AI Governance Framework: What I Got Wrong Preparing for the EU AI Act

Frequently Asked Questions

01.When does the EU AI Act apply to my business?

There is no single date. Prohibited practices and AI literacy obligations have applied since 2 February 2025. General-purpose AI model rules began on 2 August 2025. Standalone high-risk systems listed in Annex III were pushed to December 2027, and high-risk systems embedded in products already regulated under other EU law get until August 2028. Treating the furthest date as the deadline is the mistake most founders make.

02.What penalties does the EU AI Act carry?

Prohibited practices carry fines of up to 35 million euro or 7 percent of global annual turnover, whichever is higher. Most other breaches sit in a lower tier of up to 15 million euro or 3 percent of turnover. Both tiers have been enforceable since February 2025, so the exposure is present now rather than arriving with the 2027 high-risk deadline.

03.Is an AI governance policy document enough to comply?

No. The regulation requires that high-risk systems are assessed before market entry and across their whole lifecycle, and that they are overseen by people rather than by automation. A policy document cannot produce a lifecycle decision log on demand. What satisfies an auditor is infrastructure: model cards written before training runs, a record of which humans reviewed which automated decisions, and an override path someone other than the model's author can trigger.