EU AI Compliance Act

The Regulatory Landscape

The EU AI Act entered into force in August 2024, with implementation following a staggered timeline that reshapes how AI systems are designed, documented, validated, and monitored across Europe:

• February 2025: Prohibited AI practices became enforceable, banning systems that pose unacceptable risks including manipulative AI, social scoring, and certain forms of predictive policing
• August 2025: GPAI model transparency requirements and governance structures became applicable, requiring technical documentation, training data summaries, and copyright compliance
• August 2026: High-risk AI system obligations become generally applicable—covering AI used in healthcare, education, employment, law enforcement, critical infrastructure, and more. This includes mandatory risk management, data governance, technical documentation, human oversight, and conformity assessment
• August 2027: Full scope applies to all risk categories, including AI embedded in regulated products

The European Commission’s Digital Omnibus proposal (November 2025) has introduced potential adjustments—including a possible extension to December 2027 for certain high-risk obligations—but prudent organisations are treating August 2026 as the binding deadline and building compliance infrastructure now.

Provenya’s R&D Focus

Provenya’s research in EU AI compliance focuses on making the transition from high-level obligations to operational practice as efficient and commercially valuable as possible:

Use-Case Classification & Risk Mapping

We develop practical classification methodologies that help organisations determine which of their AI systems are in scope, at what risk level, and what specific obligations apply. This proportionate approach prevents over-engineering governance for low-risk systems while ensuring high-risk systems receive the attention they need.

Compliance-by-Design Documentation

Our research produces documentation frameworks that can be maintained across the AI lifecycle—not just created once for initial compliance. This includes system descriptions, intended use specifications, risk control frameworks, evaluation plans, and deployment records that evolve as systems are updated.

Evidence Generation Methodologies

We develop practical approaches to generating the evidence that regulators, auditors, and procurement bodies require: evaluation plans, testing protocols, traceability records, and change logs that are built into development workflows rather than retrofitted.

Deployment Governance Models

Our research addresses the ongoing governance challenge: monitoring, incident response, retraining controls, and oversight models that ensure compliance continues after deployment—not just at the point of market entry.

Supply Chain Alignment

The EU AI Act creates responsibilities across the entire AI value chain. Our research develops practical assurance requirements and documentation standards that reduce integration and procurement risk for organisations working with third-party AI components.