The European Union has adopted the AI Act (Regulation (EU) 2024/1689), a comprehensive regulatory framework governing the development, deployment and use of artificial intelligence. As a regulation, the AI Act applies directly across the EU and introduces a common set of requirements aimed at ensuring that AI systems are safe, trustworthy and respectful of fundamental rights.
What applies, and when
This is the part that has moved most since I first wrote this article, and it changes what you should be working on right now.
The AI Act phases in. The prohibitions and the AI literacy obligation applied from February 2025. Obligations for general-purpose AI models followed in August 2025. The bulk of the regulation was due to apply from 2 August 2026.
Then the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force in late July 2026 and deferred the high-risk deadlines:
- Standalone high-risk systems under Annex III, such as hiring, credit scoring and education, moved from August 2026 to 2 December 2027
- High-risk AI embedded in regulated products under Annex I moved to 2 August 2028
- The Article 50 transparency duties kept their original date and applied from 2 August 2026, with a grace period to December 2026 for machine-readable marking of content from systems already on the market
Check Regulation (EU) 2026/1744 for the exact wording before you build a plan on these dates. The practical point is the split: the high-risk machinery has more time, and the transparency duties do not.
What does the AI Act mean for organizations using AI?
Organizations that use AI systems such as Microsoft Copilot, ChatGPT, Claude or other generative or decision-support tools typically fall under the role of deployers according to the AI Act.
Here is a distinction worth making early, because a lot of AI Act anxiety is misdirected. Deploying Microsoft 365 Copilot to help people draft documents is not, in itself, operating a high-risk AI system. The high-risk categories are specific: Annex III lists uses such as recruitment, creditworthiness, education and essential services. If you use Copilot to screen job applicants, you are in Annex III territory. If you use it to summarise meeting notes, you are not.
That matters for sequencing. Most organizations deploying generative AI are dealing with AI literacy, transparency and ordinary governance, not the Annex III regime. Work out which bucket each of your AI uses falls into before you start implementing high-risk controls you may not need.
If an AI system processes personal data, which is often the case, organizations must comply with both the GDPR and the AI Act. This means operating under two regulatory regimes at the same time:
- Under the GDPR, the organization acts as a data controller and must ensure lawful processing, transparency, data minimization and appropriate security measures.
- Under the AI Act, the organization acts as a deployer and must meet a set of obligations related to AI risk management, governance, oversight and accountability.
While there is some overlap between the two frameworks, the AI Act goes beyond data protection and introduces requirements related to fundamental rights, system behaviour and lifecycle management of AI systems.
Key obligations under the AI Act for deployers
The AI Act introduces a risk-based approach. Among other things, organizations must ensure that:
- AI systems are classified according to risk
- high-risk AI systems are subject to enhanced governance, testing, traceability and documentation requirements
- AI systems are monitored and followed up after deployment (post-market monitoring)
- human oversight is implemented where required
- potential impacts on fundamental rights are assessed, not limited to privacy alone
- incidents, malfunctions and adverse effects are handled systematically
- roles and responsibilities related to AI governance are clearly defined
Documenting compliance in practice
To comply with the AI Act, organizations must be able to demonstrate compliance in a structured, consistent and auditable way. This is where Microsoft Purview Compliance Manager can be used as a practical supporting framework.
Compliance Manager provides a premium regulatory template called the EU Artificial Intelligence Act, which translates the requirements of the regulation into organizational and technical improvement actions derived from its chapters and articles.
It is one of four premium AI templates, which now sit under their own heading on the Regulations page:
- EU Artificial Intelligence Act
- ISO/IEC 42001:2023
- ISO/IEC 23894:2023
- NIST AI Risk Management Framework 1.0
There is also a fifth thing to know about, because it arrives whether you ask for it or not. Activating Microsoft 365 Copilot licences brings in a regulation called AI Baseline, which merges all four of the standards above into one consolidated control framework. If you want a single view across them, that is where to look; if you need the structure an auditor will ask for against one specific standard, use the individual template. I cover AI Baseline in a separate article.
The template does not automatically make an organization compliant, nor does it replace the legal and organizational assessments that must be performed. Instead, it provides a structured way to identify, prioritize, implement and document measures related to the use of AI systems.
The template is not tied to a specific AI service, but it is particularly relevant for organizations using AI capabilities within the Microsoft 365 ecosystem. This includes Microsoft 365 Copilot, Copilot Chat and other generative AI solutions that use organizational data stored in SharePoint, OneDrive and Exchange. Microsoft also states that the AI templates apply to every generative AI app Purview supports for AI interactions, which includes Security Copilot, ChatGPT Enterprise, Microsoft Foundry, Gemini and DeepSeek.
Licensing has changed
This article previously said you needed an A5 or E5 licence, or the equivalent Compliance Suite licence, to use the EU AI Act template. That is still the general rule for premium templates, and using one counts against your purchased premium licences.
There is now an easier way in. Built-in assessments for the key AI regulations, including the EU AI Act, the NIST AI RMF and the ISO/IEC standards, are provided free for six months with Copilot or Agent licences. If you are deciding whether this is worth building a programme around, that window is when to find out.
Example 1 – Article 12: Record-keeping and logging
Article 12 of the AI Act sets requirements for record-keeping and logging for high-risk AI systems. The objective is to ensure traceability, auditability and the ability to perform effective investigations if incidents or failures occur.
Several improvement actions in Compliance Manager are directly linked to Article 12.1.
These improvement actions focus on establishing comprehensive logging and traceability across systems involved in AI usage. By automatically collecting logs from sources such as firewalls, proxies and cloud services, organizations gain a consolidated view of activity and events related to AI usage.
In addition, cloud activity logs and audit logs provide detailed audit trails for changes to cloud resources and actions performed by users and administrators. This makes it possible to determine who did what, when it happened and at what level. Together, these capabilities provide a strong and auditable foundation for meeting the record-keeping and logging requirements of Article 12.
One practical note for the Microsoft 365 side: filter the unified audit log on Copilot as the workload, and check how long your licence actually retains those records before you rely on them as evidence. Logging that has aged out is not traceability.
Example 2 – Article 14: Human oversight
Article 14 introduces requirements for human oversight of high-risk AI systems. The goal is to ensure that AI systems do not operate without meaningful human control and the ability to intervene when necessary.
Several improvement actions in Compliance Manager are mapped to Article 14.4.
These actions collectively support governance and human control over AI usage. By classifying data using sensitivity labels and restricting AI access to data through data loss prevention policies, organizations can significantly reduce the risk of AI systems accessing or disclosing information they should not.
In addition, reporting and analytics capabilities in Microsoft Purview provide visibility into how AI is actually being used, including whether sensitive data appears in prompts or is used in unintended ways. These measures make it possible to monitor AI usage, understand emerging risks and intervene when required, in line with the human oversight requirements of the AI Act.
Two capabilities have arrived since this article was written and are worth adding to the oversight story. Data Security Posture Management for AI gives you an inventory of which AI apps are actually in use and which policies cover them, with an activity view that has its own tab for AI activities. And Insider Risk Management now has a Risky AI usage policy template, plus a separate Risky Agents template covering agents hosted in Copilot Studio and Microsoft Foundry. The second one is the interesting one for AI Act purposes: it is behavioural monitoring of an individual agent, with alerting and its own baseline. For documenting human oversight of an autonomous system, that is a stronger answer than a policy document saying agents must be used responsibly.
Note that improvement actions in Compliance Manager contribute different point values. These scores are intended to support prioritization and risk-based decision-making, not to replace legal judgment.
Assessing and tracking compliance
Once the EU AI Act template has been enabled and improvement actions have been implemented, organizations can run assessments in Compliance Manager to evaluate their current level of compliance.
The assessment score is divided into two parts: one reflects improvement actions that Microsoft has implemented as the service provider, the other reflects actions the organization itself is responsible for implementing.
If we select «Your improvement actions», we can see what we need to do. Ouch, only 2 % completed!
If you have an Azure AI Foundry deployment, some of that work can now test itself. Compliance Manager integrates with AI Foundry and syncs 15 automated evaluation actions, covering metrics such as reliability, coherence and fluency, showing real pass or fail status rather than a box someone ticked. In a framework that otherwise depends almost entirely on manual attestation, evidence that generates itself is worth seeking out.
Used correctly, Microsoft Purview provides a practical and structured foundation for translating the AI Act’s legal requirements into concrete technical and organizational measures. It enables organizations to document compliance, track progress over time, manage risk and support a responsible and trustworthy use of artificial intelligence.
What it does not do is tell you whether your AI use is high-risk, or whether a given obligation applies to you at all. That remains a legal assessment, and after the Digital Omnibus it is also a question of which year you are in.
