The EU AI Act is in force. Prohibitions applied in February 2025. High-risk system obligations are phasing in now. Most mid-market organisations have done very little to prepare — and the window for that to be acceptable is closing.

The EU AI Act's risk classification system is the foundation of everything else in the regulation. Get it wrong and you either over-invest in compliance for systems that don't need it, or — more dangerously — under-invest in systems that do. This guide walks through the framework in plain language.

Every conversation about AI governance eventually reaches the same question: who owns this? In most organisations, AI has been treated as a technology matter. The EU AI Act, NIST AI RMF, and ISO 42001 all share a different view — AI governance is a risk management problem, an accountability problem, and a board-level responsibility.

Compliance professionals working on AI governance frequently encounter both the NIST AI RMF and the EU AI Act in the same conversation. They address overlapping concerns and use similar language — but they are very different in nature. Here is how to think about both, and whether you need to engage with each.