What is the primary objective of EU AI Act?

The primary objective of the EU AI Act is to establish a risk-based regulatory framework that prohibits unacceptable-risk AI practices, imposes strict obligations on high-risk AI systems, mandates transparency for limited-risk systems, and leaves minimal-risk systems largely unregulated. Regulation (EU) 2024/1689, which entered into force on 1 August 2024, ensures safety, fundamental rights protection, and innovation through lifecycle controls like risk management (Article 9), data governance (Article 10), and conformity assessments (Article 43).

Who is legally or professionally required to comply with EU AI Act?

Providers, deployers, importers, distributors, and authorized representatives of AI systems whose outputs are used in the EU must comply with the EU AI Act. Providers develop or place high-risk systems on the market (Article 3(3)); deployers are professional users (Article 3(4)). Scope includes third-country entities via extraterritorial reach (Article 2), covering high-risk uses in Annex III (e.g., biometrics, employment) and GPAI models (Chapter V).

Does EU AI Act require an external audit or third-party certification?

High-risk AI systems require conformity assessment, which may involve third-party notified bodies and external audits depending on classification. Internal assessments suffice for some (Annex VI), but Annex III systems or those without harmonized standards (Article 40) need notified body evaluation (Annex VII, Articles 28–39), EU Declaration of Conformity (Article 47), CE marking (Article 48), and EU database registration (Article 49).

How often should an assessment for EU AI Act be performed?

Assessments for EU AI Act compliance must be performed before placing high-risk systems on the market or into service, with continuous post-market monitoring. Risk management is lifecycle-continuous (Article 9); substantial modifications trigger reassessment (Article 3(23)). Logs retained at least 6 months (Article 19); serious incidents reported without undue delay (Article 73).

What are the consequences of non-compliance with EU AI Act?

Non-compliance with the EU AI Act incurs tiered administrative fines up to 7% of worldwide annual turnover or €35 million for prohibited practices, 3% or €15 million for high-risk failures, and 1% or €7.5 million for supplying incorrect information. Enforcement by national authorities (Article 70) and AI Office (Article 64) includes market withdrawal, bans, and personal liability (Chapter XII).

Can EU AI Act be mapped to other international frameworks?

No, EU AI Act FAQs must stand alone without referencing mappings to other frameworks.

What is the first step to begin implementing EU AI Act?

The first step to implement the EU AI Act is to conduct an AI inventory and classify all systems by risk tier. Map assets to prohibited practices (Article 5), high-risk Annex I/III (Article 6), GPAI (Chapter V), or transparency obligations (Article 50), documenting decisions for authority review.

What is the primary objective of AS9110C?

AS9110C's primary objective is to enable aviation maintenance organizations to consistently provide products and services meeting customer and applicable statutory/regulatory requirements while enhancing customer satisfaction through effective QMS application and continual improvement. It incorporates ISO 9001:2015's Annex SL structure (Clauses 4–10) with aviation-specific additions like configuration management, product safety, counterfeit parts prevention, traceability, preservation, and human factors controls, ensuring continuing airworthiness in MRO environments.

Who is legally or professionally required to comply with AS9110C?

AS9110C applies to aviation maintenance organizations, including repair stations, MRO providers, and OEMs with autonomous MRO operations, regardless of size. It targets entities performing maintenance, repair, overhaul, or continuing airworthiness management on civil/military aircraft/components, where certification is often mandated by customers, OEMs, or regulators for OASIS listing and contract eligibility; regulatory requirements (e.g., FAA/EASA Part 145) take precedence.

Does AS9110C require an external audit or third-party certification?

Yes, AS9110C requires third-party certification through accredited bodies, involving Stage 1 (documentation review) and Stage 2 (on-site implementation audit). The QMS must be fully operational for at least three months, with a full internal audit cycle and management review completed prior; certification lists organizations in the IAQG OASIS database, with surveillance audits annually and recertification every three years.

How often should an assessment for AS9110C be performed?

AS9110C requires internal audits at planned intervals based on process risk, status, and results, with at least one full cycle before certification. Management reviews occur regularly (e.g., annually or tied to business cycles), evaluating performance data, audits, risks, and improvements; external surveillance audits are annual, with full recertification every three years.

What are the consequences of non-compliance with AS9110C?

Non-compliance with AS9110C risks loss of certification, exclusion from OEM contracts, OASIS delisting, and regulatory sanctions like operating certificate suspension. It can lead to safety incidents from poor configuration/traceability, rework costs, AOG events, litigation, fines (e.g., up to $100k/day under FAA Part 145), and reputational damage in the aviation supply chain.

Can AS9110C be mapped to other international frameworks?

Yes, AS9110C's Annex SL structure enables direct mapping to ISO 9001:2015 as its baseline, with correlation matrices for regulatory alignments like FAA/EASA Part 145. It supports integrated management systems by sharing high-level clauses (context, leadership, planning), though aviation-specific controls (e.g., counterfeit prevention) require tailored application.

What is the first step to begin implementing AS9110C?

The first step is to define QMS scope, perform a gap analysis against Clauses 4–10, and map to regulatory/customer requirements. Secure executive sponsorship, identify internal/external issues and interested parties, and produce a prioritized remediation plan using tools like risk worksheets and process identification matrices.

Standards Comparison

EU AI Act vs AS9110C

EU AI Act

Mandatory

2024

EU regulation for risk-based AI system governance

AS9110C

Mandatory

2016

Aerospace QMS standard for aviation maintenance organizations

Quick Verdict

EU AI Act mandates risk-based compliance for AI systems across EU sectors to ensure safety and rights, while AS9110C is a voluntary QMS certification for aviation MROs emphasizing traceability and airworthiness. Organizations adopt AI Act for legal compliance, AS9110C for market access.

Artificial Intelligence

EU AI Act

Regulation (EU) 2024/1689 on Artificial Intelligence

Cost

€€€

Complexity

Medium

Implementation Time

18-24 months

Key Features

Risk-based classification into four AI tiers
Prohibits unacceptable-risk AI practices outright
Conformity assessments and CE marking for high-risk
GPAI model obligations with systemic risk rules
Extraterritorial scope for non-EU providers

Quality Management

AS9110C

AS9110C Quality Management Systems for Aviation Maintenance

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based thinking in strategic and operational planning
Configuration management and traceability controls
Counterfeit and suspect parts prevention
Human factors in root cause analysis
Continuing airworthiness and release requirements

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

EU AI Act Details

What It Is

Regulation (EU) 2024/1689, the EU AI Act is a comprehensive horizontal regulation establishing a risk-based framework for AI systems. It prohibits unacceptable-risk practices, imposes strict obligations on high-risk AI, transparency for limited-risk, and minimal rules for others, applicable across sectors with extraterritorial reach.

Key Components

Four risk tiers: prohibited, high-risk (Annex I/III), limited-risk, minimal-risk.
High-risk requirements: risk management (Article 9), data governance (Article 10), documentation (Articles 11-13), human oversight (Article 14), cybersecurity (Article 15).
GPAI rules (Chapter V), conformity assessments, CE marking, EU database registration.
Phased enforcement via AI Office, national authorities, fines up to 7% global turnover.

Why Organizations Use It

Mandatory for EU market access; mitigates legal risks, fines, bans. Builds trust, enables procurement, improves AI quality via lifecycle governance. Competitive edge in regulated sectors like HR, biometrics, infrastructure.

Implementation Overview

Phased rollout (6-36 months); inventory/classify AI, build QMS, conduct assessments. Cross-functional: legal, engineering, risk teams. High-risk needs notified bodies; ongoing monitoring. Targets providers/deployers globally.

AS9110C Details

What It Is

AS9110C (AS9110:2016 Rev C) is an international quality management system (QMS) certification standard for aviation maintenance organizations, such as repair stations and MRO providers. It builds on ISO 9001:2015's Annex SL structure, incorporating risk-based thinking, PDCA cycles, and aviation-specific requirements for continuing airworthiness and safety.

Key Components

Core clauses 4–10 covering context, leadership, planning, support, operation, evaluation, and improvement.
Aviation additions: configuration management, counterfeit parts prevention, human factors, traceability, preservation, and external provider controls.
No fixed number of controls; emphasizes documented information, competence, and operational risk management.
Certification via accredited bodies with Stage 1/2 audits and 3-year cycles.

Why Organizations Use It

Meets customer/OEM contracts and regulatory alignments (e.g., FAA/EASA Part 145).
Mitigates safety risks, ensures traceability, and boosts on-time delivery.
Enhances market access via IAQG OASIS listing and competitive differentiation.
Builds stakeholder trust through auditable evidence of airworthiness.

Implementation Overview

Phased approach: gap analysis, process design, training, internal audits, certification.
Applies to MROs of all sizes globally; requires 6–12 months typically.
Involves leadership commitment, risk registers, and operational pilots before audits. (178 words)

Key Differences

Aspect	EU AI Act	AS9110C
Scope	Risk-based AI systems lifecycle governance	Aviation MRO quality management processes
Industry	All sectors using AI in EU	Aerospace maintenance organizations globally
Nature	Mandatory EU regulation with fines	Voluntary QMS certification standard
Testing	Conformity assessments, notified bodies	Internal audits, certification body audits
Penalties	Up to 7% global turnover fines	Loss of certification, market exclusion

Scope

EU AI Act

Risk-based AI systems lifecycle governance

AS9110C

Aviation MRO quality management processes

Industry

EU AI Act

All sectors using AI in EU

AS9110C

Aerospace maintenance organizations globally

Nature

EU AI Act

Mandatory EU regulation with fines

AS9110C

Voluntary QMS certification standard

Testing

EU AI Act

Conformity assessments, notified bodies

AS9110C

Internal audits, certification body audits

Penalties

EU AI Act

Up to 7% global turnover fines

AS9110C

Loss of certification, market exclusion

Frequently Asked Questions

Common questions about EU AI Act and AS9110C

EU AI Act FAQ

AS9110C FAQ

You Might also be Interested in These Articles...

Measuring CIS Controls v8.1 in the Real World: KPIs, Dashboards, and Automated Evidence for Continuous Assurance

Master CIS Controls v8.1 measurement with essential KPIs, executive-ready dashboards, and automated evidence collection for continuous assurance. Make complianc

SEC Cybersecurity Rules Implementation Guide: Mastering Form 8-K Item 1.05 Materiality Determination and 4-Business-Day Reporting Workflow

Master SEC Form 8-K Item 1.05 compliance with step-by-step materiality assessment, incident workflows & Inline XBRL tagging. Beat the 4-business-day clock. Esse

SOC 2 for Bootstrapped SaaS: Lazy Founder's Automation Roadmap with Vanta/Drata Templates

Bootstrapped SaaS founders: Achieve SOC 2 Type 2 in 3 months with Vanta automation (cuts 70% manual work). Free templates, workflows, screenshots, metrics & Sig

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how EU AI Act and AS9110C compare against other standards

Other EU AI Act Comparisons

Other AS9110C Comparisons

What It Is

Key Components

Four risk tiers: prohibited, high-risk (Annex I/III), limited-risk, minimal-risk.

High-risk requirements: risk management (Article 9), data governance (Article 10), documentation (Articles 11-13), human oversight (Article 14), cybersecurity (Article 15).

GPAI rules (Chapter V), conformity assessments, CE marking, EU database registration.

Phased enforcement via AI Office, national authorities, fines up to 7% global turnover.

What It Is

Key Components

Core clauses 4–10 covering context, leadership, planning, support, operation, evaluation, and improvement.

Aviation additions: configuration management, counterfeit parts prevention, human factors, traceability, preservation, and external provider controls.

No fixed number of controls; emphasizes documented information, competence, and operational risk management.

Certification via accredited bodies with Stage 1/2 audits and 3-year cycles.

Why Organizations Use It

Meets customer/OEM contracts and regulatory alignments (e.g., FAA/EASA Part 145).

Mitigates safety risks, ensures traceability, and boosts on-time delivery.

Enhances market access via IAQG OASIS listing and competitive differentiation.

Builds stakeholder trust through auditable evidence of airworthiness.

Aspect

EU AI Act

AS9110C

Scope

Risk-based AI systems lifecycle governance

Aviation MRO quality management processes

Industry

All sectors using AI in EU

Aerospace maintenance organizations globally

Nature

Mandatory EU regulation with fines

Voluntary QMS certification standard

Testing

Conformity assessments, notified bodies

Internal audits, certification body audits

Penalties

Up to 7% global turnover fines

Loss of certification, market exclusion