What AI regulation requires of your organisation, and when
The EU AI Act applies to the AI your organisation builds, buys and uses, the GDPR wherever that AI processes personal data, and DORA's third-party rules to AI that banks, insurers and investment firms buy as an ICT service. The AI Act's rules for high-risk uses, among them credit scoring and life and health insurance pricing, apply from 2 December 2027.
Meeting them starts with knowing which AI systems you run and what could go wrong with each. Below are the duties by role, each linked to the risk register lines that cover it, and a free method and workbook for the work.
Checked against the AI Act as amended in July 2026 and Ireland's Regulation of Artificial Intelligence Act 2026. Updated 1 November 2026. Not legal advice.
The AI Act as amended by Regulation (EU) 2026/1744, with the other rules beside it.
- DORA: the third-party rules for banks, insurers and investment firms, which reach AI bought as an ICT service
- AI Act: prohibited practices and AI literacy
- AI Act: general-purpose AI models, and the penalty rules
- Ireland: the Regulation of Artificial Intelligence Act 2026 comes into operation
- AI Act: transparency for chatbots and AI-generated content, and the Act's general date of application
- As at 1 November 2026
- AI Act: a ninth prohibited practice, AI that generates non-consensual intimate images or child sexual abuse material; the deadline for marking AI-generated content from generators placed on the market before 2 August 2026
- Product liability: software, including AI, is a product for products placed on the market or put into service after this date
- AI Act: high-risk uses in Annex III, including credit scoring, life and health insurance pricing and recruitment
- AI Act: AI that is, or is a safety component of, a product under Annex I, such as machinery, toys, lifts and medical devices
What you must do, by role
Most organisations are deployers: they use AI systems that others build, including systems bought from vendors. Many are also providers of systems they built for their own use. Find your role, then its duties. Each duty names its article, when it applies and the register lines that cover it. The lists give the main duties, not every condition and exception: read the article before you rely on it.
- Every organisation that builds, buys or uses AI
- Organisations that use high-risk AI
- Organisations that build high-risk AI
- Providers of general-purpose AI models
- Banks, insurers and other financial entities
- In Ireland
Every organisation that builds, buys or uses AI
Most of this applies now
Any provider or deployer, whatever the risk class of its systems. Under the AI Act a deployer is any organisation that uses an AI system under its authority, including one bought from a vendor.
Check every AI system you build, buy or use against the prohibitions in Article 5, among them manipulation that causes significant harm, social scoring that leads to unjustified detrimental treatment, and emotion recognition at work or in education other than for medical or safety reasons.
Where: AI Act Art 5
When: 2 February 2025; the ninth prohibition from 2 December 2026
Take measures to support the AI literacy of your staff and of others who operate or use AI systems on your behalf.
Where: AI Act Art 4, as replaced in 2026
When: 2 February 2025
Providers: design systems that interact with people so that people know they are dealing with an AI, unless that is obvious, and mark generated content in a machine-readable format. Deployers: disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless a person has reviewed it and holds editorial responsibility, and tell people exposed to emotion recognition or biometric categorisation.
Where: AI Act Art 50, 111(4)
When: 2 August 2026; providers' marking for generators placed on the market before then, 2 December 2026
Where AI processes personal data, the controller must have a lawful basis, and an Article 9 condition for special categories such as health data; carry out a data protection impact assessment before processing that is likely to result in a high risk; and use decisions based solely on automated processing that significantly affect people only where Article 22 allows, with safeguards that include human intervention.
Where: GDPR Art 6, 9, 22, 35
When: 25 May 2018
Treat AI as a product for liability: the manufacturer is liable to people, whether or not it was at fault, for death, personal injury, damage to other property (not property used only for professional purposes), and the destruction or corruption of data not used for professional purposes, when a defective system causes them, including defects that come from updates, upgrades or machine learning after release. Purely financial loss is not covered.
Where: Directive (EU) 2024/2853
When: Products placed on the market or put into service after 9 December 2026
Phase 1 of the method records every system in an inventory, with its role and its class under the Act. Register lines LEG-07 to LEG-09 cover a system put in the wrong class, a prohibited practice hidden in a feature, and missed transparency, literacy and registration duties.
Organisations that use high-risk AI
From 2 December 2027
Deployers of the uses listed in Annex III of the AI Act, among them creditworthiness and credit scoring, risk assessment and pricing in life and health insurance, recruitment and worker management, education, and access to essential public services. Systems placed on the market or put into service before then come under these rules only if their design changes significantly afterwards; systems intended for public authorities must comply by 2 August 2030 (Article 111(2)).
Use the system in line with the provider's instructions, and give human oversight to people with the competence, training and authority it needs.
Where: AI Act Art 26(1), 26(2)
When: 2 December 2027
Where you control the input data, make sure it is relevant and sufficiently representative for the system's intended purpose.
Where: AI Act Art 26(4)
When: 2 December 2027
Monitor the system in operation. If you have reason to think that using it as instructed may present a risk to health, safety or fundamental rights, suspend it and inform the provider or distributor and the market surveillance authority without undue delay. Report a serious incident immediately, first to the provider.
Where: AI Act Art 26(5)
When: 2 December 2027
Keep the logs the system generates, where they are under your control, for a period that suits its purpose and of at least six months, unless other law provides otherwise.
Where: AI Act Art 26(6)
When: 2 December 2027
Register line: TRA-07
Inform workers' representatives and the workers affected before using the system at work, and tell people when it makes or helps make decisions about them.
Where: AI Act Art 26(7), 26(11)
When: 2 December 2027
Where the GDPR requires a data protection impact assessment, use the provider's information to carry it out. The GDPR duty applies already.
Where: AI Act Art 26(9); GDPR Art 35
When: GDPR now; AI Act from 2 December 2027
Register line: LEG-03
Before first use, carry out a fundamental rights impact assessment if you are a public body, a private body providing public services, or you use AI for credit scoring or for life and health insurance pricing. Send the results to the market surveillance authority, and update the assessment when the facts change.
Where: AI Act Art 27
When: 2 December 2027
When a person affected by a decision based on the system's output asks, explain the role of the AI system and the main elements of the decision, where it has legal or similarly significant effects on them.
Where: AI Act Art 86
When: 2 December 2027
Register line: TRA-02
Take on the provider's duties if you put your name or trademark on a high-risk system already on the market, make a substantial modification that leaves it high-risk, or change the intended purpose of a system so that it becomes high-risk.
Where: AI Act Art 25(1)
When: 2 December 2027
The use-case template in phase 2 records the oversight, logging, notices and impact assessments for each system. The workbook's FRIA sheet maps the six elements of Article 27 to the register and the templates.
Organisations that build high-risk AI
From 2 December 2027; 2 August 2028 for AI in Annex I products
Providers: organisations that develop a high-risk AI system, or have one developed, and place it on the market or put it into service under their own name, including for their own use. A lender that builds its own credit scoring model and uses it is both provider and deployer. Systems placed on the market or put into service before then come under these rules only if their design changes significantly afterwards; systems intended for public authorities must comply by 2 August 2030 (Article 111(2)).
Run a risk management system for the whole lifecycle, starting with the identification and analysis of the known and reasonably foreseeable risks to health, safety and fundamental rights.
Where: AI Act Art 9
When: 2 December 2027
Govern training, validation and test data, including examination for possible biases.
Where: AI Act Art 10
When: 2 December 2027
Prepare technical documentation before the system goes on the market and keep it up to date, keep the compliance records for ten years, and design the system to record events automatically and keep its logs.
Where: AI Act Art 11, 12, 18, 19
When: 2 December 2027
Give deployers instructions they can understand and use, and design the system for effective human oversight.
Where: AI Act Art 13, 14
When: 2 December 2027
Achieve an appropriate level of accuracy, robustness and cybersecurity.
Where: AI Act Art 15
When: 2 December 2027
Run a quality management system, complete the conformity assessment before the system is placed on the market or put into service, including for your own use, and register Annex III systems in the EU database. For credit scoring and insurance pricing the assessment is internal, without a notified body.
Where: AI Act Art 17, 43, 49
When: 2 December 2027
Draw up the EU declaration of conformity and affix the CE marking. If the system does not conform, correct, withdraw, disable or recall it at once, and inform those affected.
Where: AI Act Art 20, 47, 48
When: 2 December 2027
Monitor the system after it is placed on the market under a documented plan, and report serious incidents to the market surveillance authority within the deadlines in Article 73.
Where: AI Act Art 72, 73
When: 2 December 2027
Article 9 starts with identification, and phase 2 of the method is that step: two tracks, top-down and bottom-up, reconciled into one register. Phase 4 scores the risks, and phase 6 keeps the record that the technical documentation draws on.
Providers of general-purpose AI models
Since 2 August 2025; 2 August 2027 for models placed on the market before then
Organisations that develop a general-purpose model, such as a large language model, and place it on the market. Most organisations use these models and are not their providers.
Keep technical documentation, give information to providers who build on the model, have a copyright policy and publish a summary of the training content. Models with systemic risk carry more duties, including evaluation, incident reporting and cybersecurity.
Where: AI Act Art 53, 55, 111(3)
When: 2 August 2025; 2 August 2027 for models placed on the market before then
Most organisations meet these models as deployers or downstream providers. Register line OPS-01 covers dependence on one foundation-model provider.
Banks, insurers and other financial entities
DORA since 17 January 2025; AI Act high-risk duties from 2 December 2027
Financial entities carry the AI Act's duties and their own sector's rules. For high-risk AI used in providing financial services, the market surveillance authority is normally the national financial supervisor, unless the State names another authority (Article 74(6) and (7)).
Where an AI service you buy is an ICT service under DORA, assess its risks before you contract, including concentration risk; record it in the register of information; put DORA's contract terms in the contract; and keep exit strategies for services that support critical or important functions.
Where: DORA Art 28 to 30
When: 17 January 2025
Credit scoring of individuals, fraud detection excepted, and risk assessment and pricing in life and health insurance are high-risk uses, so their deployers need a fundamental rights impact assessment before first use.
Where: AI Act Annex III point 5(b), (c); Art 27
When: 2 December 2027
Meet the deployer's monitoring duty through your internal governance under financial services law, and keep the system's logs within the documentation that law requires. The duties to suspend a risky system and to report incidents still apply.
Where: AI Act Art 26(5), 26(6)
When: 2 December 2027
If you build high-risk AI, your internal governance under financial services law meets most of the quality management system duty, but not the risk management system, post-market monitoring or serious incident reporting.
Where: AI Act Art 17(4)
When: 2 December 2027
Register line: MOD-13
Insurers: expect supervisors to apply EIOPA's Opinion on AI governance and risk management, which sets out how insurance law applies to AI systems that are neither prohibited nor high-risk.
Where: EIOPA Opinion
When: 6 August 2025
Register line: LEG-10
Phase 1 maps the sector rules beside the Act. Register lines OPS-01, MOD-05 and LEG-12 carry DORA's third-party articles, and LEG-10 covers sector rules that are missed.
In Ireland
In operation since 31 July 2026
The Regulation of Artificial Intelligence Act 2026 gives effect to the AI Act in Irish law. It was signed on 21 July 2026 and came into operation on 31 July 2026, apart from two paragraphs of one definition in section 78 (S.I. No. 403/2026).
It sets up Oifig IS na hÉireann, the AI Office of Ireland, as an independent statutory body. The Office coordinates the authorities that supervise the AI Act and is the single point of contact for the European Commission, sector regulators and the public.
Where: Regulation of Artificial Intelligence Act 2026
When: 31 July 2026
It gives market surveillance authorities an enforcement toolkit that runs from notices to prohibition and seizure, and then to fines and prosecution, with independent adjudication. It amends the Central Bank Act 1942 and the Competition and Consumer Protection Act 2014 so that AI Act sanctions can be imposed under them.
Where: Regulation of Artificial Intelligence Act 2026
When: 31 July 2026
Fines under the AI Act
| Breach | Article | Maximum fine |
|---|---|---|
| A prohibited practice | Art 99(3) | €35 million or 7% of total worldwide annual turnover |
| A breach of the obligations of providers (Article 16), deployers (Article 26), authorised representatives, importers or distributors, or of the transparency duties (Article 50) | Art 99(4) | €15 million or 3% |
| Incorrect, incomplete or misleading information given to authorities or notified bodies in reply to a request | Art 99(5) | €7.5 million or 1% |
| A provider of a general-purpose AI model, fined by the Commission, from 2 August 2026 | Art 101 | €15 million or 3% |
Turnover is that of the preceding financial year. The maximum is the higher of the two amounts, or the lower for SMEs, including start-ups (Article 99(6)), and for small mid-caps on the fines in Article 99(4) and (5) (Article 99(6a)). In Ireland, the Regulation of Artificial Intelligence Act 2026 sets the rules for imposing them.
Every AI Act article the register cites, with all its lines, what the Digital Omnibus changed and the sources: EU AI Act obligations by role and date. Templates for two of the duties: the fundamental rights impact assessment and the AI system inventory.
The method behind the duties
Article 9 of the AI Act, clause 6.1.2 of ISO/IEC 42001 and a data protection impact assessment all ask you to identify and assess the risks. The method does that in six phases. It is the bank risk identification method rebuilt for AI, and it keeps the bank method's numbering.
Foundation setting
The standards map, governance and roles, the taxonomy, the context, the AI system inventory, the risk criteria and the starting universe of risks.
Dual-track identification
Top-down: workshops, SWIFT (structured what-if), scenarios, Delphi and red-team review. Bottom-up: the AI use-case template and ten specialist sub-processes.
Reconciliation and portfolio view
One reconciled register, the blind spots of each track, the enterprise AI risk map and the concentrations behind it.
Assessment
Four-dimensional scores, a data quality rating for each score, inherent and residual risk, and materiality.
Interaction
Bow-ties, the interaction matrix, cascades and hidden concentration, such as many suppliers running on one underlying model.
Documentation
The living AI risk inventory, a profile for each material risk, and an audit trail.
A register of 91 AI risks
Each risk is written as one line you can adopt, change or reject. Every line names the harm to score and its unit of exposure, the key controls with their ISO/IEC 42001 Annex A references, an owner, an indicator and the regulatory hooks that tie it to the duties above.
The lines sit in a taxonomy of nine categories, each owned by one function. Every row of the MIT AI Risk Repository was mapped against the register: of the 1,181 risks an organisation could own, 95% are covered at least in part.
- Critical 5
- High 46
- Moderate 40
Standards and frameworks the method maps to
Customers, auditors and supervisors also ask for these. The method gives you the identification work each of them asks for and none of them describes in full.
- ISO/IEC 42001
- The AI risk assessment in clause 6.1.2 and the Annex C objectives and risk sources. Thirty-seven of the 38 Annex A controls are cited by at least one register line.
- ISO/IEC 23894 and 42005
- AI risk management guidance and AI system impact assessment, set against the phases of the method.
- NIST AI RMF and AI 600-1
- The trustworthiness characteristics of the AI Risk Management Framework and the generative AI profile.
Who wrote it
Rory Roberts, FRM, spent more than twenty years in risk at banks and insurers. He was VP and Global Head of Risk Identification at Credit Suisse and Risk Identification Lead in enterprise risk management at Standard Chartered. The AI method is his bank method applied to AI systems.
The book, AI Risk Identification: The Complete Methodology, is free: 157 pages, with the register as an Excel workbook. The bank method is published as Bank Risk Identification: The Complete Methodology.
To have the work done with you, see AI risk identification for one organisation. About Rory Roberts
Get the book and the register
Your files are ready. The links are personal to your email address and work for 7 days. A copy is on its way to your inbox.
Start with Chapter 1, then Appendix A for the register. Questions about the method are welcome at rory@eonriskservices.com.
Questions
Does the EU AI Act apply to AI we buy from a vendor?
Yes. Using a bought system under your own authority makes you its deployer, with the deployer's duties. If the system is high-risk, the provider's instructions, logs and information become part of your own compliance. Financial entities within DORA's scope must also apply its ICT third-party rules where the vendor provides an ICT service.
What is AI risk identification?
Finding, describing and recording the ways an organisation's development, purchase or use of AI could cause harm, before those risks are assessed and controlled. It is the first step of AI risk management. A risk that has not been identified is not assessed, not controlled and not reported.
Is AI risk identification the same as an AI risk assessment?
Identification is the first part of it. ISO 31000 divides risk assessment into identification, analysis and evaluation. Identification finds and describes the risks; the other two score and rank them. An AI risk assessment is only as complete as the identification behind it.
Does the EU AI Act require AI risk identification?
For high-risk AI systems, yes. Article 9 requires providers to run a risk management system that includes the identification and analysis of the known and reasonably foreseeable risks to health, safety and fundamental rights. Article 27 requires some deployers, including those using AI for credit scoring or for life and health insurance pricing, to assess the specific risks of harm to the people affected.
How does the method relate to ISO/IEC 42001?
ISO/IEC 42001 requires an AI risk assessment (clause 6.1.2) and lists controls in Annex A, but it does not supply a taxonomy or a register. The method supplies both, and every register line names its Annex A controls. Thirty-seven of the 38 Annex A controls are cited by at least one line.
What is an AI risk taxonomy?
A classification of AI risks into categories, so that every risk has one home and no area is left out. The taxonomy here has nine categories and 42 sub-categories, drawn so that each category lines up with the function that owns the controls.
Is the book free?
Yes. Enter your email address and the download links for the book and the register workbook appear straight away. A copy of the links is sent to the same address.