This chapter gives architects a working map of the law that governs AI in Europe. It is not legal advice but a description of the obligations that shape architecture, attributed to the instruments and articles that create them. It covers the risk-based structure of Regulation (EU) 2024/1689, the AI Act, its roles, timeline, conformity assessment and standards, how it interlocks with adjacent European instruments, and who supervises it, and it ends with a codified regulatory position that Chapters 8 to 11 make executable.
Legal teams read regulation to determine liability; architects read it to determine structure: which components must exist, which records must be kept and which decisions must be reviewable. The AI Act is written in the style of European product safety law: it defines a product category, assigns obligations to economic operators by role, requires conformity assessment before market placement, and establishes market surveillance afterwards (1, European Union, 2024). That style is foreign to most software architects, so reading the Act as a product safety law is the first step to reading it well.
Article 5 prohibits a short list of practices outright, including manipulative or deceptive techniques that cause significant harm, exploitation of vulnerabilities due to age or disability, social scoring leading to detrimental treatment, certain predictive policing based solely on profiling, untargeted scraping of facial images, emotion recognition in workplaces and education except for medical or safety reasons, and most real-time remote biometric identification in public spaces for law enforcement. The intended-purpose statement of every system, and the prohibited-uses list in every agent manifest, must therefore be checked against this list at intake, and the check recorded.
Primary topics explored
- Why architects need their own map
- The risk-based structure
- Roles and why they move
- Timeline of application
- Conformity assessment and harmonised standards
- Interplay with adjacent instruments
About AI Governance
AI Governance is Book 2 of The Transformed Architecture. It shows how large European enterprises and public authorities decide what artificial intelligence is used for, classify and manage its risks, meet the obligations of the EU AI Act and its neighbours, choose and contract their suppliers, organise the forums that take decisions, and produce the evidence that shows it is all true.
It builds on the conclusions of Architecture as Code.
Chief risk and compliance officers, AI governance boards, CIOs and chief architects, and senior officials in public authorities.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 3: The EU AI Act and the European Regulatory Landscape in AI Governance gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Foundations” and is one of 32 drawn from the manuscript.