under its authority”, outside personal, non-professional use. One organization can be a provider for the AI it sells and a deployer for the AI it buys.

Providers of high-risk systems carry the heaviest load. Before a system goes on the market they need risk assessment and mitigation, high-quality datasets, logging for traceability, detailed documentation, clear information for the deployer, and a high level of robustness, cybersecurity and accuracy. Once it is on the market, they run post-market monitoring, and providers and deployers both report serious incidents and malfunctions.

When the rules apply

  • The Act entered into force on 1 August 2024.
  • Prohibited practices and the AI literacy obligations have applied since 2 February 2025.
  • The governance rules and the obligations for general-purpose AI models have applied since 2 August 2025.
  • The Act as a whole has applied since 2 August 2026, when the AI Office and national authorities took on enforcement and the transparency rules came into effect.
  • The ban on AI that generates non-consensual sexually explicit and intimate content or child sexual abuse material applies from December 2026.
  • The rules for high-risk systems in the Annex III areas apply from 2 December 2027.
  • The rules for high-risk AI built into products under Annex I, such as lifts or toys, apply from 2 August 2028.

The AI Omnibus set the last 3 dates. The Commission proposed it on 19 November 2025, the Parliament and the Council reached political agreement on 7 May 2026, and it entered into force on 27 July 2026. It also simplified the AI literacy requirement for companies, with the Commission and the Member States taking a stronger role in promoting AI literacy, extended some simplifications for SMEs to small mid-cap companies and widened access to regulatory sandboxes.

What a deployer of a high-risk system must do

Article 26, in the consolidated text as at 27 July 2026, sets the deployer’s duties.

  • The deployer takes technical and organizational measures to use the system according to the provider’s instructions for use.
  • It assigns human oversight to people with the necessary competence, training and authority, and gives them support.
  • Where it controls the input data, it makes sure the data is relevant and sufficiently representative for the system’s purpose.
  • It monitors the system’s operation, informs the provider, and suspends use and informs the provider and the market surveillance authority when the system presents a risk.
  • It keeps the logs the system generates, where they are under its control, for at least 6 months unless other law says otherwise.
  • It informs workers’ representatives and affected workers before using a high-risk system at work, and it informs people who are subject to decisions an Annex III system makes or helps make.

Financial institutions get a specific rule. The monitoring duty counts as met when they comply with the internal governance rules of EU financial services law, and they keep the logs as part of the documentation that law already requires.

Article 27 adds a fundamental rights impact assessment before deployment for bodies governed by public law, private entities providing public services, and deployers of systems that assess creditworthiness, set credit scores or price life and health insurance, under points 5(b) and 5(c) of Annex III. The assessment describes how and how often the system will be used, who it affects, the specific risks of harm and the human oversight measures. Article 50 adds transparency duties: deployers of emotion recognition and biometric categorization systems inform the people exposed to them, and deployers of deep fakes disclose that the content is artificial.

How can EU AI Act obligations map to controls and evidence?

EU AI Act obligations map to controls when each duty is written as a condition that can be checked, with the evidence that proves it and the system that holds that evidence. A deployer’s duty to monitor a high-risk system, for example, becomes a control on drift, bias and safety signals, with an owner and a record of each check.

Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA. For the Act, CCM watches the signals from each AI system, and CCA decides whether the controls that carry each duty still work.

The Act itself asks deployers to watch. Under Article 26, in the text the Commission’s AI Act Service Desk shows, a deployer of a high-risk system monitors its operation, and it keeps the logs the system generates, where they are under its control, for at least 6 months. The mapping table below takes each duty in turn, with what DigitalXForce checks and what stays with the organization. The EU AI Act compliance guide shows how to turn each of these duties into a control with an owner, a test and evidence.

A monitoring signal does not classify a system or make a disclosure. The organization and its counsel decide each system’s category and its own role, and the deployer writes the fundamental rights impact assessment where Article 27 requires one.

What DigitalXForce does for the EU AI Act

AI governance is the set of policies, roles, controls and evidence an organization uses to decide which AI systems it runs, how they may be used and whether their controls keep working. DigitalXForce governs AI through its AI TRiSCM™ module (Trust, Risk, Security and Compliance Management). The module discovers AI assets across cloud, code repositories, CI/CD pipelines, containers, model endpoints, RAG and vector databases and business applications. A deployer cannot classify AI it has not found, so the inventory comes before everything else.

The module assesses LLMs, chatbots, copilots, RAG systems, AI agents and model files against security, safety, privacy, robustness and operational risk. Its EU AI Act mapping covers risk classification, transparency, conformity assessment and the fundamental rights impact assessment, and each AI control is mapped once to the Act, ISO/IEC 42001 and the NIST AI RMF.

For human oversight, an AI system is approved before it goes into production, and approved and prohibited use are enforced as policy gates. For monitoring, the module runs bias monitoring, drift detection and performance and safety telemetry after deployment. Every test result is kept with the evidence it read and a timestamp.

AI systems enter the same chain as every other asset. A failed guardrail raises a risk in the enterprise risk register, AI JedAI scores it, and X-ROC, the XForce Risk Operations Center, alerts, triages, escalates and reports it. An exception or a risk acceptance is recorded as a named person’s decision with a reason and an expiry date.

The vendors behind an organization’s AI are assessed in the third-party risk management module, and a material change in a vendor’s posture, such as a new base model, triggers a reassessment. XForce GPT writes the narrative on what AI is in use, what its risk is and what changed, and an analyst reviews AI output before anyone relies on it.

The AI TRiSCM and AI Risk Governance module inventories AI systems, assesses them and maps their controls to the EU AI Act, NIST AI RMF and ISO/IEC 42001.

What stays with your organization

The Act places its duties on providers and deployers by name, and none of them moves to a software vendor.

  • Your organization decides, with counsel, whether each system is prohibited, high-risk, subject to transparency duties or minimal risk, and whether it acts as provider or deployer.
  • Your organization assigns human oversight to competent people and follows each provider’s instructions for use.
  • Your organization keeps each high-risk system’s own logs for at least 6 months and informs workers and affected people.
  • Your organization carries out the fundamental rights impact assessment where Article 27 requires it and makes the Article 50 disclosures.
  • Your organization reports serious incidents and suspends a system that presents a risk.
  • As a provider, your organization completes the conformity assessment, technical documentation and post-market monitoring.

How the EU AI Act maps to the platform

EU AI Act dutyWhat DigitalXForce doesWhat the organization still does
AI inventory and risk levelAI TRiSCM discovers AI systems and assesses each one, and its mapping covers risk classification.The organization and its counsel decide each system’s category and the organization’s role.
Human oversight, Article 26(2)An AI system is approved before production, and use policies are enforced as gates.The organization names competent people to oversee each system.
Monitoring operation, Article 26(5)Bias monitoring, drift detection and safety telemetry run after deployment, and failed guardrails become risks in X-ROC.The organization informs the provider and suspends use when a system presents a risk.
Logs, Article 26(6)Every control test result is kept with its evidence and a timestamp.The organization keeps the system’s own logs for at least 6 months.
Fundamental rights impact assessment, Article 27The mapping covers the assessment as a control area.The deployer writes and owns the assessment.
Transparency, Article 50Approved and prohibited use are expressed as controls with tests.The organization makes the disclosures to the people concerned.
AI from third partiesModel vendors are assessed in the TPRM module and reassessed on material change.The organization chooses its providers and follows their instructions for use.

Where DigitalXForce is not the answer

DigitalXForce does not decide whether a system is prohibited or high-risk, and it does not perform a provider’s conformity assessment. An organization whose AI is limited to minimal-risk tools, such as spam filters, has few duties under the Act and does not need a governance platform for them.

What is tested from live data and what still needs a person

Which controls DigitalXForce tests directly from live tool data depends on the tools you connect through X-Connect and E-Connect. Controls that rest on a document, such as a signed policy, are reviewed by AI JedAI against the requirement and kept with their evidence. The demo shows that split for your own stack.

The evidence the auditor receives

For each control, the auditor receives the test result, the evidence it read, the time it was read and the history of earlier results. A-Assess prepares the evidence and findings in the form auditors review.

Other frameworks the same controls report to

A control set up for the EU AI Act often also answers requirements in NIST AI RMF and ISO/IEC 42001, and the security of an AI system is tested against ISO/IEC 27001 and SOC 2 like any other system. DigitalXForce maps such a control once, so one test result reports to each framework it belongs to. The article on the common control framework explains the method.

The EU AI Act applies across sectors, and the industries page shows how each one uses the platform.

DigitalXForce is not a certification, assessment or authorization body for the EU AI Act. It tests and documents the controls the framework requires.

Questions about the EU AI Act

How can EU AI Act obligations map to controls and evidence?

Write each duty as a condition that can be checked, with the evidence that proves it and the system that holds that evidence. The monitoring duty in Article 26(5) becomes a control on drift, bias and safety signals from each deployed system. DigitalXForce maps each AI control once to the Act, ISO/IEC 42001 and the NIST AI RMF.

How should an organization prepare for the EU AI Act?

Start with an inventory of every AI system in use, then decide with counsel which systems are high-risk and whether the organization is a provider or a deployer for each. The rules for high-risk systems in the Annex III areas apply from 2 December 2027, and those for AI built into products under Annex I from 2 August 2028. Controls and evidence for oversight and monitoring can be in place before those dates.

When do the EU AI Act’s high-risk rules apply?

Since the AI Omnibus entered into force on 27 July 2026, the rules for high-risk systems in the Annex III areas apply from 2 December 2027, and the rules for high-risk AI built into products under Annex I apply from 2 August 2028. The rest of the Act has applied since 2 August 2026, and the bans since February 2025.

Is my organization a provider or a deployer under the EU AI Act?

A provider develops an AI system or model, or has one developed, and places it on the market or into service under its own name. A deployer uses an AI system under its own authority in a professional capacity. One organization can hold both roles for different systems, and counsel should confirm the role for each one.

What does a deployer of a high-risk AI system have to do?

Under Article 26, a deployer uses the system as the provider instructs, assigns competent human oversight, monitors its operation, keeps its logs for at least 6 months and informs affected workers and people. Public bodies, and deployers of systems that score credit or price life and health insurance, also carry out a fundamental rights impact assessment under Article 27.

Which AI practices does the EU AI Act ban?

It bans 9 practices, including harmful manipulation and deception, exploitation of vulnerabilities, untargeted scraping to build facial recognition databases and emotion recognition in workplaces and schools. The original 8 bans have applied since February 2025, and the ban on AI that generates non-consensual intimate content or child sexual abuse material applies from December 2026.

Does DigitalXForce classify our AI systems under the EU AI Act?

It does not make the legal classification. DigitalXForce discovers AI systems, assesses their risk and maps their controls to the Act’s areas, including risk classification and the fundamental rights impact assessment. The organization and its counsel decide each system’s category and its own role.

DigitalXForce terms used on this page

DigitalXForce gives each of its terms one definition and uses it everywhere, including in its glossary.

  • TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance.
  • A risk operations center is an operating model for continuously measuring, prioritizing and reducing risk, in the way a security operations center handles threats; DigitalXForce’s implementation is X-ROC, the XForce Risk Operations Center. X-ROC is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported.
  • AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements.
  • XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant.

Sources

Do this once instead of every audit.

Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.

Request a demo

Scroll to Top
Title banner reading Era of Automated Security Risk and Posture Management with the DigitalXForce logo beside a hand holding connected user icons and a report

Era of Automated Security Risk and Posture Management

Title banner reading Era of Automated Third Party Risk Management with Trust but Verify, with the DigitalXForce logo beside a hand holding connected user icons and a report

Era of Automated Third Party Risk Management: Trust but Verify

Title banner reading Era of Automated Security Plans, Standards, Policies and Procedures, with the DigitalXForce logo beside a hand holding connected user icons and a report

Era of Automated Security Plans, Standards, Policies and Procedures