Question 1

What is the EU AI Act?

Accepted Answer

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework governing artificial intelligence systems. It classifies AI systems by risk level and imposes obligations — ranging from transparency notices to full conformity assessments — depending on the level of risk an AI system poses to health, safety, or fundamental rights.

Question 2

When does the EU AI Act apply?

Accepted Answer

The EU AI Act entered into force on 1 August 2024. Provisions are being phased in: prohibited AI practices became enforceable on 2 February 2025; rules for high-risk AI systems in Annex I apply from 2 August 2026; and Annex III high-risk systems and GPAI model rules apply from 2 August 2026 as well. Full enforcement across all provisions applies by 2 August 2027.

Question 3

Who does the EU AI Act apply to?

Accepted Answer

The Act applies to providers (organisations that develop or place AI systems on the EU market), deployers (organisations that use AI systems in a professional context in the EU), importers, and distributors. It has extraterritorial reach — organisations outside the EU are covered if their AI system's output is used within the EU.

Question 4

What is a high-risk AI system?

Accepted Answer

High-risk AI systems are defined in Annexes I and III of the Act. Annex I covers AI embedded in safety-critical products (machinery, medical devices, vehicles). Annex III lists standalone high-risk use cases: biometric identification, critical infrastructure, education, employment decisions, essential private and public services, law enforcement, migration management, and administration of justice. High-risk systems face the most stringent obligations: risk management, data governance, technical documentation, human oversight, logging, and conformity assessment.

Question 5

What are the four AI risk tiers?

Accepted Answer

The EU AI Act defines four tiers. (1) Unacceptable risk — prohibited outright (e.g., social scoring by governments, real-time remote biometric surveillance in public spaces with limited exceptions). (2) High risk — extensive obligations including conformity assessment, CE marking, and registration in an EU database. (3) Limited risk — lighter transparency requirements, such as disclosing that users are interacting with an AI chatbot. (4) Minimal/no risk — no specific EU AI Act obligations, though voluntary codes of conduct are encouraged.

Question 6

What obligations apply to high-risk AI system providers?

Accepted Answer

Providers of high-risk AI systems must: establish a risk management system; implement data and data governance measures; create and maintain technical documentation; enable logging and record-keeping; ensure transparency and provide instructions for use; build in human oversight capabilities; achieve appropriate levels of accuracy, robustness, and cybersecurity; and register the system in the EU AI database before placing it on the market.

Question 7

What is an AI Impact Assessment?

Accepted Answer

An AI Impact Assessment (also called a Fundamental Rights Impact Assessment for certain deployers) evaluates how an AI system may affect individuals' fundamental rights, safety, or health. Deployers of high-risk AI systems must carry out assessments before deployment and document the results. GeraCompliance generates these assessments automatically based on your system's classification and use case.

Question 8

What are the penalties for non-compliance?

Accepted Answer

Fines are tiered by violation type: up to €35 million or 7% of global annual turnover for violations related to prohibited AI practices; up to €15 million or 3% for other violations including failure to meet high-risk system obligations; up to €7.5 million or 1.5% for supplying incorrect or misleading information to authorities. SMEs and start-ups face lower caps (the lesser of the percentage or the fixed amount).

Question 9

What is the AI Act's registration database?

Accepted Answer

The EU AI Act requires that high-risk AI systems listed in Annex III be registered in a publicly accessible EU database before they are placed on the market or put into service. The European AI Office administers this database. GeraCompliance can pre-populate your registration data from your system profile.

Question 10

How does GDPR interact with the EU AI Act?

Accepted Answer

GDPR and the EU AI Act are complementary but distinct. GDPR governs the processing of personal data (lawful basis, data subject rights, DPO requirements). The EU AI Act governs the deployment of AI systems (risk classification, conformity, transparency). If your AI system processes personal data — which most do — you must comply with both. GeraCompliance covers both regulatory frameworks in a single dashboard.

Question 11

What is a GDPR Data Processing Agreement (DPA)?

Accepted Answer

A Data Processing Agreement is a contract between a data controller and a data processor (Article 28 GDPR). If you use an AI vendor that processes personal data on your behalf, you must have a signed DPA in place. GeraCompliance provides ready-to-use DPA templates customised to your organisation and vendor relationships.

Question 12

Does GeraCompliance itself comply with GDPR?

Accepted Answer

Yes. GeraCompliance is designed from the ground up to be GDPR-compliant. Data is stored on EU infrastructure, we operate under a lawful basis of contract and legitimate interest, we maintain a comprehensive privacy notice, and we will sign a DPA with any customer who processes personal data on our platform.

Question 13

What is a Data Protection Impact Assessment (DPIA)?

Accepted Answer

A DPIA (Article 35 GDPR) is required when processing is likely to result in a high risk to individuals' rights and freedoms — for example, large-scale processing of special category data, systematic monitoring of public areas, or automated decision-making with legal or significant effects. GeraCompliance guides you through DPIA creation and links findings to your AI risk assessment.

Question 14

How does GeraCompliance help with EU AI Act compliance?

Accepted Answer

GeraCompliance automates the most time-consuming parts of compliance: AI system classification (we determine the correct risk tier automatically), document generation (technical documentation, impact assessments, conformity declarations), milestone tracking (we map every regulatory deadline to your specific systems), audit-ready reports (exportable PDFs that satisfy national authorities), and continuous monitoring (alerts when your compliance status changes).

Question 15

Is GeraCompliance a legal service?

Accepted Answer

No. GeraCompliance is a software platform that helps you organise and document your compliance processes. It is not a law firm and does not provide legal advice. For legal opinions specific to your organisation's circumstances, you should consult a qualified EU data protection or technology lawyer. Our templates and guidance are designed by compliance experts and reviewed by legal counsel, but they do not constitute legal advice.

Question 16

How long does it take to get compliant?

Accepted Answer

For a minimal-risk AI system, compliance can be confirmed in under an hour using GeraCompliance. For a high-risk system, a thorough compliance programme — including technical documentation, risk management system, and conformity assessment — typically takes 4–12 weeks depending on system complexity and your team's availability. GeraCompliance reduces this timeline by up to 10x compared to manual processes.

Question 17

Can I use GeraCompliance for multiple AI systems?

Accepted Answer

Yes. GeraCompliance is designed for organisations with multiple AI systems. The AI System Registry lets you manage all your systems from a single dashboard, track compliance status per system, and generate consolidated audit reports. Pro and Enterprise plans include unlimited system registrations.

Question 18

What happens if new regulations are introduced?

Accepted Answer

The regulatory landscape is evolving — the European AI Office publishes guidance, sector-specific regulations are being updated, and Member States are implementing national enforcement mechanisms. GeraCompliance monitors official EU publications and updates the platform's classification rules, templates, and checklists automatically. Customers receive in-app alerts when changes affect their registered systems.

EU AI Act & GDPR — Your Questions Answered

1EU AI Act — Basics

2EU AI Act — Obligations & Compliance

4Using GeraCompliance

Still have questions?

EU AI Act & GDPR — Your Questions Answered

1EU AI Act — Basics

2EU AI Act — Obligations & Compliance

3GDPR & Data Protection

4Using GeraCompliance

Still have questions?