How RecordPoint can help
RecordPoint can help organizations facilitate their EU AI Act compliance with several key features, including:
EU AI Act compliance with RecordPoint
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law governing artificial intelligence. It sets risk-based obligations for organizations that develop, deploy, or supply AI systems connected to the EU market, spanning data governance, record-keeping, transparency, and human oversight. With RecordPoint, you can govern the data and systems behind your AI, and stay ready to prove it.
Govern and evidence your AI systems
The Act requires providers and deployers to keep records of their AI systems and demonstrate ongoing oversight. RecordPoint gives you a live view of every AI system, model, and data source, with the approvals, monitoring, and audit trail you need to show a regulator how each system is governed.
See and control every AI system in use
You cannot govern what you cannot see. RecordPoint inventories the AI systems, copilots, and agents running across your organization, surfaces shadow AI, and captures the approvals and oversight you need as defensible evidence against the Act's record-keeping duties.
Give your high-risk AI only governed data
The Act sets a high bar for the data high-risk systems are built on. RecordPoint delivers approved, permission-aware, sensitivity-controlled data to your AI systems, with lineage and guardrails at every step, so what your models rely on is relevant, controlled, and accounted for.
What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and is the first comprehensive law dedicated to artificial intelligence. It takes a risk-based approach: the more risk a system poses to health, safety, or fundamental rights, the stricter the obligations placed on it.
The Act applies beyond the EU's borders. Any organization that places an AI system on the EU market, puts one into service in the EU, or whose system's output is used in the EU falls in scope, wherever it is based. Separate obligations apply to providers of general-purpose AI models.
Obligations apply in phases. Prohibited practices and AI literacy duties applied from February 2025, and general-purpose AI model rules and penalties from August 2025. Following the 2026 Digital Omnibus, the main high-risk obligations apply from December 2027, and AI embedded in regulated products from August 2028.
The Act applies beyond the EU's borders. Any organization that places an AI system on the EU market, puts one into service in the EU, or whose system's output is used in the EU falls in scope, wherever it is based. Separate obligations apply to providers of general-purpose AI models.
Obligations apply in phases. Prohibited practices and AI literacy duties applied from February 2025, and general-purpose AI model rules and penalties from August 2025. Following the 2026 Digital Omnibus, the main high-risk obligations apply from December 2027, and AI embedded in regulated products from August 2028.
The four risk tiers:
Lorem ipsum
Unacceptable risk: banned outright, such as social scoring and certain biometric surveillance.
High risk: the bulk of the obligations, such as recruitment, credit scoring, essential services, and critical infrastructure.
Limited risk: transparency duties, such as disclosing AI-generated content or that a person is dealing with AI.
Minimal risk: the vast majority of AI in use today, largely unregulated.
Compliance with the EU AI Act
Any organization that develops, deploys, or supplies high-risk AI connected to the EU market must meet the Act's core obligations. For high-risk systems, the main requirements are:
1
Risk management system (Article 9).
Establish and maintain a continuous, documented process to identify, evaluate, and mitigate risks across the AI system's lifecycle.
2
Data and data governance (Article 10).
Ensure training, validation, and testing data is relevant, sufficiently representative, examined for bias, and as free from errors and as complete as possible for the intended purpose.
3
Technical documentation (Article 11).
Keep documentation that shows how the system meets the Act's requirements, ready to provide to regulators.
4
Record-keeping and logging (Article 12).
Automatically log events over the system's lifetime so its behavior can be traced and reconstructed.
5
Transparency and information (Article 13).
Make the system transparent enough that deployers can understand its output and use it correctly.
6
Human oversight (Article 14).
Design systems so people can effectively oversee them, intervene, and stop them when needed.
7
Accuracy, robustness, and cybersecurity (Article 15).
Ensure the system performs consistently and resists errors, faults, and manipulation.
8
Quality management system (Article 17).
Operate a documented quality management system covering the obligations above.
9
Registration and post-market monitoring (Articles 16, 18, and 72).
Register high-risk systems, retain documentation, and monitor performance after the system is on the market.
Penalties for noncompliance
Up to
€35M or 7%
of global annual turnover, for prohibited AI practices
Up to
€15M or 3%
of global annual turnover, for high-risk and transparency breaches
The EU AI Act carries some of the steepest penalties in technology regulation. The most serious breaches, involving prohibited AI practices, can reach 35 million euros or 7% of global annual turnover, whichever is higher. Breaches of high-risk or transparency obligations can reach 15 million euros or 3%, and supplying incorrect or misleading information to authorities up to 7.5 million euros or 1%. Caps are set proportionately, with lower ceilings for SMEs and start-ups.
Frequently asked questions
Have more questions about AI EU Act compliance or looking for additional details? Reach out to our friendly team - we're happy to help you navigate it.
Contact UsExplore EU AI Act articles & case studies
Regulatory breakdowns, expert commentary, and real-world case studies: everything you need to decode complex EU AI Act requirements, build a defensible AI governance strategy, and learn from how regulated organizations are preparing.
