AI Regulation and Risk Readiness: a practical crosswalk between European law and voluntary risk guidance

Paper Eight argued that the European artificial intelligence regulation and the voluntary generative risk profile published in the same month were instruments of entirely different kinds, and that a single evidence system could serve both provided the record kept them apart.

Nothing in this article constitutes legal advice. It is offered to support discussion and further review with qualified advisers.

Was the EU AI Act in force but not yet applicable in August 2024?

That was the position the paper reported on 30 August 2024. The regulation had entered into force on 1 August, 20 days after its publication in the Official Journal, and at that point none of its substantive provisions had become applicable. The earliest application date the paper identified was 2 February 2025. Entry into force and applicability are different things, and the paper treated the confusion between them as the costliest error in the subject. Every date below describes where matters stood in the summer of 2024, and the compliance timetable has moved on since the paper was written.

• The regulation entered into force on 1 August 2024 and none of its substantive provisions applied on the day the paper was written.
• The chronology matters, because the presidents signed the regulation on 13 June 2024 and describing that signature as adoption is a common and material error.
• The application dates the paper set out ran from 2 February 2025 for prohibitions and the artificial intelligence literacy duty through to 2 August 2027 for one further category.
• Role determined duty, so provider, deployer, importer and distributor each carried different obligations, and an organisation that fine-tuned or rebranded a model might occupy a role it had not assumed.
• The voluntary profile offered a method that produces useful evidence and discharges no legal obligation.

How was the EU AI Act made, and why does the sequence matter?

The Parliament adopted its position on 13 March 2024, the Council adopted the regulation on 21 May, the presidents signed it on 13 June, publication in the Official Journal followed on 12 July, and entry into force came on 1 August. The paper treated 13 June as the date most often misdescribed, since that day marked the signature and the Council’s adoption had already come on 21 May. Getting the step wrong shifts every downstream date in a compliance plan, which is why the paper set the sequence out stage by stage. The error is easy to make and expensive to keep.

What did the compliance timetable require, and when?

Prohibitions and the artificial intelligence literacy duty were due to apply from 2 February 2025, obligations on general-purpose models and the governance provisions from 2 August 2025, general application from 2 August 2026, and one further category from 2 August 2027. The paper read that schedule as a planning instrument. An organisation that knew which of its systems fell into which bracket could sequence its work across two years, and an organisation lacking that knowledge had to treat the earliest date as the one governing everything. Role determined duty throughout, so the same system could carry a different set of obligations depending on whether the organisation counted as provider, deployer, importer or distributor, and the paper observed that an organisation which fine-tunes or rebrands a model may find itself in a role it had not expected to occupy.

Can a voluntary AI risk framework answer a regulator’s question?

On the paper’s reading, it cannot. The United States standards institute had published its profile on generative artificial intelligence risks six days before the paper was written, as a companion to its existing risk management framework, and that profile was voluntary, cross-sectoral and organised around risks with suggested actions set against the four functions of the parent framework. It imposes nothing. Following it produces evidence an organisation would want in any event, and it discharges no duty created by the regulation.

My own reading, which goes beyond what either instrument states, is that the practical risk sits in how the record is kept. Where the two sets of evidence merge into one undifferentiated file, an organisation asked whether a legal obligation was discharged will find itself offering material gathered under a framework that creates no obligations at all. The crosswalk earns its place because the underlying work overlaps so heavily. Both instruments want an organisation to know what its systems do, to have tested them, to have designed human oversight, and to log, monitor and keep records, so the evidence can be gathered once and presented in two directions.

Where should an organisation have started on AI compliance?

With the inventory. The paper argued that every route through the following two years began with knowing which systems existed, what they did, where they operated and who owned them, and that an organisation without that record had 23 months to build one and would need most of them. That estimate looks conservative to me, since inventory work tends to expose systems nobody had classified and owners nobody had named.

From the inventory the paper moved to classification and then to what it called the evidence pack, meaning the record showing what a system does, how it was tested, how human oversight was designed and what has been logged. The pack is built once. Tagging each item to the obligation or the suggested action it supports is the method the paper proposed, and it is the part of the work most likely to survive any reasonable change in the timetable.

The value of a crosswalk lies in the saving it produces on work that both instruments demand, and its danger lies in the equivalence a reader may infer from seeing two columns set side by side. The regulation confers obligations, timetables and penalties. The profile suggests actions. Holding that distinction inside the record costs very little at the point the evidence is created, and it matters a great deal at the point somebody asks a question under one regime and receives an answer drawn from the other. That is the position as the paper found it on 30 August 2024.

Frequently asked questions

Does the EU AI Act apply to a business that only buys in AI tools?

Yes, with duties that differ from those carried by a builder. As the paper described the European artificial intelligence regulation on 30 August 2024, role determined duty, and provider, deployer, importer and distributor each carried a distinct set of obligations. A business that only buys in tools was likely to sit as a deployer. That was the position in 2024, and the timetable has moved on since.

What happens to our obligations if we fine-tune or rebrand someone else’s AI model?

It may change your role under the European artificial intelligence regulation, and your obligations with it. The paper’s reading on 30 August 2024 was that an organisation which fine-tunes or rebrands a model may find it occupies a different role from the one it had assumed, since provider, deployer, importer and distributor each carry different duties. Confirming the classification early was the prudent step in 2024.

What should an AI system inventory actually contain?

Four things, on the paper’s account. Writing on 30 August 2024, it argued that every route through the following two years began with knowing which systems exist, what they do, where they operate and who owns them. An organisation without that record had 23 months to build one and would probably need most of them. The 23 months reflect the timetable as it stood in 2024.

Can one set of evidence serve both the EU rules and a voluntary AI risk framework?

Largely yes, provided the record keeps the two apart. The paper argued on 30 August 2024 that both instruments want an organisation to know what its systems do, to have tested them, to have designed human oversight, and to log, monitor and keep records. Evidence gathered once can be presented in two directions. The voluntary profile discharges no legal duty, so the record should show which is which.

What was the AI literacy duty, and when was it due to start?

It was among the first obligations in the European artificial intelligence regulation due to take effect. The paper recorded on 30 August 2024 that the artificial intelligence literacy duty was scheduled to apply from 2 February 2025, alongside the prohibitions, making that the earliest application date in the whole timetable. Later categories stood further out. The timetable has since moved on from where the paper found it.

Paul Forrest is a fractional Chief AI Officer and AI strategist working with UK boards, private equity portfolio companies and growing businesses. Read how the fractional CAIO engagement works, or see the full range of Ecaveo AI services.