EU AI Act Compliance for AI Built on Your ERP

No. Most AI-on-ERP assistants, drafting help, exception triage, natural-language reporting, are limited-risk or minimal-risk because they inform a human decision rather than making one autonomously in a listed high-risk category. The classification changes if the system is extended into areas like automated employment decisions or safety-critical sign-off without human review, which is why each use case needs its own classification rather than a blanket assumption.

The main obligation is transparency: the person interacting with the system needs to know they are dealing with AI, and AI-generated content should be identifiable as such. This is a straightforward design requirement, labeling drafts clearly and not presenting AI output as if a person wrote it, rather than a heavy documentation or conformity assessment burden.

The Act entered into force in August 2024. Prohibited-practice rules and AI literacy obligations applied first, general-purpose AI model obligations followed from mid-2025, and most high-risk system obligations apply from August 2026, with some sector-specific extensions running to 2027. The exact date that matters for a given project depends on which category its use case falls into, so it is worth confirming against the current text rather than treating one date as universal.

It changes who holds which obligations. When you self-host, you control and can document the model version, training data provenance to the extent the provider discloses it, and deployment configuration directly, which makes it easier to produce the documentation the Act expects. Using a provider's API shifts some documentation obligations to that provider, but you still need to understand and be able to describe what you are using.

They overlap significantly but are not the same assessment: GDPR asks whether processing personal data is lawful and proportionate (via a DPIA where required), while the AI Act asks about the risk the AI system itself poses and what obligations attach to that risk level. Running both assessments together on the same use case, rather than as separate workstreams, produces a more consistent and defensible conclusion.

The Act requires organizations deploying AI systems to ensure staff who operate or are affected by them have a sufficient level of understanding of how the system works and its limitations. In practice, this means real, use-case-specific training, what the assistant can and cannot be trusted to do, not a generic slide deck about artificial intelligence in general.

Yes, in principle. A drafting assistant that starts as limited-risk can drift toward higher-risk territory if a later feature gives it more autonomous decision authority, for example letting it approve a transaction without review. Building a periodic review of existing use cases into the governance process catches this kind of scope creep before it becomes a compliance gap discovered during an audit.