— RegulationAI Act Compliance
The world's first comprehensive legal framework for artificial intelligence — imposing obligations proportionate to the risk level of each AI system.
Maximum penalties
Risk levels
Member states
Year of adoption
Who is affected ?
AI system providers
- AI system developers
- Publishers placing an AI system on the EU market
- Providers of general-purpose AI models (GPAI)
- Importers and distributors of AI systems
- Manufacturers integrating an AI system into a product
AI system deployers
- Companies using AI systems in a professional setting
- Public administrations deploying AI systems
- Organizations using AI for decision-making
- Employers using AI in HR (recruitment, evaluation)
- Critical infrastructure operators integrating AI
The Regulation applies to any actor placing on the market, putting into service, or using an AI system in the European Union, regardless of their place of establishment.
The risk-based approach
The AI Act classifies each AI system by risk level. The higher the risk, the stricter the obligations.
Unacceptable risk
PROHIBITEDPractices prohibited since February 2025: social scoring, subliminal manipulation, exploitation of vulnerabilities, real-time biometric identification in public spaces, sensitive biometric categorization.
High risk
STRICT COMPLIANCEAI systems in sensitive domains (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) or safety components of EU-regulated products.
Limited risk
TRANSPARENCYSystems interacting with people (chatbots, virtual assistants) or generating content (deepfakes, text, images). Obligation to inform users they are interacting with an AI.
Minimal risk
FREESpam filters, recommendation systems, video games. No specific obligations, but codes of conduct and AI literacy are encouraged.
Are you affected by the AI Act ?
Determine in 5 minutes your AI Act risk classification and assess your readiness level: obligations, timeline, personalized recommendations.
Launch the AI Act simulatorRegulation (EU) 2024/1689 on artificial intelligence — known as the AI Act — is the world's first legislation to regulate AI comprehensively. Adopted in August 2024, it applies progressively through 2027 and covers all actors in the AI value chain: providers, deployers, importers, distributors.
The AI Act does not apply in the same way to all systems. It establishes a risk-based approach: the more likely an AI system is to affect fundamental rights, the stricter the obligations. Certain practices are outright prohibited. High-risk systems must comply with a demanding framework of risk management, technical documentation, and human oversight.
Conitiv enables you to classify your AI systems, assess your readiness level, and monitor the AI compliance of your suppliers — all from a single platform.
What the AI Act specifically requires
Risk management system (Article 9)
Implementation of a continuous and iterative risk management system throughout the AI system lifecycle. Identification, estimation, and evaluation of known and foreseeable risks. Tests proportionate to the risk level.
Data governance (Article 10)
Training, validation, and test datasets must meet quality criteria: relevance, representativeness, absence of bias, completeness. Documented and traceable governance.
Technical documentation (Article 11)
Comprehensive technical documentation demonstrating AI system compliance: design, development, capabilities, limitations, risk management, data used. Regular mandatory updates.
Transparency and information (Articles 13 and 50)
High-risk systems must be sufficiently transparent for deployers to correctly interpret results. Chatbots and content-generating systems must inform users they are interacting with an AI.
Human oversight (Article 14)
High-risk systems must allow effective human oversight: understanding of capabilities and limitations, ability to intervene and stop, maintaining final human decision-making authority.
Accuracy, robustness, cybersecurity (Article 15)
High-risk systems must achieve an appropriate level of accuracy, robustness, and cybersecurity. Protection against third-party manipulation attempts, resilience to errors and inconsistencies.
The blind spot: your AI suppliers
The AI Act imposes different obligations on providers and deployers of AI systems. But in practice, the deployer remains responsible for ensuring that the systems it uses are compliant — including those developed by third parties.
in maximum penalties
Concretely, if you integrate a high-risk AI system developed by an external provider, you must verify its compliance: technical documentation, risk management, human oversight, CE marking. The Regulation does not exempt you from this verification.
Conitiv enables you to assess the AI Act compliance of your AI suppliers, centralize compliance evidence, and track changes in their regulatory posture — before deadlines take effect.
| Fournisseur | DPA | Évaluation | Statut |
|---|---|---|---|
| Fournisseur A | Oui | Mars 2021 | Expiré |
| Fournisseur B | — | ? | Manquant |
| Fournisseur C | Oui | Juin 2022 | Expiré |
| Fournisseur D | — | — | Manquant |
| Fournisseur E | — | ? | ? |
How Conitiv helps you with the AI Act
Classification and inventory of your AI systems
Inventory all your AI systems, classify them according to the AI Act risk pyramid, and automatically identify your obligations. Complete visibility over your regulatory exposure.
AI Act compliance assessment
Structured article-by-article questionnaire covering AI Act requirements: risk management, data governance, technical documentation, transparency, human oversight. Readiness score out of 1,000.
AI supplier oversight
Assess the AI Act compliance of your AI suppliers: technical documentation, CE marking, risk management. Centralize evidence and track changes in their regulatory posture.
Management and documentation
Consolidated AI Act compliance dashboard. Regulatory deadline tracking, alerts on Regulation developments, centralized documentation and enforceable evidence.
Implementation timeline
The AI Act applies progressively between 2024 and 2027. Each milestone adds new obligations.
Adoption of the Regulation
Publication in the Official Journal of the EU. Entry into force 20 days later.
Prohibited practices + AI Literacy
Unacceptable risk practices (Article 5) are prohibited. AI literacy obligation for all.
GPAI obligations
Providers of general-purpose AI models (GPAI) must comply: documentation, copyright, evaluation.
High risk — Annex III
Mandatory compliance for high-risk AI systems in sensitive domains: biometrics, employment, credit, justice, etc.
High risk — Annex I
Mandatory compliance for AI systems as safety components of EU-regulated products (medical devices, machinery, aviation…).
You deploy AI — or you provide it
If you are an AI system provider
- →Classify each system according to the AI Act risk pyramid and identify your specific obligations.
- →Document technical compliance: risk management, data governance, transparency, human oversight.
- →Prepare CE marking for your high-risk systems and compile the required technical documentation.
If you deploy an AI system
- →Assess the AI Act compliance of your AI suppliers before deploying their systems.
- →Implement the human oversight and control processes required by the Regulation.
- →Conduct a fundamental rights impact assessment for high-risk systems.
Regulation (EU) 2024/1689 was adopted in August 2024 and applies progressively. Prohibited practices (Article 5) and the AI literacy obligation have been in force since February 2025. GPAI obligations apply since August 2025. High-risk obligations under Annex III will apply in August 2026 and those under Annex I in August 2027.
An AI system is classified as high-risk if it falls under one of the domains listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) or if it is a safety component of an EU-regulated product listed in Annex I. The Conitiv simulator helps you determine your classification in minutes.
The provider is the one who develops or places an AI system on the market. The deployer is the one who uses this system in a professional setting. Both have obligations under the AI Act, but they differ: the provider bears the primary burden of technical compliance, while the deployer must ensure human oversight and transparency towards end users.
A general-purpose AI model (GPAI) is a model trained on large amounts of data, capable of performing a variety of distinct tasks. LLMs like GPT, Claude, Mistral, or Llama are examples. GPAI providers have had specific obligations since August 2025: technical documentation, copyright policy, training data summary.
No. Conitiv prepares you for compliance by assessing your risk classification, measuring your readiness level, and overseeing your AI suppliers. Conitiv assessments produce documented and actionable evidence, but do not substitute for a compliance audit by a notified body within the CE marking framework.
Penalties vary by severity: up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for high-risk obligations, €7.5M or 1% for inaccurate information. SMEs benefit from proportionate caps. Beyond financial penalties, non-compliance may result in a market ban.
Ready to assess your AI Act compliance?
expert Conitiv