The EU AI Act for non-lawyers: a practical compliance playbook

August 16, 2026 · 5 min · Free, with full transcript

The EU AI Act is now producing real obligations for companies deploying AI in Europe, and ignorance of the legal text is not a defence your board will accept. This playbook gives you a concrete sequence of steps to assess your exposure, assign ownership, and take action before regulators come looking.

Listen to the podcast

4 min

Read the full transcript

Welcome to the Leaders' Insights podcast.

Today's episode, the EUAI Act for Non-Lawyers, a practical compliance playbook.

Everyone's panicking about the EUAI Act, the European Union's law on artificial intelligence.

You're telling me most of that panic is aimed at the wrong thing?

Completely wrong.

Companies are throwing money at model audits and ethics boards when the thing that'll

actually bite them is far more boring.

They don't know which AI systems they're even running.

That sounds like an excuse to avoid the hard stuff.

It's the opposite.

The hard stuff is the inventory.

I've sat in rooms with a bank's compliance team who genuinely could not tell me whether

their fraud-scoring tool was built in-house or bought from a vendor.

If you don't know that, you can't classify it.

And classification is the whole game.

Break that down.

Why is classification the game?

Because the Act is risk-tiered.

Four buckets, prohibited high risk, limited risk, and minimal risk.

Prohibited stuff like social scoring, ranking citizens by behavior, has been banned since

February 2025.

But the tier that eats budgets is high risk—things like AI used in hiring, credit decisions,

or medical devices.

Most of those obligations phase in through August 2026 and 2027.

So a company's first move isn't lawyers.

It's a spreadsheet?

A spreadsheet you'll hate.

List every AI system who owns it, what it decides, and whether a human can overrule

it.

90% of firms skip this because it's tedious.

Then they hire a magic circle law firm at 900 euros an hour to tell them something

an intern with a checklist could have found.

You're being cocky.

Give me a real number that backs the wrong panic claim.

Fine.

A 2025 survey from IBM—and yes, they sell governance tooling, so grain of salt, swite—found

80% of businesses cited explainability as a top concern, but only about a quarter had

a complete register of their AI use.

They're worried about the philosophy and ignoring the plumbing.

What happens to the firm that gets the plumbing wrong?

Fines up to 35 million euros or 7% of global annual turnover for the prohibited stuff.

That's higher than the data protection fines everyone got scared of in 2018.

But here's the part boards don't grasp.

The regulator doesn't need to prove your model is biased.

They just need to prove you had no process to check.

Absence of documentation is the offense.

So documentation theater gets rewarded?

To a point, yes.

And that's the uncomfortable truth.

A well-documented mediocre system will survive an audit better than a brilliant undocumented

one.

The act regulates your paperwork trail as much as your algorithm.

It's basically GDPR with a maths degree.

Who inside the company actually owns this?

Everyone points at legal.

And legal points back.

That's the failure mode.

My role?

Whoever deploys the system owns the risk.

If your HR director rolled out a CV screening tool, that's a high-risk deployment, and

it's hers, not the general counsel's.

Legal advises?

The business owner is accountable?

Name that person in writing or nothing gets done.

Let's talk about companies buying AI rather than building it.

Off the hook?

No.

And this is where people get burned.

If you deploy a high-risk system, you carry deployer obligations even if a vendor built

it.

Human oversight, monitoring, keeping logs.

When Workday got sued in the U.S. over hiring algorithm bias, the vendor made it wasn't

a shield.

Same logic here.

Get contractual guarantees from your supplier that they'll hand over the technical documentation,

or you're holding the bag alone.

Give me the sequence a non-lawyer can start Monday.

Four steps.

One, inventory every AI system.

Two, classify each into the risk tiers.

Most sit in minimal risk, and you can relax.

Three, for anything high-risk, name a human owner and demand the vendor's documentation.

Four, write down your oversight process, even if it's imperfect.

Imperfect and written beats perfect and verbal every time.

One thing they do today?

Open a spreadsheet and list every AI tool your company touches.

Not the fancy models.

All of them, including the chatbot marketing bot without telling anyone.

You can't govern what you can't see.

And right now, most of you are flying blind.

That's your five.

The full AI track, structure, no fluff, is at MBA-training.com.

Read and go deeper