EU AI Act: what should a first security hire know?

The EU AI Act is a regulation that sorts AI systems by risk and puts duties on those who provide or deploy them. Some rules already apply; others were pushed back. If you are new to security at a company with AI features, start by finding out which tier each system falls into.

What are the risk tiers?

The European Commission describes four levels. Unacceptable risk practices are prohibited. High risk systems face strict obligations. Some systems carry transparency duties, for example labelling deep fakes and certain published text. Minimal risk systems, such as spam filters or video game AI, are not regulated by the Act.

High risk uses include AI in critical infrastructure, education, employment, migration and border control, among others listed by the Commission. Before a high risk system goes to market, the Commission lists duties such as risk assessment and mitigation, high quality datasets, logging of activity for traceability and detailed documentation.

What dates matter?

Per the Commission's page, the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions:

• Prohibited practices and AI literacy obligations: 2 February 2025.
• Governance rules and obligations for general purpose AI models: 2 August 2025.
• High risk rules for certain sensitive areas (Annex III): extended to 2 December 2027.
• High risk rules for AI embedded in regulated products (Annex I): extended to 2 August 2028.

These extensions come from the AI Omnibus, which the Commission says entered into force on 27 July 2026. The page also says transparency rules come into effect in August 2026. Dates have moved before, so confirm on the Commission site before you plan around them.

Why does this land on security?

Several duties sit close to security work: logging, documentation, data governance, and resilience against misuse. Incident reporting for serious incidents is another area to understand. You will not own the legal reading, but you will be asked for evidence: inventories, logs, access controls and test results.

A constructed example

A company's hiring tool ranks applicants. You are asked whether it is covered. Employment appears among the high risk areas the Commission lists, so you flag it for legal review and start collecting the basics: what data trains it, who can change it, what is logged, who reviews its outputs. Even if the formal deadline is 2 December 2027, an inventory now saves rushed work later.

What should you do in the first month?

1. List every AI system the company builds, buys or embeds, with an owner.
2. Note where each is used and whether people in the EU are affected.
3. Ask legal to assign a tier or confirm uncertainty.
4. Check whether your company is a provider (builds), a deployer (uses), or both.
5. Review logging: can you reconstruct what a high risk system did?
6. Document data sources and access controls.
7. Track the Commission page for date changes.
8. Start a shared register so legal, product and security use one list.

Safeguard's compliance automation can help organize controls and evidence; it does not determine your legal classification or make you compliant.

What do you not need to do yourself?

You are not expected to interpret the law or decide classification alone. Legal owns that reading. Your contribution is evidence and controls: knowing what systems exist, how they are secured, what they log, and how incidents are handled. A useful habit is to keep a plain English record of each AI system: purpose, data used, who can change it, what is monitored. Update it when systems change. It will help with the Act, with customer reviews, and with any other framework your company adopts later. Keep dates under review, since the Commission has already moved some deadlines.

Quick check

Sources

• European Commission, AI Act regulatory framework

Last reviewed: 18 October 2026.