The EU AI Act is now fully enforceable in 2026. If your business develops, deploys, or simply uses AI systems, compliance is no longer optional—it is a structural legal requirement. This guide breaks down exactly what CTOs, legal teams, and founders need to do right now to avoid penalties of up to €35 million or 7% of global turnover.

Since the AI Act entered into force, we have witnessed a fundamental shift in how European businesses approach artificial intelligence. What began as a regulatory framework has evolved into a competitive differentiator: companies that demonstrate robust AI governance win enterprise contracts, attract investment, and build trust with customers. Conversely, those that ignore compliance face not only fines but also reputational damage, contract terminations, and exclusion from public procurement.

In this comprehensive guide, we cover risk classifications, sector-specific obligations, contract requirements, documentation standards, and a practical 90-day implementation roadmap. Whether you run a startup integrating OpenAI APIs or a mid-market company deploying proprietary machine learning models, this article is your starting point for lawful AI operations in the European Union.

1. Understanding AI Risk Classifications

The AI Act categorizes AI systems into four risk tiers. Misclassifying your system is the fastest route to non-compliance, and regulators are increasingly scrutinizing self-assessments that appear overly optimistic.

How to Determine Your Risk Level

The classification process requires a systematic analysis of four dimensions:

1. Intended Purpose: What decision or outcome does the AI system influence? Decisions about people are riskier than decisions about inventory.
2. Deployment Context: Is the system used in healthcare, finance, recruitment, or public administration? Each sector carries different baseline risk assumptions.
3. Autonomy Level: Does the system make fully automated decisions, or does it merely assist human decision-makers? Higher autonomy generally means higher risk.
4. Impact Severity: What harm could result from an erroneous or biased output? Financial loss, discrimination, physical harm, or reputational damage each weigh differently.

2. The AI Act in Spain: AEPD Guidance

While the AI Act is a European regulation with direct effect, the Spanish Data Protection Agency (AEPD) has issued detailed guidance that shapes how businesses in Spain should interpret and implement its requirements. Understanding this local dimension is critical for companies operating from or targeting the Spanish market.

Key AEPD Positions for 2026

• Integrated Assessments: The AEPD insists that AI risk assessments and GDPR Data Protection Impact Assessments (DPIAs) must be integrated into a single process. Running them separately creates gaps and contradictions that regulators will identify.
• Continuous Review: Unlike traditional one-off compliance exercises, algorithmic audits must be ongoing. For High-Risk systems in critical sectors, the AEPD expects annual reviews at minimum.
• Human Oversight Documentation: It is not enough to claim that humans supervise AI. Companies must document who supervises, how they are trained, what authority they have to override, and how override decisions are recorded.
• Third-Party AI: If you use third-party AI APIs (OpenAI, Anthropic, Google), you remain responsible for compliance. The AEPD does not accept "we just use the API" as an excuse for inadequate governance.

Our AI legal advisory service works directly with the AEPD's guidance framework to ensure your compliance program meets both European and Spanish standards.

3. Sector-Specific Compliance Requirements

While the AI Act provides a horizontal framework, its practical application varies dramatically by industry. Here is how compliance looks across key sectors:

Human Resources & Recruitment

AI-powered CV screening, video interview analysis, and performance prediction tools are classified as High Risk. Employers must:

• Notify candidates that AI is used in the selection process
• Ensure the system does not discriminate based on gender, age, ethnicity, or disability
• Provide candidates with meaningful information about how the system evaluates them
• Maintain human review of all negative decisions

Financial Services & Credit Scoring

Credit scoring algorithms and fraud detection systems face intense scrutiny. Banks and fintechs must:

• Document the logic behind credit decisions in plain language
• Test for proxy discrimination (e.g., ZIP code correlating with ethnicity)
• Provide customers with the right to contest AI-driven decisions
• Report annually to regulators on model performance and fairness metrics

Healthcare & Medical Devices

AI used for diagnosis, treatment recommendation, or patient triage is High Risk and often falls under the Medical Devices Regulation as well. Healthcare providers must:

• Validate AI systems on representative patient populations
• Ensure clinicians retain final decision-making authority
• Report adverse events involving AI to both health and AI regulators
• Maintain detailed records of AI-assisted decisions for liability purposes

E-commerce & Retail

Recommendation engines and dynamic pricing systems are generally Limited Risk, but become High Risk if they involve:

• Behavioral profiling that affects access to essential services
• Price discrimination based on sensitive characteristics
• Chatbots that provide legal, financial, or medical advice

4. Core Compliance Obligations by Risk Level

For High-Risk AI Systems

High-Risk systems are subject to the most extensive requirements under the AI Act. These obligations apply to both providers (those who develop the system) and deployers (those who use it in their operations).

• Risk Management System: Continuous identification and mitigation of risks throughout the AI lifecycle. This must be documented, reviewed, and updated regularly.
• Data Governance: Training, validation, and testing data must be representative, free of errors, relevant, and complete. Data quality management must be documented.
• Technical Documentation: Detailed records that allow authorities to assess compliance. This includes system architecture, design choices, training methodologies, and performance metrics.
• Record-Keeping: Automatic logging of events during operation, especially for systems that make decisions about individuals.
• Transparency: Clear information to deployers and end-users about the system's capabilities, limitations, and intended use.
• Human Oversight: Natural persons must be able to intervene and override AI decisions. This requires both technical mechanisms (override buttons) and organizational structures (trained personnel with authority).
• Accuracy & Robustness: Systems must achieve appropriate levels of accuracy, robustness, and cybersecurity. Performance must be measured and documented.
• Conformity Assessment: Either self-assessment (internal quality management system) or third-party audit before market placement or deployment.

For Limited Risk (Generative AI)

Generative AI systems like large language models and image generators face specific transparency obligations:

• Clear disclosure that content is AI-generated (watermarks, metadata, or explicit statements)
• Publication of training data summaries, including sources and copyright considerations
• Prevention of generating illegal content (child abuse material, deepfakes for fraud, etc.)
• Documentation of model capabilities and known limitations

5. AI Clauses in IT Contracts

Your existing IT contracts and SaaS agreements are likely missing critical AI-specific provisions. In 2026, every technology agreement must address the unique risks and regulatory requirements of artificial intelligence. Standard software contract templates simply do not cover the AI Act's demands.

Essential AI Contract Clauses

1. AI System Disclosure: Exact models used, training data sources, version control, and update mechanisms. Vendors must not be allowed to swap models without notice.
2. Bias Mitigation Warranty: Supplier guarantees that algorithms meet fairness standards and have been tested for discriminatory outcomes across protected groups.
3. Human-in-the-Loop Requirement: Contractual obligation for meaningful human oversight, including training requirements and override authority.
4. Audit Rights: Your right to inspect technical documentation, test results, and training data. This includes the right to engage independent auditors.
5. Liability Caps for AI Decisions: Clear allocation of responsibility when AI outputs cause harm. Who pays when the algorithm makes a discriminatory hiring recommendation?
6. Regulatory Change Clause: Automatic contract updates when AI Act amendments, implementing acts, or guidance are published. The regulatory landscape is evolving rapidly.
7. Data Usage Restrictions: Explicit prohibition on using your data to train the vendor's general AI models without separate consent.
8. Explainability Requirements: Vendor must provide interpretable outputs or explanations for individual decisions upon request.

Our AI legal advisory service specializes in drafting and negotiating these clauses to protect your business while maintaining productive vendor relationships.

6. Internal AI Governance Framework

Compliance is not just a legal task—it is an organizational capability. Companies that treat AI governance as a checkbox exercise will fail. Those that embed it into their culture and processes will thrive.

Building Your AI Governance Committee

Every organization using High-Risk AI should establish a cross-functional governance committee with representatives from:

• Legal & Compliance: To interpret regulatory requirements and monitor legal developments.
• Data Science / Engineering: To assess technical feasibility of compliance measures.
• Product Management: To ensure compliance does not destroy user experience or product viability.
• HR / Ethics: To evaluate human impact and organizational readiness.
• Information Security: To address cybersecurity risks specific to AI systems.

Policies You Need in 2026

• AI Use Policy: Which AI tools can employees use? What data can they input? What approvals are required?
• AI Procurement Policy: Due diligence checklist for evaluating AI vendors before purchase.
• AI Incident Response Plan: What happens when an AI system produces a harmful output? Who is notified? What is the remediation process?
• AI Training & Awareness Program: Regular training for staff who interact with or oversee AI systems.

7. Technical Documentation Deep Dive

The AI Act requires extensive technical documentation, but many organizations struggle with what exactly to produce. Here is a comprehensive breakdown:

System Description

• General description of the AI system, including its intended purpose and limitations
• Description of the system's architecture and design choices
• Key functional and technical specifications
• Description of the hardware and software environment

Data Documentation

• Description of training, validation, and testing datasets
• Data collection methodologies and sources
• Data preprocessing, cleaning, and labeling procedures
• Analysis of data representativeness and potential gaps
• Measures taken to detect and mitigate bias in training data

Model Documentation

• Description of the model architecture and algorithms used
• Training methodology, including hyperparameters and optimization techniques
• Validation and testing results, including performance metrics
• Known limitations, failure modes, and edge cases
• Explanation of how the model reaches decisions (interpretability methods)

Operational Documentation

• User instructions and intended use cases
• Known risks and mitigation measures
• Post-market monitoring plan
• Incident reporting procedures
• Version control and change management processes

8. Algorithmic Audits & Continuous Monitoring

The AI Act requires ongoing—not one-time—compliance. The Spanish Data Protection Agency (AEPD) emphasizes that algorithmic audits and Data Protection Impact Assessments (DPIAs) must now be integrated processes, reviewed annually in critical sectors.

What an Algorithmic Audit Covers

• System purpose and intended use cases
• Architecture diagrams and data flows
• Bias testing results and mitigation measures
• Performance drift detection over time
• User instructions and limitations
• Post-market monitoring plans and incident logs
• Human oversight effectiveness assessment

Continuous Monitoring Requirements

High-Risk AI systems must include automatic logging capabilities that record:

• Each time the system is used
• The input data and corresponding output
• Any decision made by the system or with its assistance
• Any intervention by a human overseer
• Any serious incidents or malfunctions

These logs must be retained for a period appropriate to the system's purpose, typically at least six months, and must be accessible to regulators upon request.

9. Real-World Compliance Scenarios

10. Penalties & Enforcement Timeline

The AI Act's penalty structure is designed to be dissuasive. Regulators have significant discretion in determining fines, taking into account the nature, gravity, and duration of the infringement, as well as the size and financial capacity of the offender.

Enforcement in Practice

Penalties are applied by national market surveillance authorities—in Spain, this role falls to the AEPD for systems involving personal data, and to other sectoral regulators for specific applications (e.g., the Spanish Medicines Agency for medical devices). The European AI Office coordinates cross-border cases and maintains a public database of non-compliant systems.

Importantly, the AI Act allows for administrative fines on both providers and deployers. If you use a third-party AI system that is non-compliant, you may still face penalties for deployment. This makes vendor due diligence not just a procurement best practice but a legal necessity.

11. Frequently Asked Questions

12. Your 90-Day Action Plan

Compliance is a journey, not a destination. Here is a practical roadmap to get your organization AI Act-ready in 90 days:

Phase 1: Discovery & Classification (Days 1-14)

1. Inventory all AI systems in use or development across your organization. Include third-party APIs, embedded features, and experimental projects.
2. Classify each system by risk level using the AI Act's criteria. Document your reasoning—regulators may ask for it.
3. Map data flows for each AI system, identifying what personal data is processed and under what legal basis.
4. Identify gaps between current practices and AI Act requirements for each system.

Phase 2: Contract & Vendor Review (Days 15-30)

1. Review all vendor contracts for AI Act gaps. Prioritize High-Risk systems and critical business dependencies.
2. Renegotiate or amend contracts to include AI-specific clauses: disclosure, warranty, audit rights, liability allocation.
3. Conduct vendor due diligence on AI providers. Request technical documentation, conformity assessments, and bias testing results.
4. Establish a vendor monitoring process to track regulatory updates and compliance changes.

Phase 3: Risk Assessment & Documentation (Days 31-60)

1. Conduct DPIAs and AI risk assessments for all High-Risk systems. Integrate them into a single assessment document.
2. Draft technical documentation for each High-Risk system, covering architecture, data, model, and operational details.
3. Establish human oversight protocols, including training programs, override procedures, and escalation paths.
4. Implement logging and monitoring systems capable of recording AI decisions and human interventions.

Phase 4: Governance & Training (Days 61-90)

1. Establish your AI governance committee with clear mandates and reporting lines.
2. Draft internal AI policies: use policy, procurement policy, incident response plan.
3. Train relevant staff on AI Act requirements, human oversight procedures, and incident reporting.
4. Conduct a mock audit to test your documentation, processes, and team readiness.
5. Schedule regular review cycles (quarterly for critical systems, annually for others).

13. Downloadable Compliance Checklist