EU AI Act Compliance — Risk Classification, Governance & ISO 42001
The EU AI Act regulates AI by risk. Some uses are prohibited outright, high-risk systems (for example in recruitment, credit, critical infrastructure and medical devices) carry strict requirements, and providers of general-purpose AI models and chatbots have transparency duties.
Prohibitions have applied since February 2025 and general-purpose AI obligations since August 2025, with most high-risk requirements following. Mutex Systems inventories and classifies your AI use, builds the governance the Act expects and tests AI features for security weaknesses.
- Category
- Compliance Framework
- Jurisdiction
- European Union
- Issuing Body
- European Union
- Current Version
- Regulation (EU) 2024/1689 — in force since 1 August 2024, with obligations phasing in from 2025
- Who It's For
- Organisations that develop, deploy, import or distribute AI systems in the EU — including UK and Pakistani software companies whose AI products are used by EU customers.
Core Domains
A Practical Compliance Path
- 01
AI inventory
Identify every AI system you build or use and your role for each (provider, deployer, importer).
- 02
Classification
Map each system to the Act’s risk tiers and list the obligations that apply.
- 03
Governance build
Implement ISO 42001-based policies, risk and impact assessments and human-oversight controls.
- 04
Technical assurance
Test AI features for prompt injection, data leakage and robustness, and keep the technical documentation current.
ISO 42001 as the operating system for the AI Act
We use ISO 42001 as the management system that produces AI Act evidence, so you build governance once and can certify it.
- AI inventory and classification workshop
- ISO 42001-aligned AI policy and impact assessments
- LLM penetration testing aligned to the OWASP LLM Top 10
AI governance with provable human oversight
grComply carries ISO 42001 and EU AI Act obligations side by side, with AI risk and impact assessments and an audit trail showing who reviewed each AI-assisted decision.
- AI system register with risk tier and role
- AI impact and risk assessments linked to controls
- Human-oversight evidence via confirm-before-complete
- Cross-mapping to ISO 42001 and ISO 27001
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About EU AI Act
When does the EU AI Act apply?
It entered into force on 1 August 2024. Prohibited practices have applied since 2 February 2025 and general-purpose AI model obligations since 2 August 2025. Most high-risk obligations apply from August 2026 onwards, with some later; EU institutions have discussed adjusting parts of this timeline, so check the current position for your use case.
Does the EU AI Act apply to UK companies?
Yes, if you place AI systems on the EU market or their output is used in the EU, even when the company is based in the UK or elsewhere.
What are the fines under the EU AI Act?
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, and lower tiers for other breaches.
How does ISO 42001 relate to the EU AI Act?
ISO 42001 is a certifiable AI management system standard. It does not equal legal compliance, but it provides the risk management, documentation and oversight processes the AI Act expects, which makes it the most practical way to organise compliance.
Ready to Start Your EU AI Act Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.