AI regulation, what executives need to know
What the European AI Act requires, who it reaches outside Europe, and what is worth documenting even if your company isn't obligated yet.
AI regulation has moved from committee topic to concrete operational consequence. An executive doesn't need the legal detail, but does need three things: who it reaches, what counts as risky, and what you have to be able to show.
The risk-tiered approach
The European AI Act organizes obligations by the risk of the use, not by the technology. The same model can face different requirements depending on what it's applied to.
Unacceptable risk: prohibited uses, such as social scoring by public authorities or certain forms of manipulation.
High risk: systems used in recruitment and workforce management, credit assessment, education, access to essential services, critical infrastructure. These carry the heaviest obligations.
Limited risk: mainly transparency duties, such as informing people they're interacting with an automated system.
Minimal risk: most everyday enterprise applications, with no specific obligations beyond general law.
The practical consequence is that most internal and productivity use cases fall into the lower tiers. Serious obligations appear when the system affects people's rights or opportunities.
Who it reaches
The test isn't where the company is based, but where the system or its outputs are used. A Latin American company offering an AI-powered service to European customers, or assessing candidates in Europe, can fall within scope.
Role matters too: obligations differ for those who develop a system and those who deploy it in their operations. Most companies sit in the second group, with narrower but non-trivial duties: human oversight, use consistent with the provider's instructions, monitoring and record keeping.
What it asks for, in practical terms
For a high-risk system, the requirements look a lot like what any internal control function would ask:
- Documentation of what the system does, with what data and with what limitations.
- Effective human oversight, not nominal: someone with real ability to review and reverse.
- Documented risk management, reviewed periodically.
- Operational logs that allow decisions to be reconstructed.
- Information to affected people about the system's use.
None of this is exotic. What's usually missing isn't capability — it's that nobody wrote it down.
The inventory worth having now
Regardless of legal obligation, there's one document every organization should have and almost none do: an inventory of AI systems in use.
A spreadsheet with six columns is enough:
- Which system or tool.
- For which process.
- What data it consumes.
- Which decisions it influences or makes.
- Who supervises it.
- Which vendor, under what contractual terms.
Building it takes a few hours and solves three problems at once: compliance, security and spend management. It also tends to reveal tools in use that nobody had registered.
What to ask a vendor
Four questions worth asking before contracting, which any vendor should answer in writing:
- Where is data processed and stored?
- Is our data used to train models?
- What technical and limitations documentation do you provide?
- What support do you offer in the event of a regulatory request or audit?
If a vendor can't answer those four, that's meaningful information in itself.
The standard that doesn't change with the law
Beyond jurisdiction, there's one standard worth adopting because it's also good practice: if a person is affected by a decision an automated system took part in, someone must be able to explain how it was made and review it.
An organization that meets that standard will be close to meeting almost any future regulation.
Frequently asked questions
Does the European AI Act apply to companies outside Europe?
It can. It reaches those placing AI systems on the EU market or whose outputs are used within the Union, regardless of where the company is based.
Which systems count as high risk?
Among others, those used in recruitment and workforce management, credit assessment, education, critical infrastructure and access to essential services. Those cases require documentation, human oversight and risk management.
What should we document even without a legal obligation?
Which AI systems are in use, for what, with what data, who supervises them and which decisions they affect. That inventory is the foundation of any future compliance and takes only a few hours to build.