AI Act Compliance Framework: Systematically Implement Regulation (EU) 2024/1689 Requirements

Providers of high-risk AI systems listed in Annex III of Regulation (EU) 2024/1689 must establish a quality management system (Art. 17), risk management system (Art. 9), technical documentation (Art. 11), automatic logging (Art. 12) and a post-market monitoring system (Art. 72). ADVISORI structures these requirements into an integrated framework with defined roles and responsibilities.

Risk classification under Art. 6 in conjunction with Annex I and III of Regulation (EU) 2024/1689 determines the entire regulatory burden for an AI system. Only once a system is classified as high-risk do the obligations under Art. 9 (risk management), Art. 11 (technical documentation), Art. 12 (logging) and Art. 17 (quality management) apply. Within the compliance framework, the AI inventory with risk classification therefore forms the foundation for all subsequent measures — without this mapping, neither resources can be planned nor conformity assessments prepared.

Regulation (EU) 2024/1689 entered into force on 1 August 2024. Prohibited practices have applied since February 2025. Requirements for AI literacy (Art. 4) and rules for general-purpose AI models apply since August 2025. Full applicability for Annex III high-risk systems takes effect on 2 December 2027. High-risk systems embedded in regulated products (Annex I) face a deadline of August 2028.

The conformity assessment for high-risk systems covers the quality management system, technical documentation, risk management system and data governance. Depending on the system category, it is performed as an internal check (Art. 43(1)) or by a notified body (Art. 43(2)). ADVISORI prepares all documentation and internal processes for the assessment.

An AI Act framework complements existing compliance structures (ISO 27001, GDPR, DORA) rather than replacing them. Integration happens through a central AI inventory, role-based responsibilities (AI officer, risk management, data protection), shared documentation standards and aligned audit cycles. ADVISORI identifies overlaps and builds a lean governance structure that covers multiple regulatory requirements simultaneously.

The AI Act provides tiered fines: up to EUR 35 million or 7% of global annual turnover for prohibited practices, up to EUR 15 million or 3% for violations of high-risk requirements and up to EUR 7.5 million or 1.5% for providing incorrect information to authorities. SMEs and start-ups are subject to lower caps. A structured compliance framework systematically reduces the risk of penalties.

The process follows a structured approach: (1) AI system inventory and stocktaking, (2) risk classification per Annex I and III, (3) gap analysis against regulatory requirements, (4) quality management system and technical documentation setup, (5) implementation of monitoring and reporting processes, (6) conformity assessment preparation, (7) ongoing monitoring and regulatory tracking. ADVISORI supports all phases from initial assessment through operational deployment.