What Is the EU AI Act?

The EU Artificial Intelligence Act is the European Union’s comprehensive legal framework for artificial intelligence. Its aim is to protect safety, health and fundamental rights and promote reliable artificial intelligence.

The regulation imposes different requirements on the artificial intelligence system depending on its intended use and the role the organization plays.

This framework generally distinguishes between the following:

• Transparency risk: AI systems requiring specific transparency measures, including chatbots and generative AI applications.
• Unacceptable risk: AI applications that are incompatible with fundamental rights and are therefore prohibited.
• High risk: AI systems used in sensitive areas such as employment, education, essential services, critical infrastructure, and certain biometric applications.
• Minimal or no risk: AI systems that do not face additional obligations under the Act.

Why Does the EU AI Act Matter for Enterprises?

The EU AI Act makes responsible AI a regulatory requirement for organizations.

For businesses, this means that AI governance needs to address more than just model performance. Organizations may need to have knowledge of the following:

• Which AI systems are being used?
• What data can these AI systems access?
• How are risks manged and assessed?
• Do the systems meet cybersecurity requirements?
• How are users informed when interacting with AI systems?
• How are AI activities recorded and documented?
• Is adequate human oversight in place?

Requirements for high-risk AI applications include risk management, appropriate data management, human supervision, technical documentation, record keeping, and cybersecurity.

What Does the EU AI Act Say About Generative AI?

The Act establishes rules for general-purpose artificial intelligence (GPAI) models. Providers of GPAI models face various requirements, including copyright obligations and transparency.

Providers of models  responsibilities around risk assessment and mitigation. These GPAI provisions became applicable in August 2025.

For enterprises using generative AI, governance must extend to the corporate data associated with these systems. While an AI assistant may be secure at the model level, it can expose sensitive information if corporate permissions and data classifications are ignored.

What Should Organizations Consider for EU AI Act Compliance?

There is no single technical control that creates EU AI Act compliance. Organizations should instead build a broader AI governance framework.

Key considerations include the following:

• AI inventory: Identify where AI systems are deployed and how they are used.
• Risk classification: Determine whether AI use cases fall into transparency, prohibited, high-risk, or other categories.
• Access control: Prevent AI from exposing information users are not authorized to access.
• Data governance: Understand what enterprise data AI systems can process or retrieve.
• Logging and traceability: Maintain records needed to understand and investigate AI activity.
• Human oversight: Establish appropriate controls for AI-supported decisions.
• Cybersecurity: Protect AI systems, data, prompts, and integrations against manipulation or leakage.

How Does Data Governance Support Responsible AI?

AI governance and data governance are becoming increasingly interconnected.

Enterprise AI systems often retrieve information from file servers, cloud repositories, NAS, S3, SharePoint and other unstructured data sources. If these sources contain misclassified information, AI can exacerbate the existing problem.

Therefore, a governed AI architecture needs to understand both what the data contains and who is allowed access to it.

This makes capabilities such as classification, permission management, data discovery, policy and auditability important foundations for responsible enterprise AI.

How Can FileOrbis Support AI Governance?

FileOrbis provides a governed data layer between AI and content systems. This solution helps organizations prevent AI from becoming a new pathway for the disclosure of sensitive data by connecting corporate data repositories to AI while also enforcing existing permissions and content-based controls.

Key capabilities include the following:

• Permission-aware AI Access: AI responses are limited to the content the user is authorized to access.
• AI-based classification: Unstructured data can be identified and classified.
• AI sovereignty: Organizations can have control over where AI processing and corporate data reside.
• Content-aware controls: Classified information can be filtered before AI systems process it.
• Data sanitization: Identifiers can be blocked before AI processing.
• Auditability: Governance actions related to AI can be recorded.

These capabilities do not make an organization automatically compliant with the EU AI Act. They can help establish the data security, traceability and access governance foundations required for responsible enterprise AI.

In Summary

The EU AI Act changes how organizations need to think about artificial intelligence. AI adoption can no longer be separated from risk management, cybersecurity, data governance and accountability.

A particularly important principle for businesses linking AI to internal data is this: AI should not have access to more information than the user requests.

Creating context-aware, permission-aware and auditable AI environments helps organizations move toward responsible AI and maintain control over the sensitive data that underpins it.

Frequently Asked Questions

When did the EU AI Act come into effect?

The EU AI Act entered into force on 1 August 2024 and became generally applicable on 2 August 2026.  Prohibited practices and AI literacy obligations began applying in February 2025, while GPAI and governance rules began applying in August 2025.

Who does the EU AI Act apply to?

The Act can apply to organizations involved in providing, deploying, importing or distributing AI systems within its scope. Its reach can also extend beyond companies physically established in the EU in circumstances defined by the regulation.

What are high-risk AI systems under the EU AI Act?

High-risk systems encompass specific AI applications in areas such as critical infrastructure, employment, education, essential services, law enforcement, biometrics, and justice. These systems have requirements regarding risk management, data quality, record keeping, human oversight, cybersecurity, and accuracy.

Gamze Karslı
Head of Marketing