Challenges of Implementing the EU AI Act for High-Risk AI Systems
In this blog post, we examine the practical challenges of implementing the EU AI Act's requirements for high-risk AI systems. We review the relevant obligations and discuss technical and cross-cutting challenges involving data governance, system reliability, transparency, documentation, and monitoring. We also explore how organizational capabilities influence compliance efforts and how Kladero can support organizations through AI development, governance consulting, and training.
Introduction
The European Union's Artificial Intelligence Act (“AI Act”) establishes a comprehensive regulatory framework for the development and use of artificial intelligence (AI) in the EU [1], [2]. Depending on the type of AI system, its intended purpose, and the role of the organization involved, the AI Act introduces requirements concerning risk management, data governance, transparency, human oversight, technical documentation, and other aspects of AI development and use.
However, understanding which regulatory requirements apply is only one part of achieving compliance. Organizations must also determine how to implement the applicable requirements in their existing AI systems, technical infrastructure, development processes, and organizational workflows. For example, requirements concerning data quality, accuracy, and robustness may involve changes to how AI models are trained, evaluated, and monitored, while risk management and documentation obligations may require new internal processes and responsibilities. Implementing the corresponding measures can present substantial challenges, particularly when existing systems and development processes were not originally designed to meet regulatory requirements [3].
Implementing the AI Act can be particularly challenging for providers of high-risk AI systems, which are subject to some of the regulation's most extensive requirements. High-risk AI systems include certain applications that can significantly affect people's health, safety, or fundamental rights. These applications range from AI systems used to evaluate job applicants, assess students' learning outcomes, and determine individuals' creditworthiness to AI systems used as safety components in the management and operation of critical infrastructure, depending on the applicable classification criteria [1].
In this blog post, we examine the main challenges of implementing the EU AI Act's requirements for high-risk AI systems, discuss how technical capabilities and organizational practices influence compliance efforts, and explore approaches for addressing the challenges.
Requirements for High-Risk AI Systems
Under Article 6 of the AI Act, AI systems can be classified as high-risk based on their intended purpose and the risks associated with their use. In particular, the regulation distinguishes between two main categories:
-
AI systems covered by product safety legislation. AI systems that serve as safety components of products, or are themselves products, covered by certain EU harmonization legislation may be classified as high-risk when the relevant products or systems require third-party conformity assessments. Examples include certain applications involving medical devices, machinery, and other regulated products.
-
AI systems used in specified high-risk areas. Annex III identifies several areas in which AI systems may be classified as high-risk, including biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, and the administration of justice. For example, AI systems used to evaluate job applicants or assess individuals' creditworthiness may fall within the high-risk category. Article 6 also provides exceptions for certain Annex III systems that do not pose a significant risk under the conditions specified by the regulation [1].
To ensure that high-risk AI systems meet the requirements of the AI Act, providers must implement a range of technical and organizational measures throughout their development and operation. Articles 8–17 establish requirements concerning risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, cybersecurity, and quality management [1], [2].
The main requirements include:
-
Risk management (Article 9). Providers must establish and maintain a risk management system to identify, evaluate, and address risks to health, safety, and fundamental rights throughout the AI system lifecycle. Risk management also involves evaluating the effectiveness of mitigation measures and addressing relevant risks that emerge during development and use.
-
Data and data governance (Article 10). High-risk AI systems developed using model-training techniques must meet requirements concerning the quality and governance of training, validation, and testing datasets. Relevant measures include examining the suitability and representativeness of datasets, identifying potential biases, and addressing data quality issues.
-
Technical documentation and record-keeping (Articles 11–12). Providers must prepare and maintain technical documentation demonstrating how the AI system meets the applicable requirements. High-risk AI systems must also support automatic recording of events throughout their lifecycle, commonly referred to as logging, to facilitate traceability and monitoring.
-
Transparency and human oversight (Articles 13–14). High-risk AI systems must be sufficiently transparent to allow deployers to interpret their outputs and use them appropriately. Providers must supply relevant instructions and information concerning the system's capabilities and limitations. Furthermore, high-risk AI systems must be designed to enable effective human oversight, including measures for understanding, monitoring, and, where appropriate, intervening in their operation.
-
Accuracy, robustness, and cybersecurity (Article 15). High-risk AI systems must achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle. Relevant measures include testing system performance, addressing reasonably foreseeable errors and failures, and protecting against attempts to manipulate system behavior or compromise its security.
-
Quality management (Article 17). Providers must establish a quality management system covering the procedures and responsibilities required for regulatory compliance. The system includes measures concerning design and development, testing, documentation, risk management, and post-market monitoring, among other activities [1].
In addition to the requirements concerning the design, development, and operation of high-risk AI systems, the AI Act establishes further obligations for their providers. In particular, providers must retain technical documentation for the applicable period, generally ten years under Article 18, and keep automatically generated logs under their control for at least six months, unless applicable law provides otherwise (Article 19). Providers must also take corrective actions in cases of non-compliance (Article 20), cooperate with competent authorities by providing relevant information and documentation upon reasoned request (Article 21), and, where required, appoint an authorized representative within the Union (Article 22). Further obligations concern conformity assessment, declarations of conformity, CE marking, registration, post-market monitoring, and serious-incident reporting [1], [2].
Challenges of Implementing High-Risk AI Requirements
Although the AI Act specifies requirements for high-risk AI systems, translating these requirements into technical measures and organizational processes can present substantial difficulties. Some challenges arise directly from individual requirements, such as identifying and mitigating bias in training data or evaluating the robustness of an AI system. Others concern activities that support multiple requirements, including documentation, monitoring, and maintaining compliance throughout the AI system lifecycle. Furthermore, the extent of these challenges depends on an organization's technical capabilities, existing processes, and regulatory experience [3].
Requirement-Specific Technical Challenges
Several requirements of the AI Act involve technical challenges for which appropriate implementation measures depend on the characteristics and intended purpose of the AI system. In a multiple-case study involving six companies and three independent experts, Wagner et al. identified data governance, accuracy, robustness, cybersecurity, and transparency among the requirements most frequently perceived as difficult to implement [3].
-
Managing data quality and bias. Identifying and mitigating biases in training data can be difficult because datasets may contain systematic imbalances that are not immediately apparent and because eliminating all sources of bias may be unrealistic [4]. Organizations therefore need methods for detecting, evaluating, and addressing biases relevant to an AI system's intended use. Obtaining suitable datasets presents additional difficulties when data is subject to legal restrictions, originates from customers unwilling to share it, or does not adequately represent the intended application. These difficulties are particularly relevant to the data governance requirements under Article 10, which concern multiple stages of the data pipeline.
-
Evaluating accuracy, robustness, and cybersecurity. Evaluating whether an AI system performs reliably requires suitable metrics, representative test data, and testing procedures that reflect its intended operating conditions. Selecting meaningful accuracy metrics can be particularly difficult for systems whose outputs cannot be evaluated against a single, unambiguous correct answer (e.g., generative AI systems producing free-form text in response to user queries). Robustness testing must also account for changing inputs, errors, and potentially harmful feedback loops in continuously learning systems. Cybersecurity introduces additional difficulties because AI systems can be vulnerable to attacks targeting different stages of their lifecycle, including data poisoning during training and adversarial manipulation of inputs during operation. Identifying relevant threats and evaluating appropriate defenses requires security assessments tailored to the system and its deployment environment [3], [5].
-
Explaining AI system behavior and limitations. Providing deployers with sufficient information about an AI system's capabilities, limitations, and appropriate use can be challenging when its behavior is difficult to interpret. In particular, complex machine-learning models may produce outputs without offering a readily understandable explanation of the underlying decision process [6]. Providers must determine which information helps deployers interpret outputs and understand the conditions under which the system can be used appropriately, as required by Article 13. Disclosing technical details can also raise concerns about protecting intellectual property and avoiding the exposure of security-sensitive information [3].
Cross-Cutting Implementation Challenges
While some implementation challenges arise from individual requirements, others affect several obligations simultaneously. Important cross-cutting challenges include the following:
-
Maintaining documentation and traceability. Demonstrating compliance requires organizations to document relevant technical decisions, system characteristics, evaluation results, and risk management activities. Keeping this information accurate can be difficult when AI models, datasets, and software components change frequently. For example, updates to a deployed model may require organizations to establish which model version was used, which tests were performed, and whether previous risk assessments remain applicable. These challenges connect the documentation and logging requirements of Articles 11–12 with the broader risk and quality management obligations of Articles 9 and 17.
-
Monitoring deployed AI systems. Providers may have limited access to information about how their AI systems perform after deployment, particularly when the systems are operated within customers' technical environments. Customers may be unwilling to share operational data because of confidentiality, privacy, or cybersecurity concerns, while technical constraints can make collecting and storing logs difficult. Such limitations complicate post-market monitoring, the investigation of performance problems, and the identification of risks that become apparent during use [3].
-
Integrating compliance into development processes. Risk assessments, testing procedures, documentation, and corrective actions must remain coordinated as AI systems are developed, updated, and maintained. However, these activities may already be distributed across different teams and tools. For example, a model update that changes system performance may require renewed evaluation, corresponding updates to technical documentation, and a review of existing risk controls. Establishing procedures that connect these activities is therefore important for maintaining compliance as AI systems evolve.
Organizational Factors Influencing Implementation
The difficulty of implementing high-risk AI requirements also depends on an organization's existing capabilities and operating environment. Several factors can influence how much additional work is necessary to achieve compliance:
-
Industry and regulatory experience. Organizations operating in highly regulated sectors, such as medical technology, may already have established procedures for risk management, quality assurance, technical documentation, and product safety. Some of these processes can provide a foundation for implementing AI Act requirements, although existing regulatory compliance does not automatically establish conformity with the AI Act. Similarly, companies developing safety- or security-critical systems may already have extensive practices for evaluating accuracy, robustness, and cybersecurity.
-
AI maturity and technical expertise. Organizations with established AI development practices may already have data governance procedures, model evaluation frameworks, and infrastructure for monitoring deployed systems. In contrast, organizations with less experience developing and operating AI systems may need to introduce these capabilities before they can systematically evaluate performance, manage risks, or maintain the necessary documentation.
-
Company size and available resources. Implementing compliance measures requires personnel, technical infrastructure, and coordination between different responsibilities. Larger organizations may have dedicated legal, quality assurance, and compliance teams, whereas smaller companies may need to distribute these tasks among employees who also develop and maintain AI systems. However, larger companies can also face coordination difficulties when development activities are distributed across multiple departments or products [3].
How Kladero Can Help
Implementing the AI Act's requirements for high-risk AI systems requires both technical expertise and processes that support compliance throughout the AI system lifecycle. At Kladero, we help organizations address these challenges by combining AI development capabilities with expertise in AI governance and regulatory requirements.
For requirement-specific technical challenges, we support organizations in establishing data governance practices, assessing data quality and potential biases, and developing suitable methods for evaluating AI system accuracy and robustness. We also help organizations examine the capabilities and limitations of their AI systems and determine how relevant information can be communicated to users and other stakeholders. In particular, we draw on our experience developing vera[tag], our solution for identifying and labeling AI-generated content, to support the development of suitable transparency and disclosure measures.
To address cross-cutting implementation challenges, we support the integration of risk management, technical documentation, monitoring, and evaluation activities into existing development workflows. Depending on the system and its deployment environment, this can involve developing data pipelines, implementing technical infrastructure for collecting operational information, or establishing processes for documenting model changes and evaluation results.
Since compliance efforts also depend on organizational capabilities, we provide AI governance consulting and training to help organizations assess their existing practices, identify gaps, and establish appropriate responsibilities and procedures. Our approach takes into account the organization's AI maturity, regulatory environment, and available resources.
Summary
In this blog post, we examined the practical challenges of implementing the EU AI Act's requirements for high-risk AI systems. We discussed technical difficulties concerning data governance, accuracy, robustness, cybersecurity, and transparency, as well as cross-cutting challenges involving documentation, monitoring, and the integration of compliance measures into development processes. We also explored how an organization's AI maturity, regulatory experience, and available resources influence its ability to address these challenges.
As the discussion shows, understanding regulatory requirements is only the starting point. The more difficult task is often translating them into reliable technical solutions and processes that remain effective as AI systems evolve. While this can require substantial effort, existing development practices and organizational expertise can provide a useful foundation. Finally, we outlined that Kladero can support these efforts through AI development, governance consulting, and training.
Stay tuned for more posts on AI regulation, governance, and practical approaches to regulatory compliance.
Bibliography
Meet the author
You may also like
AI TransparencyDMEXCO 2026: Our Experience and Key Insights on AI Transparency
DMEXCO 2026 was an inspiring two days of ideas, conversations, and new perspectives on how AI is reshaping marketing, content creation, and commerce. In this blog post, we share some of our highlights from Cologne and the insights we took away on AI transparency, audience trust, and the future of responsible content creation.
AI TransparencyDisclosing AI-Generated Content Under the EU AI Act
In this blog post, we examine the transparency and disclosure requirements for AI-generated and AI-manipulated content under Article 50 of the EU AI Act. We discuss which types of content require disclosure, how those disclosures should be presented, and how the European Commission's Guidelines and the Code of Practice further specify these requirements. Finally, we introduce vera[tag] and Kladero's broader approach to supporting AI-content disclosure and transparency workflows.
AI TransparencyTransparency and Disclosure Concerns of AI-Generated Content
In this blog post, we briefly examine transparency and disclosure in the use of GenAI for content creation, including recreational, informational, marketing, advertising, and e-commerce purposes. We review key concerns surrounding AI-generated content, the transparency and disclosure requirements introduced by the EU AI Act and major online platforms, and the practical challenges of managing content disclosures at scale. Finally, we introduce vera[tag] and Kladero's broader approach to supporting effective AI transparency and disclosure.
