Lessons Learned from the EU AI Act: What Organizations Should Know (Part-2)

5 days ago

7 min read

1. INTRODUCTION AND RECAP

AI now shapes decisions about jobs, loans, healthcare, and customer service. The EU AI Act is the first comprehensive law written to keep those decisions safe and fair, and its lessons reach well beyond Europe. If you are new to this series, here is the short version.

The Act sorts AI into risk levels: banned uses, high-risk systems with strict rules, limited-risk systems with transparency duties, and minimal-risk systems that are largely left alone. It gives organizations roles, such as provider and deployer, and expects controls across the whole AI lifecycle, from the first idea to retirement. The main high-risk deadlines are expected to move to December 2027 and August 2028 under a provisional political agreement, but the expectations behind them have not changed.

Part 1 covered four lessons, each backed by a real case:

Know what AI you have. You cannot manage what you cannot see.
Classify and assess risk before you deploy. Test early, especially for systems that affect people’s lives.
Build governance with clear accountability. Every system needs a named owner.
Make human oversight real. A reviewer who approves everything is not oversight.

Part 2 covers four more lessons, then looks at the global standards that help you turn all eight into working compliance.

2. KEY LESSONS FOR ORGANIZATIONS

LESSON 5: BE TRANSPARENT AND DOCUMENT EVERYTHING

The Act requires technical documentation, logging, and clear information for users. People must also be told when they are dealing with AI. Documentation is your evidence. Without it, you cannot explain a decision, investigate an incident, or answer a regulator.

Record each system’s purpose, design choices, data sources, test results, and known limits. Keep logs that let you trace important decisions, and label AI-generated content. Treat your public statements about AI as promises, because you may be held to them.

Case study: A national airline’s chatbot (2024). A customer was given incorrect refund guidance by an airline’s website chatbot. The airline argued that the chatbot was a separate entity responsible for its own statements. A tribunal rejected that argument and ordered the airline to compensate the customer. You are accountable for what your AI tells people, and testing, documented limits, and output monitoring protect you.

Evidence is the hardest part of compliance. Gorisco helps organizations build audit-ready documentation and keeps it current as systems change, so you can answer questions quickly instead of rebuilding the story under pressure.

LESSON 6: GOVERN YOUR DATA AND VENDORS

AI is only as good as its data. Article 10 expects high-risk systems to use data that is relevant, representative, and managed with attention to bias. And since most organizations buy or build on third-party AI, vendor risk is AI risk.

Track where your data comes from and check it for gaps and skew. Align data use with privacy laws such as the GDPR in Europe and the DPDP Act in India. Ask vendors for documentation, test evidence, security proof, and incident commitments. Put AI-specific terms in contracts, such as audit rights, notice of major changes, and clear liability.

Case study: A US healthcare risk algorithm (2019). A 2019 study in the journal Science examined a widely used algorithm that helped decide which patients received extra care. It used past healthcare spending as a stand-in for medical need. Because Black patients had historically received less care and spent less, the system underestimated how sick they were. The model did what it was built to do. The flaw was in the data choice, and nobody had tested for it.

Gorisco’s managed third-party AI risk reviews help organizations ask vendors the right questions, collect and track their evidence, and avoid inheriting hidden risk.

LESSON 7: MONITOR CONTINUOUSLY AND PREPARE FOR INCIDENTS

Launch is not the finish line. Models drift, data changes, attackers adapt, and people find new ways to use tools. The Act requires monitoring after launch and reporting of serious incidents, and every major framework treats monitoring as essential.

Track performance, fairness, and drift against agreed limits. Set alerts and clear triggers for retraining, rollback, or shutdown. Keep an incident plan that covers detecting, containing, investigating, notifying, and learning. Review each system on a schedule, and whenever it changes in a meaningful way.

Case study: A large online real estate company (2021). In 2021, a large online real estate company used algorithms to price homes it bought and resold. When the housing market shifted quickly, the approach could not keep up. The company shut down the business, wrote off hundreds of millions of dollars, and cut roughly a quarter of its workforce. There were several causes, but it shows how costly it is to run a model in a changing world without strong monitoring and firm limits on decisions.

Monitoring is an ongoing responsibility, not an annual initiative. Gorisco helps organizations to run continuous control monitoring, scheduled reviews, and incident response support as a managed service, so problems surface early and not in a news story.

LESSON 8: RESPECT THE RED LINES AND BUILD THE COMPLIANCE IN

Some AI uses are simply off limits, and data protection law applies to AI as much as to anything else. Building compliance in from the start is far cheaper than fixing a violation later.

Screen every new use case against the Act’s prohibited practices and the laws of each country where you operate. Involve legal and privacy teams at the design stage, not at the end. Map the rules that overlap, such as AI law, data protection, consumer law, and sector rules.

Case study: A facial recognition company (2024). A facial recognition company built a database by scraping billions of images from the web. Several European data protection authorities acted against it, including a €30.5 million fine in 2024. The EU AI Act now explicitly bans untargeted scraping of facial images to build such databases. In a separate case, a national regulator temporarily blocked a popular AI chatbot in 2023 and later fined its maker over data protection issues. Together they show that privacy law and AI law work side by side.

Gorisco helps organizations map overlapping obligations across AI law, data protection, and sector rules, so you can see what applies to each system in each market.

4. GLOBAL STANDARDS AND A PRACTICAL PATH

The EU AI Act tells you what to achieve. Standards and frameworks help with how. No single document covers everything, so mature organizations combine several.

ISO/IEC 42001:2023 is the first certifiable international standard for AI management. It sets up an AI Management System, a repeatable way to run AI governance, much as ISO 27001 does for information security. Its Annex A lists 38 controls covering policies, impact assessment, the AI lifecycle, data, third parties, and responsible use. It works well as the backbone of your program.

ISO/IEC 23894 and the NIST AI Risk Management Framework give you the risk method. NIST organizes the work into four functions: Govern, Map, Measure, and Manage. It also offers a Generative AI Profile for risks specific to those systems. ISO/IEC 27001 and 27701 secure the information security and privacy foundations AI depends on. ISO/IEC 42005 supports impact assessment, and ISO/IEC 38507 helps boards set accountability at the top.

One caution matters. ISO/IEC 42001 certification does not equal EU AI Act compliance. The Act has specific legal duties, such as risk classification, conformity assessment, and registration. But a well-built management system covers much of the groundwork, so you are not starting from zero.

A practical path looks like this. In the first two months, name an owner, publish an AI policy, build your inventory, and start AI literacy training. By month four, classify systems by risk and role, assess the higher-risk ones, review key vendors, and run a gap assessment against the Act, ISO/IEC 42001, and the NIST AI RMF. Over the following months, close the gaps in documentation, testing, oversight, and contracts, and set up monitoring and incident plans. From there, review regularly, run internal audits, and consider ISO/IEC 42001 certification for outside assurance.

Sustaining it is the hard part. Most teams find the hard part is not starting but keeping it going. Systems change monthly, rules keep moving, and few organizations have people who understand law, risk, data science, and audit together. This is where a managed approach helps. At Gorisco, we provide managed GRC services across the AI lifecycle, building one control set mapped to many frameworks so a single piece of evidence can support the EU AI Act, ISO/IEC 42001, the NIST AI RMF, and your privacy obligations at once. The aim is less duplicated work and a clearer view of where you stand.

5. CONCLUSION

The EU AI Act is more than a regulation. It is a practical blueprint for using AI responsibly, and the eight lessons in this series show what it asks of organizations in everyday terms.

In Part 1, we saw that AI failures rarely begin with the technology. They begin with gaps in basic practices: not knowing which AI tools are in use, not assessing risk before deployment, not assigning clear accountability, and not giving human reviewers real authority.

In Part 2, the same pattern continued. Weak documentation, unexamined data and vendors, missing monitoring, and overlooked legal limits each led to costly and well-documented consequences. In every case, the root cause was a governance, risk, or compliance gap that existing frameworks were designed to close.

Several points stand out for organizations moving forward:

The Act sets the legal goals, and standards provide the method. ISO/IEC 42001, ISO/IEC 23894, the NIST AI RMF, and related frameworks help turn legal requirements into repeatable practice.
Certification is not compliance. A strong management system builds the foundation, but the Act’s specific duties, such as risk classification, conformity assessment, and registration, must still be met directly.
Timelines may shift, but expectations will not. Even with high-risk deadlines expected to move to late 2027 and 2028, regulators, customers, and partners are already asking how AI is governed.
Compliance is continuous. AI systems, data, and regulations all change, so controls must be monitored and reviewed throughout the AI lifecycle, not only at launch.

Organizations that act early gain more than readiness for a single law. They build the trust, consistency, and evidence needed to scale AI with confidence in any market.

At Gorisco, we help organizations strengthen resilience by aligning people, processes, and technology. From governance frameworks to remote-work policies, our focus is on building secure, transparent, and continuity-ready operations in today’s connected world.

To read our other blogs, click here. We would love to hear your thoughts, so please share your comments!