What it asks for. The AI Act is the EU regulation laying down harmonised rules on artificial intelligence. It takes a risk based approach: some practices are prohibited, high risk systems face detailed requirements on risk management, data, documentation, transparency, human oversight, accuracy, robustness and cybersecurity, certain systems have transparency duties, and general purpose AI models have their own obligations. Obligations apply in phases.
In practice. Organisations should inventory their AI systems, determine their role as provider or deployer, classify each system by risk category and plan compliance for the applicable obligations. Governance, AI literacy and documentation are central. Evidence includes the AI inventory, classification decisions, conformity documentation for high risk systems and supplier information.
Common gaps. Many organisations have no inventory of AI in use, including AI embedded in purchased products. Deployer obligations are often overlooked on the assumption that compliance is the vendor's problem.