AI Governance and Program Management · Topic 2 of 6
AI Regulatory Requirements and the EU AI Act
AI regulation for security managers: EU AI Act risk tiers, provider and deployer duties, phased application, penalties, GDPR overlap and conformity.
- 6 min
- Includes a diagram
- EU AI Act tiers: unacceptable (banned), high, limited (transparency), minimal.
- Providers carry the heaviest duties; deployers must follow instructions, oversee, monitor and keep logs.
- Changing purpose or substantially modifying a high-risk system can make a deployer a provider.
What it is
AI is now regulated directly, and it is also caught by laws that already existed for data, consumers, employment and specific sectors. The security manager does not interpret the law alone; legal counsel does. The manager's job is to make sure obligations are identified, mapped to controls, evidenced and monitored as they change.
The most detailed AI law is the EU AI Act (Regulation (EU) 2024/1689). It takes a risk-based approach: the higher the risk an AI use poses to health, safety and fundamental rights, the stricter the rules.
How it works
EU AI Act risk tiers
| Tier | Examples | Consequence |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative techniques that cause harm, exploiting vulnerabilities of specific groups, untargeted scraping of facial images, emotion recognition in workplaces and schools (with narrow exceptions) | Prohibited |
| High risk | AI as a safety component of regulated products; listed uses in areas such as biometrics, critical infrastructure, education, employment, access to essential services such as credit, law enforcement, migration and justice | Strict requirements before and after placing on the market |
| Limited risk | Chatbots, AI-generated or manipulated content such as deepfakes | Transparency: people must be told they are dealing with AI or that content is AI-generated |
| Minimal risk | Spam filters, AI in video games | No specific obligations; voluntary codes encouraged |
General-purpose AI models have their own obligations, such as technical documentation, information for downstream providers, a copyright policy and a summary of training content. Models with systemic risk must also be evaluated, including adversarial testing, and their providers must report serious incidents and ensure cybersecurity.
Roles and duties
| Role | Who | Key duties for high-risk AI |
|---|---|---|
| Provider | Develops an AI system or has it developed and places it on the market under its own name | Risk management system, data governance, technical documentation, logging, instructions for use, human oversight design, accuracy, robustness and cybersecurity, quality management, conformity assessment, registration, post-market monitoring, serious incident reporting |
| Deployer | Uses an AI system under its authority in a professional capacity | Use it according to the instructions, assign competent human oversight, monitor operation, keep the logs it controls, inform the provider of serious incidents, inform affected workers, and in certain cases carry out a fundamental rights impact assessment |
| Importer and distributor | Bring systems into or make them available on the EU market | Verify the provider has met its obligations |
A deployer becomes a provider if it puts its own name on a high-risk system, makes a substantial modification to it, or changes its intended purpose so that it becomes high-risk. This matters for organizations that customize vendor AI.
The Act applies to providers placing AI on the EU market wherever they are based, and to providers and deployers outside the EU when the AI output is used in the EU.
Phased application and penalties
The Act entered into force on 1 August 2024 and applies in stages. Prohibitions and the AI literacy duty applied first, from 2 February 2025. Obligations for general-purpose AI models followed from 2 August 2025, and most remaining obligations apply in later stages. The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk rules to 2 December 2027 for listed uses and 2 August 2028 for AI in regulated products.
| Infringement | Maximum fine |
|---|---|
| Prohibited AI practices | EUR 35 million or 7% of worldwide annual turnover, whichever is higher |
| Most other obligations | EUR 15 million or 3% |
| Supplying incorrect or misleading information to authorities | EUR 7.5 million or 1% |
Other laws that apply to AI
| Law or rule | Why it matters for AI |
|---|---|
| GDPR and similar privacy laws | Lawful basis for training and inference data, data protection impact assessments for high-risk processing, rules on solely automated decisions with significant effects, data subject rights, breach notification to the supervisory authority within 72 hours |
| Sector rules | For example banking model risk guidance, medical device rules, insurance and employment rules |
| Local laws | For example New York City's rules requiring bias audits of automated employment decision tools |
Conformity and evidence
For high-risk AI, the provider carries out a conformity assessment, by itself or in some cases through a notified body, before the system is placed on the market. Deployers need evidence that their vendor has done so, and must keep their own evidence of oversight, monitoring and impact assessment.
The security manager supports this with an obligations register: each requirement, the AI systems it applies to, the control that meets it, the owner and the evidence. Regulatory change is tracked as an input to risk reassessment.
A worked example
A bank buys a vendor credit-scoring model to use for consumer loans in the EU. Credit scoring of individuals is a listed high-risk use, so the bank is a deployer of a high-risk system.
The security manager works with legal to confirm the vendor's conformity evidence, sets up human oversight by trained credit officers, makes sure logs are retained, and plans the fundamental rights impact assessment that the Act requires before AI is used to assess the creditworthiness of individuals. When the bank's data scientists propose retraining the model on the bank's own data and changing its purpose, the manager flags that this could make the bank a provider and asks legal to review before work starts.
How the exam asks about this
- "Which EU AI Act category applies to a customer service chatbot?" Limited risk, with transparency duties.
- "An organization substantially modifies a vendor's high-risk AI system. What is the MOST important consequence?" It may take on the provider's obligations.
- "What should the security manager do FIRST when a new AI regulation is announced?" Work with legal to determine whether and how it applies to the organization's AI inventory.
What to remember for the exam
- EU AI Act tiers: unacceptable (banned), high, limited (transparency), minimal.
- Providers carry the heaviest duties; deployers must follow instructions, oversee, monitor and keep logs.
- Changing purpose or substantially modifying a high-risk system can make a deployer a provider.
- Maximum fines for prohibited practices: EUR 35 million or 7% of worldwide turnover.
- Existing privacy, sector and consumer laws still apply to AI.
The AI inventory is the starting point for compliance. An organization cannot classify AI uses or map obligations for systems it does not know it has.
Common mistakes
Assuming the AI Act only concerns EU companies. It also reaches non-EU providers placing AI on the EU market and cases where AI output is used in the EU.
Treating every AI system as high risk. Classification depends on the use. Over-classifying wastes effort; under-classifying creates legal exposure.
Letting security interpret the law. Legal counsel interprets obligations. Security maps them to controls and evidence.
Check yourself
What are the four EU AI Act risk tiers?
Unacceptable risk, which is prohibited; high risk; limited risk with transparency duties; and minimal risk.
What is a deployer under the EU AI Act?
An organization that uses an AI system under its authority in a professional capacity, as opposed to the provider that develops and places it on the market.
Why keep an obligations register for AI?
It links each legal requirement to the AI systems, controls, owners and evidence, so compliance can be shown and changes tracked.
Topic 2 of 6 in AI Governance and Program Management
Test yourself on AI Governance and Program Management
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.