Concept card

EU AI Act Compliance

As of 2026-07-24T14:00:00Z

Edited by Cédric-Olivier Mâry, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is EU AI Act Compliance?

Every Joule or agentic AI deployment touching HR, finance, health, law enforcement, migration or critical infrastructure is 'high-risk' under EU AI Act Annex III — eight Article 9-49 obligations apply before 2026-08-02.

The EU AI Act is the first comprehensive, horizontal AI regulation adopted by a major economic bloc, and for SAP analytics consultants it is no longer a legal curiosity to skim — it is a delivery constraint that shapes how Joule, agentic workflows, and predictive analytics get architected, documented, and signed off. The regulation classifies AI systems into four risk tiers and attaches escalating obligations to each. Understanding which tier a given SAP deployment falls into, and what that tier actually requires in practice, is now part of the job description for anyone advising on AI-enabled analytics in the EU market.

What it is and why it matters

The Act works as a risk pyramid. At the top, unacceptable-risk practices are banned outright: social scoring by public authorities, real-time biometric identification in public spaces, manipulation of vulnerable groups. Beneath that sits the tier that matters most to SAP consultants — high-risk systems, defined by Annex III to include AI used in employment decisions, creditworthiness assessment, access to essential services, and several other sensitive domains. A Joule copilot that screens CVs, an agentic workflow that recommends credit limits, or an analytics model that flags employees for performance action all land in this bucket the moment they influence a real decision about a real person. Below high-risk, limited-risk systems carry only transparency duties (disclose that the user is talking to an AI), and minimal-risk systems are essentially unregulated beyond voluntary codes of conduct.

Why it matters

High-risk obligations (Art. 6 + Annex III) apply 2026-08-02, full enforcement 2027-08-02 — the compliance clock is already running for live Joule builds.
Eight named requirements (risk management, data governance, 6-month log retention, human oversight, conformity assessment) turn 'AI ethics' into an auditable checklist.
Consultants who scope this compliance workstream separately from the AI build itself capture a defensible, billable deliverable.

Key points

Reg (EU) 2024/1689 — risk-based AI regulation. Adopted 2024-06-13, published 2024-07-12.
Four tiers: unacceptable (Art. 5) · high-risk (Art. 6 + Annex III) · limited · minimal.
SAP analytics in HR/finance/health/workforce/education = high-risk Annex III.
Eight Art. 9-49 requirements: risk-mgmt · data gov · tech doc · logging · transparency · oversight · accuracy/cyber · conformity.
200-800 person-days per high-risk system documentation.
Phased enforcement: prohibitions 2025-02 → GPAI 2025-08 → high-risk 2026-08 → full 2027-08.
Penalties up to 7% global turnover (Art. 5) / 3% (high-risk).
GPAI provider × deployer obligations stack, not alternative.
EU AI Act Compliance is mastered only when it changes a named buyer decision.
Start with the semantic contract and control model before demonstrating the tool.

Terms used on this page

EU AI Act: Regulation (EU) 2024/1689 — risk-based AI regulation; first comprehensive AI law globally.
Annex III: List of high-risk AI use cases triggering Art. 9-49 obligations: HR · finance · health · education · law-enforcement · migration · justice · critical-infra.
High-risk system: AI system in Annex III sub-category. Subject to 8 articles of obligations + conformity assessment.
GPAI (General-Purpose AI): Foundation models (Claude, GPT, Mistral). Separate obligations: training-data summary, copyright, code of practice.
Conformity assessment: Pre-market self-assessment (internal control) or notified-body certification depending on sub-category.
Provider vs deployer: Provider = builds/places-on-market the system. Deployer = uses it. Both have obligations; SAP analytics consultants typically deploy + advise.
Penalty tiers: €35M or 7% (Art. 5) · €15M or 3% (high-risk) · €7.5M or 1% (info to authorities).
FR market-surveillance: CNIL + ANSSI designated authorities; loi de programmation 2024-2030 layers state-specific obligations.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →