EU AI Act compliance is shifting from policy statements to operating control: registers, risk classification, named owners and retained lifecycle evidence.
Topics: EU AI Act, AI Governance, Risk, Compliance, Evidence
EU AI Act Compliance Trends Organisations Face
A board request for an AI inventory can expose a difficult reality: many organisations cannot say with confidence which AI systems are in use, who owns them, what data they process, or whether a supplier has changed the model underneath. EU AI Act compliance trends are therefore moving beyond policy drafting. The immediate priority is operational visibility that can stand up to internal review, customer scrutiny and regulatory obligations.
For privacy, legal, risk and security leaders, the task is not to create a separate AI compliance programme that sits beside existing controls. It is to establish a repeatable system for classifying AI use, assigning accountability, assessing risk, documenting decisions and preserving evidence throughout the system lifecycle.
EU AI Act compliance trends: from principles to operating control
The first notable shift is from broad responsible AI statements to defined governance workflows. Principles still matter, but they do not answer practical questions: Has the system been registered? Is it within scope? Is it prohibited, high-risk, subject to transparency duties, or outside the relevant categories? Who approved its use? What changes require reassessment?
Organisations are increasingly treating AI governance as a control environment rather than a policy exercise. This means clear intake routes for proposed systems, named system owners, formal risk classification and escalation paths for higher-risk use cases. It also means that the AI register must become a living operational record, not a spreadsheet assembled once for a board presentation.
This approach is especially relevant where AI is embedded in common business tools. A customer service platform, recruitment workflow, fraud system or productivity assistant may use AI features that business teams regard as ordinary software. Governance teams need a process that captures both internally developed systems and supplier-provided functionality, including features enabled after procurement.
The AI system registry is becoming the control point
An AI system registry is emerging as the practical foundation for EU AI Act readiness. It provides one place to identify systems, record their intended purpose, map owners and users, document vendors, note data categories and retain classification decisions.
The quality of the registry matters more than its format. A useful record distinguishes a proof of concept from a production deployment, identifies whether people affected are employees, customers or members of the public, and records the level of human involvement. It should also connect the system to related governance records, including data protection impact assessments, processing records, vendor assessments, contracts and incidents.
Without these connections, teams are forced to reconcile separate sources whenever a question arises. That slows review, creates inconsistent evidence and makes it harder to prove that obligations have been managed consistently.
Classification is becoming more disciplined and less generic
A second trend is greater precision in risk classification. Early programmes often label every AI use case as either low risk or high risk based on an informal judgement. That is not sufficient for organisations that need defensible decision-making.
Classification should begin with the actual intended purpose and deployment context, not the technology label. The same underlying model can create very different obligations depending on how it is used, who relies on its output and the consequences for affected people. An internal drafting assistant will require a different control set from a system supporting decisions in employment, education, creditworthiness or access to essential services.
The practical challenge is avoiding two unhelpful extremes. Treating every system as high risk consumes limited specialist capacity and can delay legitimate innovation. Treating classification as a one-off self-declaration leaves organisations exposed when a system’s purpose, dataset, user group or supplier capability changes.
A structured assessment workflow creates consistency. It can require system owners to describe purpose, affected individuals, decisions supported, input data, human oversight, provider role and geographic deployment. Legal, privacy, security and risk stakeholders can then review the classification through defined approval stages, with a documented rationale retained as evidence.
Governance is extending to the supply chain
Many organisations will consume AI rather than build it. As a result, supplier governance is becoming central to AI Act readiness. A standard third-party questionnaire focused only on information security and personal data processing may not provide enough information about AI functionality, model updates, training data controls, performance limitations or human oversight expectations.
Procurement and vendor risk processes need to identify whether a supplier provides, deploys or materially supports an AI system. Contract review must then capture relevant commitments, such as notification of significant changes, documentation availability, incident cooperation, data-use restrictions and clear allocation of responsibilities.
The right level of review depends on the system’s use and risk. A low-impact workplace tool may need a lighter assessment, while an AI system affecting individuals or supporting material decisions requires deeper scrutiny. The governance objective is proportionality with traceability, not a uniform paperwork exercise for every supplier.
Privacy and AI governance are converging in daily operations
The EU AI Act does not replace GDPR obligations. In practice, the two programmes increasingly meet in the same operational decisions. An AI system that processes personal data may trigger questions about lawful basis, transparency, data minimisation, retention, international transfers, security and automated decision-making alongside its AI Act classification.
That convergence is changing how mature teams organise their work. Instead of maintaining separate AI reviews and privacy assessments with overlapping questions, they are building connected workflows. A DPIA can be initiated when personal data processing warrants it, while an AI risk assessment addresses the AI-specific use case, controls and obligations. The outputs should inform each other without collapsing two distinct assessments into one vague document.
Records of Processing Activities also need to remain aligned with the AI estate. If a new model changes categories of personal data, recipients, processing purpose or retention approach, the ROPA cannot be left behind. Likewise, a Legitimate Interest Assessment may need review where an AI deployment relies on legitimate interests and creates a materially different impact on individuals.
This is where a unified operating system is more valuable than disconnected tools. Privacy360 brings AI system registry and EU AI Act risk classification into the same working environment as DPIAs, LIAs, ROPA, vendor risk assessment, contract review, DSAR management and breach and incident management. The result is clearer ownership and less manual evidence chasing across functions.
Evidence is becoming a continuous requirement
A third major trend is the move from document collection to evidence management. Organisations are recognising that compliance cannot depend on asking teams to locate approvals, assessment versions and supplier correspondence after a problem occurs.
Evidence should be generated as work happens. That includes the initial system intake, classification rationale, review comments, approval history, control assignments, training records where relevant, vendor materials, monitoring outcomes and records of changes. Version control matters because the organisation may need to show what it knew and decided at a particular point in time.
This is also changing the role of incident management. AI-related incidents are not limited to technical outages. They can include unexpected outputs, unsafe recommendations, discriminatory performance concerns, data leakage, misuse, failed human oversight or supplier changes that affect the system’s risk profile. Teams need a route for logging, triaging and investigating these events, then linking the findings back to the affected AI record and related privacy controls.
Human oversight is being operationalised, not assumed
Many AI programmes state that a human remains in the loop. The stronger trend is to define what that actually means. A reviewer who is expected to approve hundreds of system recommendations without sufficient context, authority or time does not provide meaningful oversight.
Organisations are documenting where a person can intervene, what information they receive, when escalation is required and whether they can override an output. They are also considering the competence and independence of the person performing the review. These details are particularly relevant where AI outputs influence decisions with significant effects on people.
Human oversight should be designed around the process, not inserted as a final sign-off. For example, recruitment teams may need clear rules on whether an AI tool can rank candidates, what evidence a recruiter must review before acting, and how a candidate can challenge an outcome. The correct design will depend on the use case, but the rationale needs to be explicit.
The next priority is lifecycle governance
The most effective programmes recognise that AI compliance begins before deployment and continues after it. New data, new users, model updates, changed suppliers and expanded purposes can alter a system’s risk position. An annual review alone may not be enough.
A lifecycle model sets trigger events for reassessment, such as a material model change, an expansion into a new country, a new category of personal data, a complaint pattern or an incident. It assigns action owners and deadlines, while giving programme leaders a consolidated view of overdue reviews, high-risk systems and incomplete evidence.
This is the direction of travel: fewer isolated compliance artefacts and more connected governance operations. Organisations that can see their AI estate, classify use consistently and demonstrate accountable decisions will be better placed to adopt AI at pace without losing control.
Organisations that need specialist support alongside the platform can draw on Formiti's global privacy and AI governance services for outsourced DPO delivery, assessments and regulatory readiness across more than 120 countries.