The EU AI Act creates a risk-based regulatory framework for AI systems. Third-party AI governance starts by identifying the organization's role: provider, deployer, importer, distributor, product manufacturer, or another actor. A company using a vendor AI tool may have different obligations from a company placing an AI system on the market.
Official sources
What the AI Act is trying to do
The AI Act regulates AI based on risk. It prohibits certain practices, imposes detailed requirements for high-risk AI systems, adds transparency duties for some systems, and creates obligations for general-purpose AI models.
What teams need to do
- Inventory AI systems, embedded vendor AI, external models, AI APIs, and AI-enabled products.
- Determine actor role and risk category for each use case.
- Identify high-risk systems and required evidence.
- Review provider documentation, data governance, testing, human oversight, accuracy, robustness,
cyber security, and post-market monitoring where relevant.
- Track provider changes, model updates, data use, subprocessors, incidents, and contractual terms.
Evidence to maintain
- AI system inventory and role analysis.
- Risk classification and high-risk assessment.
- Provider evidence, technical documentation, testing, and human oversight records.
- Contract terms for data use, model changes, incidents, auditability, and subcontracting.
- Monitoring, incidents, remediation, and approval history.
Common gaps
- Embedded AI in vendor products is missed.
- Teams classify AI by tool name rather than use case and legal role.
- Contracts do not address model changes or data use.
- Monitoring stops after approval even though AI systems change quickly.
How Halbarad helps
Halbarad helps teams maintain an AI supplier and use-case inventory, map providers and downstream dependencies, collect evidence, monitor changes, track incidents and issues, and preserve the approval trail.
Halbarad supports AI governance operations. It does not determine AI Act legal classification.
Disclaimer
This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.