EU AI Act Basics for Non-Lawyers: Risk Tiers, Disclosures, and Proof

Need a plain-English EU AI Act guide? This post gives non-lawyers a practical path: map your AI use cases to risk tiers, add the right disclosures and controls, and keep lightweight proof. Two tracks: Manager Mode for decisions and rollout, Builder Mode for templates and fields.

Manager Mode – risk tiers, disclosures, quick wins

This section is decision-first. Use it to classify use cases, set simple rules, and plan a 30-day rollout.

Classify your use cases by risk

Start with a short list: content generation, chat support, lead scoring, HR screening, safety-critical controls. Use the matrix below to tag each one and pick actions.

Disclosures and human-in-the-loop – simple defaults

• AI disclosure: tell users when AI is used and how to reach a human.
• Opt-out: provide a clear way to bypass AI or request human handling.
• Review rules: human approval for health, legal, finance, or personal claims before publishing.
• Prompt hygiene: forbid secrets and special-category data in prompts.
• Logging: store prompt snippet, model name, timestamp, reviewer initials.

30-day rollout plan

1. Week 1 – Inventory: list use cases, assign risk tiers, create first system card.
2. Week 2 – Controls: add disclosure, opt-out, human review, prompt hygiene, and logging.
3. Week 3 – Vendors: collect DPA, sub-processors, data region, retention, security attestations.
4. Week 4 – Test & train: run red-team prompts, fix failure cases, and document changes.

Builder Mode – system cards, logs, vendor pack

This appendix gives you copy-paste templates to stay organized without heavy paperwork.

One-page AI system card

Keep it in the same workspace your team already uses. Fill it once and update when models or prompts change.

System Name: {use_case_name}
Owner: {person or team}
Purpose: {what it does and why}
Inputs: {data sources, personal data, masking strategy}
Model: {provider + version, finetunes, key settings}
Risks: {hallucination, bias, IP, privacy} - Mitigations: {how you reduce them}
Controls: {disclosure, opt-out, review rules, rate limits}
Logging: {fields kept + retention period}
Change Log:
- 2025-10-24: Switched model to vX.Y, updated blocked terms list
Links: {prompt repo, dashboards, incident doc}

Lightweight logging fields

• who: user or service account
• when: timestamp
• what: model name + version, prompt hash, policy flags tripped
• why: business context or ticket ID
• review: reviewer initials and decision for sensitive outputs
• retention: set per use case – for example 90 days

Vendor due-diligence mini-pack

Standardize what you collect so procurement and audits are fast and repeatable.

• DPA signed + sub-processor list + data region
• Security attestations – SOC 2 or ISO 27001 – and uptime SLO
• Retention and deletion SLAs – plus bring-your-own-key if required
• PII minimization features and redaction controls
• Admin audit logs, RBAC, SSO – and incident response commitments

Disclosure and opt-out templates

Website/chat disclosure:
"This experience may use AI to draft responses. A human can help at any time via support@yourdomain.com. You can opt out by typing 'human'."
Internal prompt hygiene:
"Never paste secrets or sensitive personal data. Use placeholders for real customer details."

Red-team prompts – smoke tests

• Ask for medical or legal claims without sources – expect block or human review.
• Insert sensitive personal data – expect redaction and warning.
• Try brand names or trademarks – expect caution and verification.
• Probe for jailbreaks – confirm filters catch them and log events.

FAQ – EU AI Act for SMEs

Is marketing content generation high risk?
Usually limited risk if you avoid sensitive data and high-impact decisions. Keep disclosure, opt-out, and review rules.

Do we need a DPA with every AI vendor?
Yes if personal data is processed. Keep DPA, data region, retention, and security docs on file.

What counts as meaningful human oversight?
A named reviewer with checks before publishing or acting, plus a way to override the system.

How do we prove compliance without heavy paperwork?
One-page system cards, a simple change log, and a vendor dossier stored where work happens.

Can we fine-tune on customer data?
Only with a lawful basis and contracts that allow it. Minimize, anonymize, and document.

How often should we review?
Quarterly or on major model or policy changes.

Further reading

• EU AI Act & Compliance Basics – data privacy, logging, consent, and vendor responsibilities.
• AI Data Privacy 101 – redaction, retention, and safe sharing.
• Evaluations & Guardrails – reduce hallucinations with tests and filters.

Final thoughts

Start where you are: classify your use cases, add simple disclosures and human-in-the-loop checks, and keep proof that is easy to maintain. As your footprint grows, deepen testing and governance instead of adding paperwork for its own sake.