Regulation (EU) 2024/1689, the AI Act, classifies artificial intelligence systems by risk and imposes obligations on those who develop and use them, including outside Europe. Privacy Tools It inventories and controls these systems.
The AI Act is the first comprehensive law on artificial intelligence, with phased implementation starting in August 2024. Official source: Text of the regulation in EUR-Lex.
The main obligations of the regulation are:
What does the regulation define for suppliers and users of AI systems?
The module of AI Governance It inventories the organization's AI systems, classifies each one by risk level, and records its purpose, data used, suppliers, and controls. Risk management and the Diagnoses and Assessments They apply assessments based on the AI Act, ISO/IEC 42001, and NIST AI RMF.
A Audit Management proves the high-risk controls; Capacity records the AI literacy of the teams; the Workflow It automates approvals and reviews. The same inventory system complies with Bill 2338/2023, currently under consideration in Brazil.
AI systems inventory with risk classification
Reviews based on AI Act, ISO/IEC 42001 and NIST AI RMF
High-risk controls documented and auditable
AI Literacy with tracks and recording by contributor
Human supervision with approvals and reviews in motion
The AI Act (Regulation (EU) 2024/1689) is the European Union law on artificial intelligence. It classifies AI systems by risk level, prohibits certain practices, imposes obligations on high-risk systems and general-purpose models, and requires transparency in the use of AI with people.
Yes, when the AI system is placed on the EU market or when the output produced by it is used in the European Union (Art. 2), even if the company is not based there. Suppliers from outside the EU need to designate an authorized representative in the bloc.
These are the systems listed in Annex III, such as those used in recruitment, credit assessment, education, critical infrastructure, essential public services, and law enforcement, as well as the security components of regulated products. They require risk management, data governance, technical documentation, record keeping, human oversight, and compliance assessment.
Up to €35 million or 7% of annual global turnover for prohibited practices; up to €15 million or 3% for non-compliance with other obligations; and up to €7,5 million or 1% for providing incorrect information to the authorities (art. 99). For SMEs and startups, the lower of the two amounts applies.
Bill 2338/2023, currently under consideration in the National Congress, follows the same logic of risk classification. Even before a Brazilian law, the LGPD (Brazilian General Data Protection Law) already regulates automated decisions (article 20), and clients and auditors request evidence of AI governance. The inventory created for the AI Act serves as the basis for the Brazilian law.
Speak with one of our specialists and learn how to inventory, classify, and control your organization's AI systems.
