Our summary
Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in phases. It sorts AI systems by risk: some uses are banned, “high-risk” systems (for example in hiring, credit scoring and critical infrastructure) must meet strict requirements, and some systems such as chatbots and AI-generated content have transparency duties. It also has rules for general-purpose AI models.
High-risk systems need risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity controls. Fines can be very high, up to 7% of worldwide turnover for banned uses.
How auditors use it: Start with an inventory of the AI systems the organisation builds or uses, classify them by risk, and test the governance and controls required for each class.