AI compliance: from obligations to defensible evidence

Resolve scope before discussing compliance status

Regulation (EU) 2024/1689 establishes harmonised AI rules in the EU. Its provisions distinguish roles and contexts, including providers and deployers of high-risk systems. Buying AI from a vendor does not automatically answer which provisions apply to your activities. A general statement that a product is ‘AI Act ready’ is not a substitute for analyzing your actual intended use and responsibilities.

Create a system-level record of purpose, users, geography, affected people, vendor relationships and planned actions. Ask qualified legal advisors to determine the relevant role, classification and applicable provisions. This article deliberately does not give an application-date calendar: current timing, amendments and implementation guidance must be checked against authoritative sources before relying on them.

Build an obligation-to-evidence map

Once applicability is established, convert the relevant requirements into a working register. Record the provision or authoritative interpretation, why it applies, the responsible owner, the implementation activity and the evidence that will demonstrate it. Separate an obligation that does not apply from one whose applicability remains unresolved. An unknown should not silently become a green status.

Avoid equating a document’s existence with effective implementation. A policy may define approved use, but it does not show that access is restricted, users are trained or exceptions are handled. An assurance reviewer needs to understand how the policy connects to an operating control and how that control was evaluated. Retain evidence that exposes limitations and unresolved gaps as well as successful tests.

Use frameworks without conflating them with law

NIST AI RMF offers voluntary guidance for managing risk. It can help structure inventory, assessment, evaluation and treatment activities, but completing a framework exercise does not prove compliance with the EU AI Act or another law. Similarly, a security assessment addresses particular threats; it does not settle every question about privacy, consumer protection or sector-specific obligations.

Map reusable controls where justified, while keeping the basis for each legal conclusion separate. One access-control review may support several internal risk treatments, but an assessor still needs to know which requirement it addresses and whether additional evidence is necessary. Treat crosswalks as aids to analysis, not as automatic equivalence between different standards and obligations.

Hypothetical example: AI-assisted hiring

Consider an employer using a purchased AI tool to summarize applications and assist candidate screening. This hypothetical example does not classify a real product. The organization should document the intended use and whether recommendations meaningfully influence employment decisions, then seek a qualified assessment of relevant requirements and responsibilities.

The evidence plan could include the approved purpose, vendor information, local configuration, data handling, evaluation results, reviewer instructions and a route for concerns or corrections. A human reviewer should understand the output’s limitations and be able to challenge it; simply inserting a person at the end does not establish that oversight is effective. Changes to workflow or vendor functionality should trigger a renewed review.

Prepare for assurance without promising certification

Executives should ask for a concise summary of systems assessed, unresolved applicability questions, evidence gaps and overdue corrective actions. Require owners to distinguish ‘implemented’, ‘tested’ and ‘independently reviewed’. A dashboard that merges those states into a single green indicator hides uncertainty and weakens the usefulness of the report.

Begin with the most consequential deployments and create a defensible trail from legal assessment to operation. Ensure legal, privacy, security, business and audit teams know where supporting records live and who maintains them. Use self-assessment findings to scope the next review, not to announce compliance. Where applicability or assurance remains uncertain, seek specialist advice before deployment or expansion.

• Record the source and rationale for applicability decisions.
• Track missing evidence separately from unimplemented controls.
• Reassess after material changes to purpose, data, vendor or autonomy.
• Keep compliance conclusions qualified to their assessed scope.