The EU AI Act is now an operating constraint, not a distant policy theme. The European Commission says the Act is the first comprehensive legal framework on AI worldwide, with a risk-based structure covering unacceptable risk, high risk, transparency risk, and minimal risk systems. The page was last updated on August 3, 2026, immediately after the Act became broadly applicable on August 2, 2026, with some exceptions.
The practical burden is workflow classification. The Commission lists high-risk areas that include critical infrastructure safety components, education and vocational training, employment and worker management, access to essential private and public services, law enforcement, migration and asylum, and justice administration. It also lists prohibited practices, including harmful manipulation, social scoring, certain biometric categorization, workplace and education emotion recognition, and untargeted scraping to expand facial recognition databases.
Grey Haven's read: compliance will fail when companies treat AI as a vendor category instead of a process inventory. The same model can be low risk in one workflow and high risk in another. The control point is not the model name. It is the business process, data access, user affected, decision consequence, human review path, and evidence trail.
Operators should build a simple AI use-case register before buying another governance platform. For each workflow, record the owner, model/provider, data sources, affected users, decision rights, review threshold, logging location, and rollback path. That register will matter more than a policy slide when regulators, customers, or insurers ask what the system actually does.
The watch item for next week is whether vendors start exposing AI Act classification support at the product-feature level. If they do not, deployers will own the mapping work themselves.
Source: European Commission, “AI Act.”
