AI compliance: what evidence your company should be able to show

What would an authority, a client or an auditor ask for if they asked how you govern the AI you use? This guide starts from what the EU AI Act documents and turns it into what evidence is worth having at hand.

A note: the articles cited are from the text consolidated as of July 27, 2026 published by the European Commission’s AI Act Service Desk, and what is said about AI literacy comes from the Commission’s questions and answers (both at the end, consulted in November 2026). The evidence column is Cyrrus’s judgment; it is not legal advice and does not say what applies to your company, which depends on its role and its systems.

First: are you a provider or a deployer?

Article 3 defines the provider as a natural or legal person, public authority or other body that develops an AI system, or has it developed, and places it on the market. The deployer is whoever uses an AI system under its authority, except in a personal non-professional activity. A company can be both depending on the system. The same article defines an AI system as a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that infers, from the input it receives, how to generate outputs, such as predictions, that can influence physical or virtual environments.

Second: is any system high-risk?

Under Article 6, an AI system is high-risk when it is a safety component of an Annex I product, or is itself such a product, and the product must undergo third-party conformity assessment; or when it is listed in Annex III. An Annex III system is not considered high-risk if it poses no significant risk of harm, for example if it performs a narrow procedural task, but that exception does not apply if the system profiles natural persons.

Under Article 113 in its current version, the Annex III high-risk rules apply from December 2, 2027 and the Annex I rules from August 2, 2028. The full dates are in our guide to AI regulation.

Could you show evidence of how you govern your AI?

We design your organization’s AI Governance framework: what can be automated, what needs human oversight, and who is accountable for each decision.

• Risk map by use case, not a generic policy
• Defined roles between business, IT, and legal

Learn about AI Governance

What the regulation documents and what evidence to keep

Article 26 adds that deployers must inform workers’ representatives and the affected workers before using a high-risk system in the workplace, inform people subject to decisions supported by Annex III systems, notify the provider or distributor and the market surveillance authority without undue delay if they see a risk and suspend use of the system, report serious incidents immediately and cooperate with the competent authorities.

AI literacy: what the Commission clarifies

According to the European Commission’s questions and answers, Article 4 applies from February 2, 2025 and contains no strict requirements or mandatory trainings: it does not require guaranteeing a specific level of AI literacy for any person, nor a certificate, and the organization can keep an internal record of trainings and other initiatives. The Commission adds that relying only on instructions for use may be ineffective. National market surveillance authorities could impose proportionate penalties, with supervision and enforcement from August 2, 2026, and the regulation creates no criminal offences or right to compensation.

Assign owners before anyone asks for evidence

We help your leadership team decide what to delegate, what to supervise, and what to never automate — before adoption outruns control.

• Governance committee with business, IT, legal, and security
• Clear criteria for approving new AI use cases

Schedule a conversation about AI Governance

Penalties and who decides

The regulation’s maximum fines are in Article 99 and we summarize them in the regulation guide. Which systems are high-risk, what role your company has and what applies to it are decisions that require legal analysis; this article does not make them for you.

What leadership needs to decide

Four decisions, from Cyrrus’s judgment. First, who builds and maintains the list of AI systems, with the company’s role in each. Second, who answers for the evidence in each row of the table. Third, how often it is reviewed and who approves it. Fourth, when to consult a legal adviser, before anyone outside asks for the evidence.

To choose what supports all this, read how to evaluate governance tools; to place yourself on a readiness scale, see the maturity model.