EU AI Act Preparation: An Enterprise Compliance Checklist

With the EU AI Act enforcement beginning, enterprises must classify AI systems, implement risk management, and ensure transparency across their AI portfolios.

The Evolving AI Regulatory Landscape in 2025

The regulatory landscape for artificial intelligence has entered a period of rapid evolution and increasing complexity. With the European Union AI Act now in effect, China implementing its comprehensive AI governance framework, and jurisdictions across Asia Pacific and North America developing their own approaches, enterprises operating across multiple regions face a challenging compliance puzzle. The days of treating AI regulation as a niche concern for legal teams are over; AI compliance has become a board-level strategic issue that affects technology choices, data practices, and business models.

The EU AI Act represents the most comprehensive AI regulatory framework to date, establishing a risk-based classification system that assigns different obligations based on the potential impact of AI systems. High-risk AI systems used in critical infrastructure, education, employment, and law enforcement face the most stringent requirements, including conformity assessments, risk management systems, data governance requirements, technical documentation, and human oversight mechanisms. Enterprises deploying AI in the EU must conduct thorough audits of their AI portfolios to classify systems according to the risk framework and implement the corresponding compliance measures.

• EU AI Act enforcement began with prohibited AI practices bans, followed by high-risk system obligations, with full enforcement including general-purpose AI rules taking effect throughout 2025
• China's AI regulatory framework now spans algorithmic recommendation management, deep synthesis (deepfake) regulations, and generative AI measures, creating a comprehensive governance structure
• GDPR enforcement increasingly targets AI systems, with supervisory authorities issuing guidance on automated decision-making, data minimisation in model training, and data subject rights in the context of AI outputs
• Asia Pacific privacy laws in Japan, South Korea, Thailand, India, and Australia are converging towards GDPR-like standards, creating both challenges and opportunities for harmonised compliance approaches

China's Personal Information Protection Law and AI Compliance

China's Personal Information Protection Law (PIPL) has profound implications for AI systems that process personal data. Unlike the GDPR, which takes a principles-based approach, PIPL includes specific provisions that directly address AI and automated decision-making. Enterprises deploying AI in China must ensure that algorithmic recommendation systems provide opt-out mechanisms, that automated decision-making results are explainable to data subjects, and that cross-border transfers of personal data used for AI training meet the stringent security assessment or standard contract requirements.

The intersection of PIPL with China's other AI-specific regulations creates a multi-layered compliance environment. The Algorithm Recommendation Management Provisions require transparency in how recommendation algorithms work and give users the right to opt out of personalised recommendations. The Deep Synthesis Provisions mandate labelling of AI-generated content and require platforms to maintain content logs. The Generative AI Measures impose obligations on training data governance, content safety, and user consent for generative AI services. Navigating these overlapping requirements demands a coordinated compliance strategy that addresses all applicable regulations simultaneously.

For multinational enterprises, the challenge is compounded by the need to comply with both Chinese and international regulations simultaneously. Data localisation requirements under PIPL and the Data Security Law may conflict with the data access needs of globally centralised AI systems. Different transparency and explainability requirements across jurisdictions may necessitate jurisdiction-specific model configurations. Enterprises that take a fragmented, jurisdiction-by-jurisdiction approach to compliance face exponentially increasing complexity and cost; the most effective strategy is to design AI systems from the ground up to meet the most stringent requirements across all applicable jurisdictions.

Building a Proactive AI Compliance Programme

Reactive compliance, where enterprises respond to regulatory requirements only after they are enforced, is both risky and expensive. The most effective approach is to build a proactive AI compliance programme that anticipates regulatory trends and embeds compliance into AI development and deployment processes. This programme should include regular regulatory horizon scanning, AI impact assessments for new systems, ongoing monitoring of AI system behaviour, and documented processes for responding to regulatory inquiries and enforcement actions.

Explainability and transparency are increasingly central to AI compliance across all jurisdictions. Enterprises need the ability to explain how their AI systems make decisions, what data influenced specific outcomes, and how potential biases are identified and mitigated. This requires both technical capabilities, such as interpretability tools and decision logging, and organisational processes, such as model documentation standards and review boards. The enterprises that invest in building robust explainability infrastructure now will be well-positioned as regulations continue to evolve and enforcement intensifies.

Privacy-preserving AI techniques offer a promising path to compliance without sacrificing analytical capability. Differential privacy adds calibrated noise to data or model outputs, making it mathematically impossible to identify individuals while preserving aggregate statistical properties. Federated learning enables model training on decentralised data without centralising sensitive information. Homomorphic encryption allows computations on encrypted data, producing encrypted results that can only be decrypted by authorised parties. These techniques are moving from research to production, with leading enterprises deploying them to comply with data protection regulations while maintaining the ability to extract valuable insights from sensitive datasets.