You don’t need to read every law. You need to know which of your AI systems are in scope, who is accountable for each, and whether you could prove your controls work tomorrow.
AI regulation has moved from white papers to deadlines. Fines in the EU AI Act reach 7% of global annual turnover for the most serious breaches. US states are passing their own laws, and sector regulators have made clear that existing rules already apply to AI. For a risk or compliance leader, the question has shifted from “will this be regulated?” to “can we show our work?”
1. Your exposure depends on use, not on technology
Regulators don’t regulate “AI” in the abstract. They regulate what it’s used for. The same model is unregulated in a marketing copy tool and high-risk when it scores loan applicants or screens job candidates. Your first job is to map uses, not models.
The EU AI Act makes this explicit with four tiers: prohibited practices, high-risk systems, systems with transparency duties (chatbots, synthetic content) and everything else. High-risk uses are listed: credit scoring, employment decisions, access to essential services, education, critical infrastructure, among others.
2. You’re probably a “deployer”, and deployers have duties too
Most enterprises don’t build foundation models; they deploy them. The EU AI Act assigns deployers of high-risk systems their own obligations: use the system according to its instructions, assign competent human oversight, monitor operation, keep logs, and in some cases run a fundamental rights impact assessment. Buying from a vendor doesn’t transfer your accountability.
3. The timeline is staggered, and some of it is already live
| Date | What applies |
|---|---|
| Feb 2025 | EU prohibited practices banned; AI literacy duty for staff who operate AI |
| Aug 2025 | Obligations for general-purpose AI model providers; penalty regime |
| Aug 2026 | Transparency duties: tell people they’re dealing with AI, label deepfakes, mark AI-generated content |
| Dec 2026 | New ban on AI that generates non-consensual intimate images or child sexual abuse material; content-marking deadline for AI systems already on the market |
| Dec 2027 | High-risk obligations for Annex III uses such as credit, hiring and essential services (moved from Aug 2026 by the Digital Omnibus) |
| Aug 2028 | High-risk obligations for AI built into regulated products, such as medical devices and machinery |
| Already in force | US sector rules applied to AI (fair lending, consumer protection, employment), NYC bias audits for hiring tools |
4. AI changes faster than your control cycle
Quarterly model validation was designed for models that change quarterly. Generative and agentic systems change whenever someone edits a prompt, a vendor ships a new model version, or an agent is granted a new tool. If those changes bypass review, your last validation describes a system that no longer exists.
Treat a prompt edit or a model swap as a production change. It needs an owner, a review and a record.
5. What your board and regulators will ask
- How many AI systems do we run, and which are high-risk?
- Who approved each one, and on what basis?
- What changed since the last review, and who signed off?
- How would we know if one started behaving badly, and how fast could we stop it?
- Which policies and regulations does each system map to, and where are the gaps?
If any answer takes a week of emails to assemble, that’s your first project.
A 90-day starting plan
- Days 1–30: build the inventory, including vendor and embedded AI. Assign an accountable owner to each system.
- Days 31–60: classify each use against the EU AI Act tiers and your sector rules; adopt NIST AI RMF or ISO 42001 as your control backbone.
- Days 61–90: put model, prompt and tool changes under change control, and start collecting evidence you could hand to an examiner.
Where AgentFlow fits
AgentFlow is built for this plan: an inventory of AI systems and use cases, applicability mapping against EU, US federal and state regulations, policy packs for the EU AI Act, NIST AI RMF and ISO 42001, review queues for changes, and signed, exportable evidence. Join the waitlist →