The EU AI Act Is Here: A Practical Readiness Plan for Companies That Don't Sell in Europe

The EU AI Act Is Here: A Practical Readiness Plan for Companies That Don't Sell in Europe

When the EU's AI Act obligations began to bite, a US-based HR tech vendor with 180 employees watched their customers' procurement teams go from polite interest to forensic demand. Overnight, prospective clients in Europe started sending 40-page questionnaires about model governance, data provenance, bias testing and incident reporting. The vendor had a choice: scramble, slow every sales cycle, and hire expensive outside counsel - or respond with a pragmatic program that protected revenue without overbuilding.

They chose the latter. The result: their sales cycle didn't slow - competitors' did.

This is the reality for mid-market companies headquartered outside the EU: you may not sell directly "in Europe," but your customers, partners and regulators increasingly treat EU rules as de facto commercial standards. You don't need to become a European legal expert overnight. You do need a simple, measurable readiness plan that focuses on the parts of the law that will actually affect your buyers and your balance sheet.

Below is a practical playbook - illustrated by that HR tech vendor's story - to get AI-economy ready without overspending.

Why companies outside the EU can't ignore the EU AI Act

- Customers and procurement teams will treat EU obligations as table stakes. Large European buyers will insist on answers and proof before awarding contracts.
- Contracts and SLAs will reflect expectations created by the Act: record-keeping, incident notification, auditing rights.
- Supply-chain and partner risk: even if you don't operate in the EU, your models or data might include EU personal data or come from EU partners.
- Reputational and downstream risk: failure to provide basic transparency and governance can delay deals, increase contract leakage, or trigger costly remediation.

The HR tech vendor discovered this the hard way - but because they had prioritized a focused program, they answered the 40-page questionnaires with templates and evidence packs. Prospects were reassured; the deals closed. Competitors who had to scramble missed months of opportunity.

The four risk tiers - plain English

The EU AI Act groups AI uses into four tiers. Think of these as a triage tool for where to spend your limited time and money.

- Unacceptable risk (banned)
Systems that are broadly forbidden - social-scoring by governments, certain manipulative or subliminal techniques. If you don't build these, you don't need to sweat this bucket.

- High risk
Systems whose outputs affect fundamental rights, safety or legal outcomes - hiring & recruitment decisions, CV screening that influences employment access, credit scoring, or safety-critical controls. These attract the most obligations: documentation, testing, risk management, conformity assessment and ongoing monitoring.

- Limited risk
Systems that require specific transparency measures (for example, chatbots that are interacting with people, or emotion-recognition in consumer settings). You must tell users they are interacting with AI and provide basic info.

- Minimal / negligible risk
Everyday tools and novelty features (basic recommender systems, dev tools) - permitted with minimal obligations.

For our HR vendor, recruitment screening modules and automated interview scoring were the critical "high-risk" features. Performance dashboards and admin UX widgets were largely minimal risk. That clarity guided where they invested.

What actually bites for high-risk systems

If any of your products are high-risk, expect these core obligations to matter to customers and auditors:

- Risk management system - a living program documenting identification, mitigation and acceptance of risks. Not a 100-page binder, but an owned process tied to product development and QA.
- Technical documentation - the "how it works" package for regulators and customers: purpose, architecture, datasets, testing outcomes, performance metrics and limitations.
- Data governance and provenance - evidence of dataset sources, labeling processes, sampling strategy, and steps to manage bias.
- Human oversight and usage constraints - how the system is to be supervised, fallback processes, and a description of allowed and disallowed uses.
- Robustness and accuracy testing - statistical performance, fairness tests, and stress tests.
- Post-market monitoring & incident reporting - a loop for collecting real-world performance data and notifying downstream deployers of serious incidents.
- Conformity assessment - internal or third-party review that the system meets requirements; for certain high-risk systems third-party assessment is likely.
- Record-keeping and traceability - logs and datasets to enable reconstruction and audits.
- Transparency notices - externally published descriptions for users and buyers about the use, limitations and provenance of AI.

These are not "only legal" items - they are what procurement teams will ask for before they sign. The HR tech vendor focused on producing model cards, dataset lineage, and a single AI inventory to answer these questions quickly.

Providers vs. deployers - who does what

A common source of confusion: obligations fall differently on "providers" and "deployers."

- Provider - the organization that develops or makes an AI system available. Providers are primarily responsible for the technical documentation, conformity assessments, data governance and preparing evidence packs (model cards, test outcomes, risk-management artifacts).
- Deployer - the organization that uses an AI system in a real-world context. Deployers have obligations around safe use, supervision, and ensuring the system is used within prescribed limits; they must also report serious incidents and implement necessary mitigations.

In commercial contracts, buyers (deployers) will expect providers to supply the documentation and evidence they need to discharge their own obligations. The HR vendor acted as a provider and made it simple for deployers to satisfy their side - that's what made the difference in the sales cycle.

The practical 90-day readiness sprint (for mid-market companies)

You can get commercially defensible readiness in 90 days without a huge program. Break the sprint into three 30-day phases. Keep the focus on the minimum viable artifacts that stop sales from stalling: an AI inventory, risk tiers, model cards for high-risk systems, data lineage summaries, a lightweight conformity assessment, and a customer-facing transparency notice.

Phase 0 - setup (days 0-3)
- Appoint an AI Act lead (cross-functional: Product + Legal/GC + Security/Privacy + Sales).
- Set clear goals: "Reduce EU procurement friction for high-risk product lines" with measurable outcomes (e.g., respond to procurement questionnaires within 7 days).

Phase 1 - Inventory & Triage (days 1-30)
Deliverables: single AI inventory mapped to risk tiers; prioritized list of high-risk systems.
Activities:
- Create a one-page inventory template and scan products for AI functionality (models, automation, decision-making).
- Map each item to the four risk tiers - use product owners, legal counsel and customer success input.
- Flag dependencies: third-party models, EU data, hosting locations.
Tip: keep it lightweight - a spreadsheet or simple registry is fine. The goal is clarity, not perfection.

Phase 2 - Evidence & Conformity (days 31-60)
Deliverables: model cards for each high-risk system; data lineage snapshots; risk-management brief; lightweight conformity checklist.
Activities:
- Produce model cards: intended use, training data summary, performance metrics, fairness tests, limitations, expected user groups, mitigation steps.
- Document data lineage: sources, transformations, retention policies and access controls. If you can't fully trace historic datasets, document remediation steps and controls going forward.
- Run a lightweight conformity assessment: map product controls to high-risk obligations, document gaps, and create an action plan. For many mid-market vendors an internal assessment plus an independent review of one or two critical controls is sufficient - expensive full third-party audits can be staged later.
- Build a post-market monitoring plan and incident reporting template.
Tip: reuse privacy and security artifacts (DPIAs, data inventories) where possible. You're not inventing processes from scratch.

Phase 3 - Operationalize & Communicate (days 61-90)
Deliverables: published transparency notice; sales enablement pack (answers to common questionnaires, templates); operational playbooks for incident reporting and human oversight.
Activities:
- Publish a transparency notice on your website describing AI use cases and user rights in plain language. This is often the first thing procurement teams ask for.
- Create a customer evidence pack with the model cards, conformity checklist, and data lineage snapshots that you can send to prospects.
- Train sales and customer success on how to answer questionnaires and where to find artifacts.
- Implement basic monitoring: simple dashboards, logging of model outputs for a sample of transactions, customer feedback channels.
Tip: create a reusable Q&A library to answer the recurring questions in those 40-page procurement forms.

How the HR vendor did it - a short case study

- Inventory completed in 10 days. They discovered two modules likely to be considered high-risk: CV ranking and automated interview scoring.
- They created concise model cards for the two modules (3 pages each) that included fairness tests, performance by demographic slice, and limitations.
- Data lineage for hiring models: summarized sources (applicant uploads, resume parsers, synthetic augmentation), labeling practices and retention.
- Lightweight conformity checklist mapped to obligations; they fixed three gaps in human oversight and added a monitoring log that captured flagged decisions.
- A two-page transparency notice was published and linked in the product and sales materials.
Outcome: when procurement teams sent 40-page questionnaires, the vendor responded with a tailored evidence pack. Deals proceeded without the heavy delays that competitors experienced.

How to avoid overspending

- Prioritize high-risk items. Not all AI features require the same investment.
- Reuse controls from privacy, security and quality programs - don't reinvent the wheel.
- Use modular documentation: model cards + data lineage + conformity checklist = most buyers' needs.
- Automate registry and evidence collection: lightweight tools and scripts to extract model metadata and logging will save time.
- Stage third-party audits: start with an internal assessment and add external conformity assessment when revenue justifies it.

Frameworks to borrow from

- Use the NIST AI Risk Management Framework (AI RMF) practices for aligning technical controls to risk.
- Consider ISO/IEC 42001 as a reference for establishing an AI management system if you're scaling across multiple products.
- Map your artifacts to the EU Act's risk buckets when answering buyer questionnaires - customers understand that structure.

Conclusion - one concrete move to make today

Assign a single AI Act lead and start a 90-day readiness sprint: build a one-page AI inventory, classify risk, and produce model cards plus a transparency notice for the systems customers will actually ask about. Do that and you'll turn the EU Act from a sales blocker into a competitive advantage - like the HR vendor that kept its pipeline moving while competitors slowed down chasing paperwork.

The EU AI Act raises the bar - but a focused, risk-based response protects revenue, reduces procurement friction, and prepares you for the broader AI economy. Make the work visible, practical, and repeatable: that's the essence of AI economy readiness.