The EU AI Act, explained without the legalese

The EU AI Act is the first serious attempt by a major regulator to put rules around artificial intelligence, and like most first attempts it is enormous. But the core idea is refreshingly simple: the more dangerous the use of AI, the more rules apply. Everything else is detail hanging off that one hook.

The risk ladder, top to bottom

• Unacceptable risk: a short list of banned uses, like social scoring and certain manipulative systems. These are simply not allowed.
• High risk: AI in areas like hiring, credit, medical devices or critical infrastructure. Allowed, but with real obligations around data, documentation, human oversight and monitoring.
• Limited risk: things like chatbots, where the main duty is transparency. People should know they are talking to a machine.
• Minimal risk: the vast majority of AI, from spam filters to game logic, largely left alone.

The Act does not care that you use AI. It cares what you use it for. A spam filter and a hiring model are not the same animal, and the law finally says so.

Why this lands on your desk even if you are not in the EU

Like GDPR before it, the Act reaches beyond Europe's borders. If your AI system touches the EU market or its people, it is in scope, wherever your office happens to be. And the penalties are built to be felt, not shrugged off. So 'we are not a European company' is not the exemption people hope it is.

How Compliance One makes it tractable

The platform ships a full control library across the Act's articles and annexes, from prohibited practices to high-risk requirements to transparency and post-market duties. Each control carries a bucket, so you can see what is ready to implement, what needs your legal review, and what is simply context. It cross-maps to ISO 42001, so your AI management system and your EU AI Act obligations pull from the same evidence. The Act is long. Your path through it does not have to be, and it certainly does not have to start with a blank document and a law degree.