EU AI Act & AI Compliance

Overview

The EU AI Act is the first comprehensive legal framework written specifically for artificial intelligence systems. It entered into force on 1 August 2024 and its obligations apply in stages: the prohibitions from February 2025, the rules for general-purpose AI models from August 2025, and most high-risk obligations from August 2026, with some in August 2027. In November 2025 the European Commission proposed moving some high-risk dates later, so check the timetable that applies to your system today. The regulation establishes a risk-based classification system for AI applications and imposes corresponding obligations on providers, deployers, and importers of AI systems operating within the European Union.

The Act categorizes AI systems into four risk tiers: unacceptable risk (prohibited), high-risk (heavily regulated), limited risk (transparency obligations), and minimal risk (largely unregulated). High-risk AI systems, which include those used in employment, education, credit scoring, law enforcement, and critical infrastructure, face the most stringent requirements, including conformity assessments, quality management systems, and ongoing post-market monitoring.

For AI developers and organizations training their own models, the EU AI Act introduces detailed requirements around training data governance, documentation, and transparency. Article 10 establishes obligations for training data quality, relevance, representativeness, and the examination of possible biases. Article 11 mandates technical documentation that describes the AI system's intended purpose, design specifications, training methodologies, and validation results. These requirements represent a fundamental shift in how AI development must be documented and governed.

AI-Specific Requirements

The EU AI Act's training data governance requirements under Article 10 are among the most impactful provisions for AI development teams. Providers of high-risk AI systems must ensure that training, validation, and testing datasets are subject to appropriate data governance and management practices. This includes examining data for possible biases, identifying data gaps or shortcomings, and implementing measures to address representation issues. Training datasets must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete.

Article 13 establishes transparency requirements mandating that high-risk AI systems be designed and developed so that their operation is sufficiently transparent to enable deployers to interpret outputs and use the system appropriately. This includes clear documentation of the system's capabilities, limitations, known risks, and the characteristics of the training data. For general-purpose AI models (including foundation models), Article 53 adds further obligations around training data documentation, including a sufficiently detailed summary of the content used for training.

The Act also requires quality management systems (Article 17) covering risk management procedures, data governance protocols, post-market monitoring plans, and incident reporting mechanisms. High-risk systems must be designed to record events automatically over their lifetime (Article 12), and deployers must keep those logs for at least six months (Article 26). Providers must maintain technical documentation throughout the AI system's lifecycle and cooperate with national market surveillance authorities. Non-compliance penalties are severe, with fines up to 35 million euros or 7 percent of global annual turnover for prohibited AI practices, and up to 15 million euros or 3 percent for most other violations.

How Ertas Helps

Most of the Act's obligations sit with the provider of an AI system, and when you train a custom model for your own use case, that provider is often you. Ertas gives you a training process you control. In Ertas Studio you choose the base model, build or upload the dataset, and run and compare training runs. Studio stores the dataset behind each run so it can be repeated, which gives you source material for the data governance record Article 10 asks for and the technical documentation required by Article 11. Training runs on Ertas's cloud GPUs, so the dataset is uploaded to Ertas; minimize personal data in it first, since GDPR applies alongside the Act.

The trained model is yours. Export it as GGUF or safetensors and run it in your own environment, where you build the event logging of Article 12 and the human oversight of Article 14 into systems you operate, and where inference data never reaches Ertas. The model version stays fixed until you retrain, so the model you documented and assessed is the one deployed. The adaptive model endpoint and enterprise builds can also run the model in your own cloud or on-premise.

Risk classification, the risk management system, the bias examination of your data, conformity assessment, post-market monitoring and incident reporting stay with you. Ertas does not classify your system or produce conformity documentation for it.

Compliance Checklist