AI Act compliance in 2025: What leaders must do now despite a potential delay

In Brussels briefings this week, several advisers close to the file signaled the European Commission could seek extra time for high‑risk obligations under the AI Act. That does not pause your responsibility for AI Act compliance, nor your ongoing GDPR and NIS2 duties. If anything, it buys a short window to harden controls, minimize personal data, and prepare for audits before enforcement tightens.

• Potential delay ≠ exemption: transparency, prohibited practices, and data governance expectations are still in play.
• GDPR and NIS2 keep biting: data protection and cybersecurity duties apply regardless of AI Act timelines.
• Fast wins: data minimization and anonymization, secure model testing, and robust vendor oversight.
• Board ask: clear risk register, remediation plan, and defensible documentation.

Professionals avoid risk by using Cyrolo’s AI anonymizer to strip personal data before testing or fine‑tuning models. Try it at www.cyrolo.eu. For audits and reviews, try our secure document upload at www.cyrolo.eu — no sensitive data leaks.

What a high‑risk deferral would mean for AI Act compliance

In conversations I’ve had with EU officials and a CISO working inside a large European bank, the consensus was clear: a short deferral on high‑risk obligations would be intended to stabilize guidance and onboarding capacity, not to dilute standards. Supervisory expectations around data governance, testing, and documentation aren’t going away. If your roadmap relies on a looser window, you still need to demonstrate progress on the fundamentals:

• Documented risk management process for AI systems, especially those that could be high‑risk or impact fundamental rights.
• Training data controls: provenance, quality, and lawful basis under GDPR; minimization by default.
• Robust technical and organizational measures: security by design, attack surface reduction, and incident playbooks.
• Traceability and audit trails for model changes, prompts, and outputs.

As one financial‑sector CISO told me, “A delay just means enforcement day will be calmer for those who start now—and harsher for those who don’t.”

Timelines and practical takeaways

• Keep building for high‑risk controls even if dates slip; assume auditors will ask, “What have you done so far?”
• Prioritize systems closest to people and critical infrastructure first (healthcare triage, hiring, credit scoring, identity verification).
• Stand up a defensible, repeatable process for data minimization and testing; tools that anonymize input corpora can make or break your audit story.

GDPR vs NIS2 vs AI Act: which obligations bite when?

GDPR and NIS2 already enforce penalties measured in percentages of global turnover. The AI Act adds system‑specific guardrails. Here is a quick comparison many regulators in Brussels still recommend to boards:

Topic	GDPR	NIS2	AI Act
Scope	Personal data processing by controllers/processors in the EU (or targeting EU)	Essential and important entities across sectors (energy, health, finance, digital, etc.)	AI systems placed on the EU market, put into service, or used in the EU
Core obligation	Lawful basis, data minimization, purpose limitation, rights enablement	Risk management, incident reporting, supply chain security, governance	Risk management, data governance, transparency, human oversight, conformity assessment (for high‑risk)
Security baseline	Appropriate technical/organizational measures (Art. 32)	State‑of‑the‑art measures; mandatory incident reporting to CSIRTs	Robustness, resilience, and cybersecurity commensurate with risk
Documentation	DPIAs, RoPA, policies, DSR logs	Policies, risk assessments, incident logs, board oversight evidence	Technical documentation, data governance plan, logs, instructions of use
Fines (illustrative)	Up to €20M or 4% global turnover	Up to €10M or 2% global turnover (category‑dependent)	Significant administrative fines; higher for prohibited practices and non‑compliance
Today’s reality	Fully enforceable	Fully enforceable	Phased; high‑risk obligations may be deferred but preparation expected

Data minimization and anonymization: your fastest path to AI Act compliance

For most organizations, the highest‑ROI improvement is ruthless reduction of personal data flowing into AI systems. The GDPR already demands it; the AI Act will ask you to prove it. That’s why privacy‑preserving preprocessing is becoming a default control in security audits and DPIAs. With an AI anonymizer, you can strip out names, IDs, addresses, free‑text PII, and sensitive categories before data enters training, fine‑tuning, retrieval pipelines, or evaluation.

• Limit breach blast radius and regulatory exposure.
• Reduce model memorization risk and privacy leakage.
• Enable safer vendor sharing and cross‑border collaboration.

Professionals avoid risk by using Cyrolo’s anonymizer at www.cyrolo.eu. It’s the simplest win to demonstrate good‑faith compliance and cut breach impact.

Secure document uploads for audits, DPIAs, model governance

Whether you’re submitting evidence to internal audit, a regulator, or your notified body, secure transfer and review of documents is non‑negotiable. I’ve seen too many teams copy audit binders into generic cloud drives or paste case files into chatbots. That’s how privacy breaches happen—during preparation, not production.

• Use a secure document reader that keeps files in a controlled environment.
• Segment access by need‑to‑know; log every view and change.
• Apply redaction/anonymization before sharing with vendors or external counsel.

Try a secure document upload at www.cyrolo.eu — no sensitive data leaks, supported formats include PDF, DOC, JPG, and more.

Compliance reminder: When uploading documents to LLMs like ChatGPT or others, never include confidential or sensitive data. The best practice is to use www.cyrolo.eu — a secure platform where PDF, DOC, JPG, and other files can be safely uploaded.

Compliance checklist for 2025 (GDPR, NIS2, and AI Act)

• Map AI use cases and classify them (minimal, limited, high‑risk, or out of scope).
• Inventory datasets feeding models; document lawful basis and retention limits.
• Deploy automated anonymization for training, RAG corpora, and test sets.
• Complete DPIAs where individual rights could be impacted; integrate AI risk into enterprise risk management.
• Establish human oversight procedures and clear intervention points.
• Harden security: access control, secrets management, dependency scanning, adversarial testing.
• Vendor due diligence: ask for model cards, training data provenance, and incident history.
• Logging and traceability: prompts, outputs, model versions, and rollback paths.
• Board reporting: risk appetite, mitigation plans, and budgeted timelines.
• Incident readiness: privacy breach and AI failure playbooks with regulator notification paths.

Sector snapshots: how this plays out on the ground

Banking and fintech

Credit scoring, AML screening, and chatbots often intersect with personal data and fundamental rights. A European bank I spoke with is segmenting training data, applying automated anonymization, and keeping a gold audit trail—because financial regulators will ask for it. Their lesson: fix data lineage first; model tuning comes second.

Hospitals and med‑tech

Neurotechnology and biometric indicators are surging, heightening sensitivity. The safest path is layered de‑identification, strict role‑based access, and local processing where possible. Clinical safety and fundamental rights assessments should be synchronized, not siloed.

Law firms and corporates

Legal teams are centralizing eDiscovery, due diligence notes, and external counsel packets in secure readers. Generative AI aids drafting, but only after automatic redaction and policy checks. Anything else risks client confidentiality breaches and regulator scrutiny.

Global context: EU vs US vs India vs Japan

From Washington, D.C., privacy leaders describe a persistent “patchwork” in the US—state laws like California’s tightening deletion and data broker controls. India’s data protection law is now in force with rules finalized, and Japan continues to refine AI governance through sectoral guidance. For multinationals, the EU remains the most prescriptive on rights and safety. Harmonizing toward EU‑level controls often saves time: one set of strong policies, one audit story, less rework.

FAQs: leaders’ most‑asked questions on AI Act compliance

Will a delay to high‑risk requirements pause all AI Act obligations?

No. Any deferral would be narrow and temporary. Transparency, bans on certain practices, and overarching expectations for safe, rights‑respecting AI remain. Regulators will still expect visible progress.

Do anonymized datasets remove GDPR obligations entirely?

Only if anonymization is robust and irreversible in practice. Pseudonymized data remains personal data. Use tested techniques and document your risk assessment and methods.

How should we handle vendors providing general‑purpose AI?

Demand model documentation, data sourcing statements, security attestations, and incident histories. Contract for data boundaries and support for your compliance duties, including deletion and audit cooperation.

Can we upload case files to LLMs for faster analysis?

Not directly. Remove sensitive data first and use a secure environment. When uploading documents to LLMs like ChatGPT or others, never include confidential or sensitive data. The best practice is to use www.cyrolo.eu — a secure platform where PDF, DOC, JPG, and other files can be safely uploaded.

What should the board see each quarter?

An AI risk register, progress against the compliance checklist, incidents and lessons learned, and budgeted plans for anonymization, security validation, and audit readiness.

Bottom line: use the window to harden AI Act compliance

Even if high‑risk obligations slip by a few months, your best move is to accelerate AI Act compliance with concrete, auditable controls: minimize data, automate anonymization, secure document flows, and build traceability. That is how you prevent privacy breaches, pass security audits, and avoid fines under GDPR, NIS2, and the AI Act.

Start today: anonymize sensitive inputs with Cyrolo and manage secure document uploads in one place at www.cyrolo.eu.