The December 2023 trilogue agreement on the EU AI Act is not just a regulatory milestone—it is a design specification for any organization deploying AI within European borders. And for companies bidding on EU government contracts through TED, it is a prerequisite.
What the Act actually requires. The risk-based classification system divides AI systems into four categories: unacceptable risk (banned), high risk (strict compliance), limited risk (transparency obligations), and minimal risk (no specific rules). The critical category for most enterprise deployments is high risk—which includes AI used in employment decisions, credit scoring, law enforcement, and critical infrastructure management.
High-risk systems must maintain comprehensive documentation, ensure human oversight, provide explanations for decisions, and undergo conformity assessments before deployment. These are not post-hoc compliance checkboxes. They are architectural requirements.
Architecture implications. A system that cannot explain its decisions cannot be retrofitted for compliance. Explainability must be designed into the inference pipeline, not appended as a logging layer. Audit trails must capture not just what the model output but what data it received, what version of the model was running, and what alternative outcomes were considered.
The procurement dimension. EU tenders published on TED are beginning to include AI Act compliance as a requirement. U.S. federal procurement through SAM.gov is following a parallel path with the NIST AI Risk Management Framework. Organizations that treat compliance as a feature bolted onto an existing system will find themselves rewriting fundamental components. Those that embed it from the start will move faster through both regulatory review and contract evaluation.
In our practice, we have found that the organizations best positioned for AI Act compliance are those that already practiced data lineage, model versioning, and decision logging—not because they anticipated the regulation, but because these practices produce better systems. The Act is codifying what good engineering already demands.