GDPR was just practice. The AI Act is the exam.
Article 9 to 17 lands in 2026. The fine for non-compliance hits 7% of global turnover. Your high-risk AI use cases are still sitting in someone's inbox.
AI Act lands in 2026 with up to 7% of turnover fines. Most organisations can't list every AI use case in production today. Fix it with an AI register on Microsoft Purview + risk tiering + Responsible AI guardrails. Register live in three weeks.
If half of these sound familiar, this is your fight.
No formal assessment needed, just an honest look at the daily friction.
You can't list every AI use case running in production today.
No risk tier (minimal · limited · high · unacceptable) has been assigned to any model.
GDPR ROPA was last updated more than a year ago.
Privacy impact assessments are a Word doc nobody opens.
Documentation, evaluation and human oversight aren't in any current AI project plan.
The DPO and CISO have never sat in the same AI roadmap meeting.
Why it happens
AI under the radar
Marketing, HR, finance and IT each launched copilots and pilots. No central register, no risk tiering.
Legacy GDPR debt
Inventories drifted, retention rules evaporated, ROPA hasn't been refreshed. Now AI obligations stack on top.
No operating model
Compliance is reactive, project-by-project. Without a steering committee, every new use case starts from zero.
What it costs you
Up to 7% of turnover
AI Act fines are calibrated to global revenue: the largest fine bracket in EU regulatory history.
Project paralysis
Without a risk-tier framework, every new AI use case becomes a six-month legal review.
Reputational risk
A high-profile failure (biased model, leaked data, opaque decision) lands on the front page within hours.
The shortest path from problem to results.
Microsoft-first stack. Belgian and Estonian engineering. Senior team kickoff through delivery to support.
AI Act readiness assessment
Risk tier every use case, map to Articles 9-17, build a remediation backlog, in three weeks.
See solutionGovernance on Microsoft Purview
Classifications, retention, sensitivity labels, lineage: live in your tenant, audit-ready.
See solutionResponsible AI guardrails
Content filters, evaluation harnesses, human-in-the-loop, model cards: AI Act compliant by design.
See solutionWhen 14 AI pilots got tier-mapped and 4 went under glass.
AI Act register · 14 use cases tiered in three weeks
A Belgian financial-services group with 14 AI pilots and zero risk tiering. We built an AI register on Microsoft Purview, tiered each use case, killed four high-risk ones, mapped the rest to Articles 9-17. DPO and CISO signed off. First audit passed first time.
AI Act readiness is achievable. Pick a Tuesday.
Free 60-minute readiness call: we'll map your highest-risk use cases first.
Common questions, direct answers.
When does the EU AI Act actually start enforcing?
Phased: prohibited practices already enforced (Feb 2025), GPAI obligations Aug 2025, high-risk system obligations Aug 2026, full enforcement Aug 2027. Don't wait until late 2026.
What are the AI Act risk tiers?
Four levels: unacceptable (banned), high-risk (Articles 9-17 obligations), limited risk (transparency rules), minimal (no rules). Most enterprise use cases land in limited or high-risk.
How do we know which of our AI is "high risk"?
Annex III lists eight high-risk categories: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice. If none apply, you're typically limited risk.
Do GenAI tools like Copilot count?
Microsoft Copilot is GPAI. Obligations sit primarily with Microsoft. But how YOU deploy it (e.g., for hiring decisions) can move it into your Article 9-17 obligations as deployer.
Can we be AI Act compliant without slowing down innovation?
Yes: risk-tier early, document continuously, automate evidence. Compliance becomes a side effect of how you build, not a six-month review at the end.