Compliance

The EU AI Act in plain English for boards

The EU AI Act is the first law in the world that tells businesses exactly how they must use AI. It applies to any company selling into the EU, and most boards have not read it yet.

By Zakir Hoosen, Director, Fuzzelogic Solutions. Board-level guidance in plain English.

The EU AI Act is law now. It tells any business that puts an AI system on the EU market, or uses AI to make decisions about people in the EU, exactly what it must do. The Act is long, it is technical, and it is full of terms that mean something different in a boardroom than they do in a lab. This guide strips all of that away.

If your business sells into the EU, employs people in the EU, or makes decisions that affect people in the EU, this law applies to you. That covers most Isle of Man firms with international clients.

What the law actually says

The EU AI Act does not ban AI. It sorts AI systems into four risk levels, and it tells you what to do for each one.

1. Unacceptable risk. Banned outright. Social scoring by governments, real-time biometric surveillance in public, and systems that manipulate people without their knowledge fall here.
2. High risk. Allowed, but only with checks. Systems used in hiring, credit decisions, law enforcement, and critical infrastructure sit here. You need documentation, human oversight, testing, and ongoing monitoring.
3. Limited risk. Allowed with transparency. Chatbots must tell people they are talking to a machine. Deepfakes must be labelled.
4. Minimal risk. No rules beyond what already exists. Spam filters and recommendation engines sit here.

Most board-level concern belongs in the high-risk category. If a system makes or influences a decision about a person, their money, their job, or their access to services, it is probably high risk.

Who does it apply to

The Act applies to three groups, and most boards do not realise it covers all three.

First, providers. Anyone who puts an AI system on the EU market. That includes firms that build it and firms that brand it as their own.

Second, deployers. Anyone who uses an AI system in a professional capacity within the EU. If your business uses an AI tool to screen candidates or assess creditworthiness, you are a deployer.

Third, importers and distributors. If you bring an AI system into the EU from outside, you have obligations too.

If your Isle of Man business provides AI services to clients in the EU, you are almost certainly a provider under this law. The fact that your company is registered on the island does not change that.

The timeline

The Act entered into force in August 2024, and the rules roll out in stages. The bans on unacceptable risk systems apply immediately. The rules for general-purpose AI models apply from August 2025. The obligations for high-risk systems apply from August 2026.

That means boards have months, not years. The firms that start preparing now will have an easier path than the ones that scramble later.

A board that does not understand the strategic implications of AI is a board that will not understand the regulatory implications either.

What it means for boards

The EU AI Act is not just a compliance exercise. It changes how you govern AI.

First, someone on the board needs to own this. Not a committee. A person. The Act requires certain organisations to have a human oversight structure for high-risk AI. That means a named individual who understands the system, understands the risk, and has the authority to stop it.

Second, your existing vendor contracts probably do not cover this. If you buy an AI system from a supplier, the Act says the provider must give you certain information and documentation. If your contract does not require that, you have a gap.

Third, your risk register needs updating. AI risk is now a regulatory category, not just an operational one. Boards that treat AI risk the same as general technology risk are missing the point.

If your organisation sits in that 21%, the EU AI Act makes the gap harder to ignore.

The Fuzzelogic view

This is opinion, not legal advice. The Act is clear in some places and vague in others. The definitions of high risk will be tested in courts and by regulators over the coming years. What is certain is that the direction of travel is fixed. The JFSC issued AI governance guidance in July 20206, and the GFSC is moving the same way. Boards that build governance now will not have to rebuild it later.

The responsible AI adoption steps Fuzzelogic uses apply directly here.

1. Find it. Know where AI exists in your business. You cannot comply with a law that covers systems you do not know about.
2. Classify it. Work out which risk tier each system falls into. The Act gives you the categories.
3. Govern it. Put the oversight, documentation, and monitoring in place. The Act tells you what that looks like for high-risk systems.
4. Train for it. The people who use these systems need to know the rules. An untrained operator is a compliance risk.

What to do next

The boards that get this right will treat the EU AI Act as a starting point, not a destination. The law sets a floor. Good governance sets the standard.

Start with the assessment. Two to four weeks, fixed price, and you own the verdict and the roadmap whether or not we build any of it. When you are ready to talk AI, call Fuzzelogic Solutions and ask for Zak. www.FuzzelogicSolutions.com | info@FuzzelogicSolutions.com | +44 (0)1624 618950

For the fuller picture, read AI compliance in the Isle of Man next, then AI vendor lock-in. The full library is on our index. Our site explains how Fuzzelogic approaches AI for business. You can reach Zak directly via our contact page.