EU regulation · Artificial Intelligence Act
Sightadel guides you from taking stock of your AI systems, through role and risk class, to the obligations that follow – with templates from practice, drafting help and real consultants for the difficult parts. You decide which of them apply to you, with documented reasoning.
What it is about
The AI Act, Regulation (EU) 2024/1689, governs the use of artificial intelligence in the EU. It applies directly, without an implementing act. Its approach is risk-based: the greater the potential consequences for health, safety and fundamental rights, the stricter the obligations. Some practices are prohibited outright, high-risk systems are subject to extensive requirements, transparency obligations apply to certain systems, and the rest remains largely unregulated.
Your role is decisive. Providers develop an AI system or place it on the market under their own name and carry most of the obligations. Deployers use a system under their own authority, for example in HR or customer service. Deployers have obligations too: they must use the system as intended, ensure human oversight and, in certain cases, inform the people affected.
The obligations take effect in stages. The prohibitions and the AI literacy obligation have applied since February 2025, the rules for general-purpose AI models since August 2025, and the transparency obligations since August 2026. An amending regulation in 2026 postponed the high-risk obligations: to December 2027 for stand-alone high-risk systems and to August 2028 for AI in regulated products. There is no certificate for the regulation as a whole.
AI is built into standard software, chatbots and analytics. As a deployer, you need an inventory, trained staff and clarity on whether a system falls into a high-risk area, such as candidate selection or credit checks.
As a provider, you carry the main burden: risk management, technical documentation, quality management and, for high-risk systems, a conformity assessment before placing on the market.
Clients want to know how you govern AI before they use your product. Well-maintained evidence and a Trust Center answer that once, rather than afresh in every questionnaire.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
You know which AI systems you provide or use, which role you have in each case and which risk class a system falls into.
In SightadelThe AI inventory records each system with its purpose, owner, role and classification. Guiding questions lead you through the classification; you record the decision and its reasoning.
Certain applications are prohibited, such as manipulative techniques, social scoring or emotion recognition in the workplace, apart from narrowly defined exceptions.
In SightadelOne control per prohibited practice, answered for every system in the inventory. The result is filed with a date and resubmitted for review when something changes.
Providers and deployers take measures so that their staff build the knowledge needed to handle the systems in use. The 2026 amendment reworded this requirement; it did not delete it.
In SightadelTraining as recurring cycles with attendance records and expiry dates. The same evidence counts towards ISO 42001.
For high-risk systems, risk management across the entire lifecycle and requirements for the provenance, quality and representativeness of training, validation and test data.
In SightadelRisk register per system, linked to measures and review dates. Information on data sources and data quality is collected step by step and filed as evidence.
Technical documentation demonstrating that the requirements are met, and automatic logging of events during operation.
In SightadelThe structure of the documentation as controls with a template. Missing parts become tasks with a deadline; versions remain traceable.
Clear instructions for use for deployers, effective human oversight and an appropriate level of accuracy, robustness and cybersecurity.
In SightadelFor oversight and cybersecurity, you link existing evidence from ISO 27001. You decide who oversees the system and when to intervene.
Providers of high-risk systems operate a quality management system, undergo a conformity assessment, affix the CE marking, register the system in the EU database and monitor it after placing on the market.
In SightadelEach step as a control with evidence. The declaration of conformity and registration are filed with a date; post-market monitoring runs as a scheduled cycle.
Deployers of high-risk systems use them in accordance with the instructions for use, ensure human oversight, keep logs and, in certain cases, carry out a fundamental rights impact assessment.
In SightadelSeparate controls for deployers, distinct from those for providers. The impact assessment is collected step by step and filed alongside the data protection impact assessment.
People are told that they are interacting with an AI. Artificially generated or manipulated content is recognisable as such.
In SightadelControls per affected system; evidence such as notice texts or labelling procedures is linked.
Process
Inventory, classification and basic obligations can be evidenced in two to four months. If you provide high-risk systems, plan for around a year, and this should be completed before December 2027.
Record all AI systems, including those embedded in standard software and cloud services. Without an inventory, nothing can be classified.
For each system, determine the role as provider or deployer, rule out prohibited practices and record the risk class. Have borderline cases clarified legally.
Train staff, implement transparency notices, adopt responsibilities and an AI policy. These obligations already apply.
Only if affected: implement and evidence risk management, data requirements, technical documentation, logging and human oversight.
Providers of high-risk systems undergo the conformity assessment, draw up the declaration of conformity and register the system.
Add every new application to the inventory, repeat training, record incidents, carry out post-market monitoring and review the classification regularly.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
AI is also built into standard software, cloud services and browser extensions. Survey business units and procurement specifically and also record embedded functions.
The same company can be the provider for one system and the deployer for another. Determine the role for each system individually and give your reasons.
If you claim that a system in an Annex III area poses no significant risk, you must prove it. Record the assessment in writing before the system is used.
A notice to everyone does not replace task-specific training. Differentiate by role, repeat training for new systems and document attendance.
The high-risk deadlines have been postponed, but prohibitions, AI literacy and transparency apply. Meet the applicable obligations now and plan high-risk work backwards from the deadline.
Anyone who substantially modifies a high-risk system or offers it under their own name can become a provider. Before every modification, check whether your role changes.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
The AI management system provides the structure: inventory, responsibilities, risk assessment, impact assessment, lifecycle. Many of the regulation's organisational obligations can be met through it. It does not replace conformity assessment and registration.
GDPRIf an AI system processes personal data, the GDPR applies alongside. The record of processing activities, data protection impact assessment and fundamental rights impact assessment interlock.
ISO/IEC 27001Cybersecurity, access control, logging and supplier assessment are already evidenced there. This evidence carries over into the requirements for robustness and security.
ISO 9001Providers of high-risk systems need a quality management system. If you work to ISO 9001, you continue to use document control, approvals and corrective actions.
Audit and evidence
Nobody issues a certificate for the regulation as a whole. Providers of high-risk systems demonstrate conformity before placing on the market, depending on the system through internal control or via a notified body, and then affix the CE marking. Market surveillance lies with national authorities. Sightadel does not certify and does not provide legal advice.
Anyone carrying out an audit gets their own access in Sightadel and can never delete anything. Certification to ISO/IEC 42001 is a structured foundation, but not mandatory. If you want an external audit, you choose an auditor from our independent partner network or one of your own. No commission is paid for audits – neither to us nor to the partners.
To the independent auditor networkThe AI Act entered into force in August 2024 and has applied in stages since then. Since February 2025, the prohibitions of certain practices and the AI literacy requirements have applied. Since August 2025, the rules for general-purpose AI models, the governance structures and the penalty provisions have applied. Since August 2026, the transparency obligations for certain AI systems have applied, such as notices for chatbots and the labelling of artificially generated content.
In summer 2026, an amending regulation came into force that originated as part of the EU's so-called Digital Omnibus. Above all, it postponed the high-risk obligations: to 2 December 2027 for stand-alone high-risk systems under Annex III, and to 2 August 2028 for AI in products already subject to EU product legislation under Annex I. For individual obligations, such as machine-readable marking for generative systems already on the market, there are short transition periods. Relief for small and medium-sized enterprises was also extended and the AI literacy requirement reworded.
The postponement is no reason to wait. If you provide a high-risk system, risk management, data requirements, technical documentation and quality management will in our experience take considerably more than a year. And the obligations already in force on prohibitions, AI literacy and transparency affect almost every company. If in doubt, check the exact dates and transitional rules in the current text of the regulation.
The regulation allocates obligations by role. Providers develop an AI system or have it developed and place it on the market or put it into service under their own name or trademark. Deployers use an AI system under their own authority, except for purely private purposes. In addition, there are importers, who bring systems from third countries into the EU, distributors, who resell them, and product manufacturers, who build AI into their products.
A company can have different roles for different systems. If you develop your own assessment tool for clients, you are the provider there. If the same organisation uses standard software with AI for recruitment, it is the deployer there. The role is therefore determined per system, not per company.
Care is needed with modifications. Anyone who substantially modifies a high-risk system, changes its purpose so that it becomes a high-risk system, or distributes it under their own name can become a provider themselves and then takes on the provider's obligations. This affects, for example, companies that further train a purchased model with their own data and offer it as their own product.
In Sightadel, you record the role per system in the AI inventory, with reasoning. Depending on the role, the appropriate controls appear. You have borderline cases clarified legally and file the result as evidence.
An AI system is high-risk in two ways. First, if it is a safety component of a product, or itself a product, that falls under certain EU product legislation and requires a third-party conformity assessment, such as medical devices, machinery or toys. This legislation is listed in Annex I. Second, if it is used in one of the areas listed in Annex III.
Annex III covers, among other things, certain biometric applications, critical infrastructure, education and vocational training, employment and workers management, access to essential private and public services such as creditworthiness assessment and certain insurance, law enforcement, migration and border control, and the administration of justice and democratic processes. For companies outside the public sector, HR, credit and insurance are the most common points of contact.
Not every system in one of these areas is automatically high-risk. The regulation provides for exceptions where a system does not pose a significant risk, for example because it only performs a narrow procedural task or improves the result of a previously completed human activity. Systems that perform profiling of natural persons do not fall under this exception. Anyone relying on the exception must document their assessment.
In Sightadel, guiding questions lead you through the classification. You record the decision and its reasoning, and the classification is resubmitted for review when the system changes.
There is no list price for the EU AI Act in Sightadel. We prepare a quote to match the number of systems, your role and the edition. If your licence includes ISO 27001 or ISO 9001, the permanent discount applies to the EU AI Act as well. You can try it free for 14 days without payment details.
The effort depends almost entirely on whether you provide high-risk systems. For deployers using AI in standard software, inventory, classification, training and transparency notices can be done in a few weeks. Typically involved are IT, data protection, HR, procurement and the business units that actually use AI.
Providers of high-risk systems face a project reminiscent of product approval: risk management across the lifecycle, requirements for training and test data, technical documentation, logging, human oversight, quality management system, conformity assessment, registration and post-market monitoring. If a notified body has to be involved, it invoices its work independently. For classification questions and difficult individual cases, you can book consulting as a package in the app. It does not replace legal advice.
Most companies are deployers. Two obligations apply to them initially, regardless of risk class. First, AI literacy measures: anyone who operates AI systems or uses their output should have the necessary knowledge, tailored to the task and context. The 2026 amendment worded the requirement so that companies take measures to promote literacy rather than guarantee a particular level. You should still be able to evidence these measures. Second, transparency: if a system generates or manipulates image, audio or video content that appears authentic, or text published to inform the public, this must be disclosed in certain cases.
If you use a high-risk system, more is added. You use it in accordance with the instructions for use, assign human oversight to competent persons, ensure that input data is relevant to the purpose, monitor operation, keep the automatically generated logs for at least six months and report serious incidents. Before use in the workplace, you inform the workers and their representatives. Public bodies and certain private deployers, for example in creditworthiness assessment or life and health insurance, additionally carry out a fundamental rights impact assessment.
In Sightadel, deployer obligations are set up as separate controls, distinct from those of providers. Training runs as cycles with attendance records; the impact assessment sits alongside the data protection impact assessment.
Providers of high-risk systems draw up technical documentation before the system is placed on the market. Among other things, it describes the purpose, design, development, data, testing, performance limits, risk management, human oversight and changes over the lifecycle. On top of this come the instructions for use, quality management system, EU declaration of conformity, CE marking, registration in the EU database and a post-market monitoring plan. Small and medium-sized enterprises may keep the documentation in simplified form.
For most Annex III systems, the provider carries out the conformity assessment itself, by way of internal control. For certain biometric systems and for products under Annex I, a notified body is involved. Harmonised standards, compliance with which gives rise to a presumption of conformity, are being developed at European level. Where they are still missing, demonstrating conformity takes more effort.
Market surveillance lies with national authorities. In Germany, under the implementing act adopted in 2026, the Federal Network Agency (Bundesnetzagentur) is the central market surveillance authority, while sectoral supervisory authorities retain responsibilities in their areas. The European Commission's AI Office is responsible for general-purpose AI models. Anyone carrying out an audit gets their own access in Sightadel to the inventory, classifications and evidence: they can comment and, once approved, edit, but never delete.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
Very probably, as soon as you provide AI systems or use them professionally. The AI literacy obligation applies to all providers and deployers. How much more is added depends on your role and the risk class of the systems. Purely private use is not covered.
Prohibitions and AI literacy since February 2025, rules for general-purpose AI models since August 2025, transparency obligations since August 2026, with transition periods for certain systems already on the market. The high-risk obligations were postponed in 2026: to December 2027 for stand-alone systems and to August 2028 for AI in regulated products.
For prohibited practices, up to €35 million or 7% of worldwide annual turnover; for breaches of other obligations, up to €15 million or 3%; for supplying incorrect information to authorities, up to €7.5 million or 1%. For large companies the higher amount applies, for small and medium-sized enterprises the lower.
No, not for the regulation as a whole. High-risk systems undergo a conformity assessment and bear a CE marking. For the management system behind them, you can be certified to ISO/IEC 42001. An “AI Act certificate” offered on the market has no legal effect.
You are usually a deployer. Record the systems, train your staff and check whether any use falls into a high-risk area, such as HR decisions. For most applications, it stays at AI literacy and transparency.
Yes. The standard provides inventory, responsibilities, risk assessment and impact assessment – the organisational foundation. Legal steps such as conformity assessment, registration or certain transparency obligations need to be checked separately.
The AI Act is not listed as a separate framework in the current price list. Get in touch and we will tell you how you can use it in Sightadel.
No, deliberately not. It provides drafts from templates and helps with wording. You decide on role, risk class and residual risks yourself. Sightadel does not provide legal advice on this.
In principle, yes. You are then usually a deployer. Record the service in the inventory, train the users, set rules for confidential and personal data and check whether any use falls into a high-risk area or triggers transparency obligations. The GDPR applies alongside.
Under the implementing act adopted in 2026, the Federal Network Agency (Bundesnetzagentur) is the central market surveillance authority. Sectoral supervisory authorities retain responsibilities in their areas. The European Commission's AI Office is responsible for general-purpose AI models.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
