EU AI Act readiness: the first step towards compliance with the AI Act

The AI Act (EU AI Act) has been adopted in the EU and is expected to be incorporated into the EEA Agreement. At the same time, the use of artificial intelligence is growing rapidly in both the public and private sectors.

For many leaders, the question is no longer whether the organisation uses AI, but how much it is used, which processes it affects, and which requirements may become relevant when the regulation takes effect.

The challenge is that many organisations lack sufficient visibility to be able to answer these questions. This is where AI Act readiness comes in.

AI Act readiness is a structured assessment of an organisation’s use of artificial intelligence, with the aim of identifying how the AI Act may affect the organisation.

The assessment gives leadership a basis for understanding:

• which AI systems are in use
• which processes are affected by AI
• which parts of the organisation may be subject to stricter requirements
• which actions should be prioritised going forward

The goal is not to document full compliance with the AI Act. The goal is to gain sufficient visibility and understanding to plan further work in a risk-based manner.

For most organisations, the greatest challenge will not be writing documentation or establishing new procedures. The greatest challenge will be understanding how artificial intelligence is actually being used within the organisation.

The larger the organisation, the more difficult this becomes.

AI is used today through:

• generative AI tools such as ChatGPT, Copilot and Gemini
• AI features in existing business systems
• analytical and decision-support tools
• supplier solutions that contain AI functionality

Many organisations may therefore have a significantly larger AI portfolio than leadership is aware of.

The AI Act is risk-based, and the implications of the regulation depend largely on how AI is used. This means no one can determine how significant the AI Act will be without first mapping the organisation’s AI portfolio.

A typical assessment will cover the following.

Which AI solutions exist within the organisation?

Which processes, decisions and tasks are affected by AI?

Could any of the solutions fall within the high-risk categories of the AI Act?

Does the organisation have adequate guidelines, roles and processes for AI use?

Which areas should be prioritised going forward?

It is easy to jump straight into discussions about AI governance, AI policy or ISO 42001.

For many organisations, however, it is difficult to know which actions are necessary before they have gained an overview of the current situation.

An AI Act readiness assessment gives leadership a fact-based foundation for assessing risk, priorities and further work.

For some organisations, the assessment will show that current AI use represents limited regulatory risk. For others, it may reveal the need for more extensive action relating to governance, documentation and internal control.

The AI Act will not affect all organisations in the same way. The significance of the regulation depends on the organisation’s AI portfolio, use cases and risk profile.

Therefore, the first and most important step is to establish visibility.

Organisations that begin this work early will be better placed to meet both regulatory requirements and the continued development of artificial intelligence.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!