AI governance
EU AI Act: what it requires and how to self-assess
Regulation (EU) 2024/1689 on artificial intelligence
Direct support
Talk to an EU AI Act specialist
Reply within one business day.
Short answer
The EU AI Act is the European Union’s regulation for artificial intelligence. It bans certain practices outright, and attaches obligations to AI systems according to risk tier: high-risk systems carry requirements for risk management, data governance, technical documentation, human oversight and monitoring, while limited-risk systems carry transparency duties. General-purpose AI models carry their own documentation and transparency obligations. Obligations apply in stages, so which duties and deadlines reach you depends on the system you operate and your role.
Why it matters
What EU AI Act readiness does for the business.
Know what you are running
You cannot classify AI risk you cannot list. The programme produces an inventory with owner, vendor, data and use case for every system.
Obligations that follow the risk tier
Prohibited, high-risk, limited-risk and general-purpose systems carry different duties. Readiness assigns the duties that apply to each system you hold.
Documentation before anyone asks
Technical documentation, oversight records and post-market monitoring are written as you deploy, not reconstructed under enquiry.
Scope
Who it applies to
- Providers placing AI systems on the EU market, wherever they are established.
- Deployers using AI systems in the EU in the course of their business.
- Non-EU organisations whose AI outputs are used in the EU.
- Providers of general-purpose AI models made available in the EU.
- Importers, distributors and authorised representatives in the supply chain.
Controls
Key requirements
- Screen every AI use case against the prohibited practices before it ships.
- Classify each system by risk tier: high-risk, limited-risk or minimal-risk.
- For high-risk systems, run a risk management system across the lifecycle.
- Apply data governance: training, validation and testing data that are relevant and representative.
- Write the technical documentation and keep the logs the regulation expects.
- Provide instructions for use, transparency information and human oversight arrangements.
- Meet accuracy, robustness and cybersecurity requirements for high-risk systems.
- Operate a quality management system, then register and mark conformity where required.
- Monitor after market release and report serious incidents through the prescribed route.
The programme
How we take you through EU AI Act.
Platform and people on the same path: Fortress holds the controls and the evidence, our team runs the assessment with you, and nothing is rebuilt when the auditor arrives.
- 01
Inventory AI systems and roles
We list every AI system in development, procurement and use, and record whether you act as provider, deployer or both for each one.
- 02
Classify against the Act
Each use case is screened for prohibited practices and classified as high-risk, limited-risk, minimal-risk or general-purpose, with the reasoning recorded.
- 03
Run the gap assessment
Policies, technical documentation, oversight arrangements, data governance and quality processes are assessed against the obligations that apply.
- 04
Build the governance route
Accountability, approvals, AI literacy, human oversight and the quality management system are written, assigned and scheduled.
- 05
Assemble the evidence set
Documentation, risk assessments, oversight records, logs and vendor terms are collected per system in Accord.
- 06
Monitor and re-review
Changes to systems, models and guidance are tracked, with post-market monitoring and incident routes in place for each cycle.
Before / after
Where teams start, and where EU AI Act readiness leaves them.
Before · status quo
What the organisation looks like today.
- 01
AI arrives through pilots and procurement, and nobody holds the full list.
- 02
Risk tier is guessed per project, on the day someone asks.
- 03
Technical documentation is written after deployment, if at all.
- 04
Oversight is claimed in a policy but recorded for no live system.
After · with Risknox
What changes once the programme is running.
- 01
One register covers every system, vendor and owner.
- 02
Each system carries its risk tier and the duties that follow from it.
- 03
Documentation is written as the system is deployed.
- 04
Oversight decisions and monitoring are recorded against the system.
Self-assess it in Fortress
Three steps from “where do we stand” to a plan.
- 1
Pick EU AI Act
Choose it in the GRC builder. Your first framework is included, and shared controls are reused if you add another.
- 2
Answer and attach evidence
Work through the control set, assign an owner to each control and attach the evidence behind the answer.
- 3
Get the gap report
See what is missing, with severity, a named owner and a remediation plan you track to closure.
Product screenshot
Self-assessment and audit readiness. Formal certification or attestation is done by an accredited auditor.
Readiness check
Two questions, and an indicative band for EU AI Act.
No login. Nothing is stored until you ask for the plan.
Team size
Where are you today?
Pick a team size and where you are today to see the band.
Questions we get asked
Does the EU AI Act apply to our company if we are outside the EU?+
It can. Providers and deployers established outside the EU fall in scope where the AI system or its output is used in the Union, and general-purpose model providers have their own obligations. The role you hold for a given system decides which duties apply.
What makes an AI system high-risk?+
The regulation lists high-risk areas in its annexes, covering things such as safety components of regulated products and a set of use cases in employment, education, essential services, law enforcement, migration and justice. The first step is an inventory: you cannot classify systems you have not listed.
Is the EU AI Act a certification?+
No. It is a regulation with legal obligations. Some high-risk systems go through a conformity assessment and carry CE marking, but that is a regulatory procedure, not a certificate of good practice. ISO/IEC 42001 is the certifiable management system that can sit underneath it.
What is the difference between a provider and a deployer?+
A provider develops or places an AI system on the market under its own name. A deployer uses an AI system in the course of its activities. The same organisation can be both, for different systems, which is why the inventory records a role per system.
How does Accord help with EU AI Act readiness?+
Accord holds the AI inventory with owner, vendor, data class and role, records the risk classification and its reasoning, and keeps the documentation, oversight records and monitoring evidence per system.
Self-assessment and audit readiness, in one place.
The control set, the evidence and the gap report — no rebuild when the auditor arrives.
Last updated November 2026