AI compliance is system design, not paperwork. The EU AI Act requires continuous testing, documentation, and monitoring — not a one-time certification. This guide covers what the Act actually demands technically for LLM systems and how to build evidence of compliance.
The EU AI Act ensures AI systems meet legal, regulatory, and industry standards for safety, transparency, security, and accountability — enforced through continuous testing, documentation, and monitoring rather than a single periodic audit.
The core obligations: risk classification with documented justification, technical documentation maintained on an ongoing basis, post-market monitoring infrastructure, and — for non-compliance — exposure to EU fines, market restrictions, and lost enterprise contracts that increasingly require Act compliance as a condition of doing business.
The Act sorts AI systems into four risk tiers, each with sharply different obligations.
| Risk Tier | Examples | Requirements |
|---|---|---|
| Unacceptable | Social scoring, manipulative AI | Banned entirely |
| High risk | Healthcare AI, financial AI, employment screening | Risk assessment, technical documentation, continuous monitoring |
| Limited risk | Customer service chatbots | Transparency disclosures |
| Minimal risk | Spam filters, basic tools | Light oversight |
Most enterprise LLM deployments handling healthcare, financial, or employment-related decisions land in the high-risk tier — which is where the bulk of the Act's technical obligations apply.
Article 11 requires technical documentation covering the AI system's design, capabilities, limitations, and risk management measures. This isn't a document you write once for an initial audit — it has to be maintained continuously as the system changes, which means your documentation process needs to be tied to your actual deployment pipeline, not a separate compliance exercise that happens after the fact.
Article 72 requires ongoing monitoring of deployed AI systems — not a one-time pre-launch check. For high-risk systems, this means continuous evidence that the system is still behaving as documented, with a process for detecting and reporting when it isn't.
The HexTyx AI Security Assessment produces audit-ready security testing evidence mapped to Article 11 documentation and Article 72 monitoring requirements.