AI Ethics (EU AI Act)

Enforcement of the EU AI Act (Regulation 2024/1689) is arriving in phases. While prohibited AI practices and general-purpose AI rules came into force in 2025, the deadline for High-Risk (Annex III) systems has been pushed via the Digital Omnibus to December 2027. Any organisation that develops, deploys, or distributes AI systems within the European Union must classify each system by risk tier — unacceptable, high, limited, or minimal. Notably, under Article 63, SMEs and microenterprises benefit from specific derogations, allowing them to implement simplified Quality Management Systems (QMS) while avoiding the heaviest administrative burdens of the Act.

High-risk AI systems face the heaviest burden: technical files demonstrating data governance, accuracy metrics, robustness testing, cybersecurity controls, and human oversight protocols must exist before market placement and stay current throughout the system lifecycle. For companies in the electronics and IoT sector, the AI Act intersects with the Cyber Resilience Act, creating overlapping but distinct obligations for connected products that incorporate machine learning.

Sustalium structures this process around the Act's risk tiers. Each AI system in your inventory receives its own compliance record containing the mandated fields — intended purpose, training data provenance, bias evaluation results, transparency notices, and human oversight procedures. Evidence is linked at the system level, so teams managing multiple AI products maintain separate, auditable dossiers without duplicating shared governance policies. When national authorities request documentation, you export a complete conformity package rather than assembling it under deadline pressure.