Skip to content

EU AI Act

Miniature domed certification workshop where robots queue at a reception desk to be scanned and sorted into low, medium, high and critical risk chutes

Regulation (EU) 2024/1689: the first comprehensive AI regulation, with a risk-based approach and obligations phasing in over several years. Obligations differ sharply by role (provider vs. deployer) and risk class, so scoping comes first.

What the Digital Omnibus actually changed: The Digital Omnibus didn't delay the AI Act, it rewrote parts of it.

Verifying control text against the regulation itself: regcheck.

Start here

sameerkhairkar.com

DPIA + AI Act FRIA, done as one assessment

How to run a GDPR Data Protection Impact Assessment and the AI Act Article 27 Fundamental Rights Impact Assessment as a single exercise: one scope, one risk register, two legal lenses. A cross-mapping of every required element from both regimes, plus a self-contained interactive assessor.

Planned branches

Area Planned artefacts
Scoping & classification Role and risk-class decision checklist (provider / deployer / importer / distributor)
Prohibited practices & AI literacy Quick-reference checklist for the earliest-applying obligations
High-risk AI systems Document inventory (technical documentation, risk management, logging) · responsibility matrix
GPAI models Obligations overview for organizations consuming GPAI
AI governance operating model How to run AI governance alongside existing risk and compliance functions

Under construction

This branch opens after DORA and NIS2 foundations ship. Application dates for individual obligations are staggered. Each artefact will state which dates apply and link the official source, since guidance is still evolving.

From my library

Links from my reading library that help with AI Act work.

github.com

EuConform, an AI Act evidence format

Open evidence format plus bias-evaluation tooling for conformity work. A concrete answer to what high-risk documentation can look like.

 bsi.bund.de

BSI: Generative AI Models

The German federal cyber security authority on opportunities and risks of generative AI. Solid, vendor-neutral input for risk classification arguments.

 iapp.org

IAPP: AI governance in the agentic era

Why governance built for predictive ML does not fit autonomous agents. Good framing when you scope AI Act obligations for agentic systems.

 github.com

Risk-assessment agent (sample)

A LangChain sample that automates an EU AI Act risk assessment. Demo-grade, but a useful starting point if you want to build your own.

Primary sources