Compliance

Article 10 and the GDPR pull in opposite directions on training data. This paper maps the conflicts, including representativeness versus minimisation, and offers a practical framework.

Article 72 requires a post-market monitoring plan for high-risk AI. Done well, it reuses the infrastructure you already run rather than spawning a second compliance programme.

Article 4 has been enforceable since February 2025. Sufficient AI literacy is contextual, not universal, and a tiered, role-based programme is the only model that holds up.

Classification is the first legal obligation and the costliest to get wrong. This guide maps the four tiers, the Article 6(3) exception, and the modern edge cases that break old frameworks.

A whole-regime view of the EU AI Act for boards and compliance leaders: risk classification, the eight high-risk pillars, GPAI duties, enforcement, and a five-action roadmap.