What the EU AI Act actually does
The Act sorts AI by risk and attaches obligations accordingly. It also adds a separate set of rules for general-purpose AI (GPAI) models. The duties phase in over time, running through 2025 to 2027, and the penalties for the most serious breaches are significant, reaching into the millions of euros or a percentage of global turnover.
| Risk tier | What it means |
|---|---|
| Unacceptable | Practices banned outright, such as social scoring and certain manipulative or biometric uses. |
| High | Permitted with strict duties: risk management, data governance, human oversight, logging, technical documentation, and post-market monitoring. |
| Limited | Transparency obligations, for example telling people they are interacting with an AI system. |
| Minimal or none | No specific obligations, though voluntary codes of practice are encouraged. |
| GPAI | Separate rules for general-purpose AI models, with extra duties for models judged to carry systemic risk. |
Most of the hard work for an in-scope deployment sits in the high-risk obligations: keeping a current risk assessment, governing the data, ensuring human oversight, retaining logs, maintaining technical documentation, and monitoring the system after it goes live. Those duties need continuous, current evidence, not a one-time document.
Where Senserva fits
The EU AI Act is broader than any single tool. It is a legal and organizational program. Senserva covers the Microsoft technical layer of that program: it shows what AI you actually run in Microsoft 365, Intune, Defender, and Entra ID, how it is permissioned, and whether the controls around it are working. That is the operational evidence an assessor or regulator asks to see.
Mapping EU AI Act themes to Senserva evidence
Senserva does not make you compliant on its own. It supplies the Microsoft-side evidence for the high-risk obligations that are hardest to keep current.
| EU AI Act theme | Senserva evidence |
|---|---|
| Risk management | Ranked findings across the Microsoft AI surface, prioritized by real-world risk, give a repeatable input to your risk process. |
| Data governance | Identity, SharePoint and OneDrive sharing, and Purview label and DLP posture surface where AI could reach data it should not. |
| Human oversight | Senserva tracks human-in-the-loop and approval-gate controls, and its own remediation is approve-before-apply by design. |
| Logging and record-keeping | Audit-log and sign-in health checks confirm the logs you need are being kept and are reviewable. |
| Technical documentation | Audit-ready reports document the configuration of your Microsoft AI and agents at a point in time. |
| Post-market monitoring | Scheduled re-scans show change over time, with a clear before and after when a finding is fixed. |
For the detail on exactly what the scanner inspects on the Microsoft AI surface, see Microsoft AI security.
The standards route is the practical route
Demonstrating conformity is far easier when you run a recognized AI management system. ISO/IEC 42001 is the harmonized standard most organizations lean on, and the evidence Senserva produces maps cleanly onto it. Start with an inventory and a scan, then build the program around what you find.