What is the primary objective of EU AI Act?

The primary objective of the EU AI Act is to establish a risk-based regulatory framework that prohibits unacceptable AI practices, imposes strict obligations on high-risk AI systems, mandates transparency for limited-risk systems, and fosters trustworthy AI while protecting health, safety, and fundamental rights. Regulation (EU) 2024/1689, effective 1 August 2024, classifies AI into unacceptable, high, limited, and minimal risk tiers per Articles 5–6 and Annexes I–III.

Who is legally or professionally required to comply with EU AI Act?

Providers, deployers, importers, distributors, and authorized representatives of AI systems whose outputs are used in the EU must comply with the EU AI Act, regardless of location. Providers develop or place high-risk systems on the market (Article 3(3)); deployers are professional users (Article 3(4)). Scope captures third-country entities via EU output nexus (Article 2).

Does EU AI Act require an external audit or third-party certification?

High-risk AI systems require conformity assessment, which may involve third-party notified bodies for certain Annex III uses or where internal assessment is insufficient, but not all systems mandate external audits. Article 43 allows internal (Annex VI) or third-party (Annex VII) procedures; CE marking (Article 48) and EU database registration (Article 49) follow successful assessment.

How often should an assessment for EU AI Act be performed?

Conformity assessments for high-risk AI must be performed before placing on the market or into service, with continuous post-market monitoring and reassessment upon substantial modifications. Article 72 mandates ongoing monitoring; logs retained at least 6 months (Article 19); phased applicability from 2 February 2025 for prohibitions.

What are the consequences of non-compliance with EU AI Act?

Non-compliance with the EU AI Act incurs tiered administrative fines up to 7% of worldwide annual turnover or €35 million for prohibited practices, 3% or €15 million for high-risk obligations, and 1.5% or €7.5 million for supplying incorrect information. Enforcement by national authorities and AI Office (Articles 70, 101); includes market withdrawal and personal liability.

Can EU AI Act be mapped to other international frameworks?

Yes, EU AI Act obligations such as risk management (Article 9), data governance (Article 10), and cybersecurity (Article 15) can be mapped to other frameworks through harmonized standards (Article 40), enabling presumption of conformity. It aligns with existing EU product safety and cybersecurity regimes in Annex I, though sector-specific analysis is required.

What is the first step to begin implementing EU AI Act?

The first step to implement the EU AI Act is to conduct an AI inventory and classify all systems by risk tier against Article 5 prohibitions, Article 6, Annexes I and III. Document non-high-risk rationales; prioritize high-risk systems for conformity preparation per phased timelines (e.g., GPAI from August 2025).

What is the primary objective of MLPS 2.0 (Multi-Level Protection Scheme)?

The primary objective of MLPS 2.0 is to establish a graded cybersecurity protection system ensuring security controls match the potential harm from system compromise to national security, social order, and public interests. It classifies information systems into five levels (1-5) based on impact severity, mandating commensurate technical, management, physical, and personnel controls per GB/T 22239-2019 and related standards. This integrates cybersecurity into national security via the 2016 Cybersecurity Law Article 21, covering traditional IT, cloud, IoT, big data, and industrial systems.

Who is legally or professionally required to comply with MLPS 2.0 (Multi-Level Protection Scheme)?

All network operators in mainland China must comply with MLPS 2.0, including domestic enterprises, foreign-invested entities, and multinationals operating systems there. This encompasses providers of internet platforms, critical infrastructure (energy, finance, telecom), cloud services, IoT, and industrial networks. Virtually no exemptions exist; systems at Level 2+ require PSB filing and approval, enforced by Ministry of Public Security and local PSBs.

Does MLPS 2.0 (Multi-Level Protection Scheme) require an external audit or third-party certification?

Yes, MLPS 2.0 mandates external security reviews by licensed Chinese firms for Level 2 and above systems, with PSB approval required. Reviews score compliance (minimum 75/100) across technical, management, and physical domains per GB/T 28448-2019. Level 3+ needs annual evaluations; certification links to business licenses, with PSB oversight including inspections.

How often should an assessment for MLPS 2.0 (Multi-Level Protection Scheme) be performed?

Assessments under MLPS 2.0 must occur periodically by level: biennially for Level 2, annually for Level 3, semi-annually for Level 4, and as mandated for Level 5. Re-evaluations are also triggered by major changes (e.g., architecture shifts). Level 1 requires self-assessments; higher levels demand third-party audits and PSB verification, plus ongoing self-inspections.

What are the consequences of non-compliance with MLPS 2.0 (Multi-Level Protection Scheme)?

Non-compliance with MLPS 2.0 results in fines up to 100,000 yuan, operational suspensions, system shutdowns, and intensified PSB inspections. Enforcement since 2019 ties certification to license renewals; severe cases involve business blacklisting or criminal liability. Examples include RMB 50,000 fines post-hacks and RMB 223 million for banks failing data controls.

Can MLPS 2.0 (Multi-Level Protection Scheme) be mapped to other international frameworks?

Yes, MLPS 2.0 control domains align with international frameworks like ISO 27001 and NIST CSF. Organizational, physical, and technical controls map to ISO Annex A categories; risk treatment plans support MLPS gap analyses. However, MLPS adds prescriptive grading, PSB enforcement, and data localization absent in voluntary standards.

What is the first step to begin implementing MLPS 2.0 (Multi-Level Protection Scheme)?

The first step is conducting a provisional self-assessment to classify systems into MLPS levels based on impact to national security, social order, and public interests. Inventory assets, evaluate harm severity per GB/T 22240-2020, document rationale, then file with local PSB (within 30 days for Level 2+). Engage cross-functional teams for accuracy.

Standards Comparison

EU AI Act vs MLPS 2.0 (Multi-Level Protection Scheme)

EU AI Act

Mandatory

2024

EU regulation for risk-based AI safety and governance

MLPS 2.0 (Multi-Level Protection Scheme)

Mandatory

N/A

China's mandatory graded cybersecurity protection scheme

Quick Verdict

EU AI Act regulates AI risks EU-wide with conformity and fines; MLPS 2.0 mandates network protection in China via levels and PSB enforcement. Companies adopt AI Act for EU market access, MLPS for Chinese operations compliance.

Artificial Intelligence

EU AI Act

Regulation (EU) 2024/1689 on Artificial Intelligence

Cost

€€€

Complexity

Medium

Implementation Time

18-24 months

Key Features

Risk-based tiered classification of AI systems
Prohibits unacceptable-risk AI practices outright
Conformity assessment and CE marking for high-risk AI
GPAI model documentation and systemic risk obligations
Extraterritorial scope via EU output nexus

Standard

MLPS 2.0 (Multi-Level Protection Scheme)

Multi-Level Protection Scheme 2.0

Cost

€€€€

Complexity

Medium

Implementation Time

12-18 months

Key Features

Five impact-based protection levels (1-5)
Mandatory for all China network operators
PSB enforcement with audits/inspections
Technical controls for cloud/IoT/big data
Governance/personnel segregation requirements

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

EU AI Act Details

What It Is

Regulation (EU) 2024/1689, the EU AI Act is a comprehensive, horizontal regulation establishing a risk-based framework for AI systems. It prohibits unacceptable-risk practices, regulates high-risk systems via lifecycle controls, mandates transparency for limited-risk AI, and imposes obligations on general-purpose AI models, applicable across sectors with extraterritorial reach.

Key Components

Four-tier risk classification: unacceptable, high, limited, minimal.
High-risk requirements: risk management (Article 9), data governance (Article 10), documentation, human oversight, cybersecurity (Article 15), conformity assessment, CE marking.
GPAI duties: technical documentation, systemic risk evaluations.
Enforcement via AI Office, national authorities, fines up to 7% global turnover.

Why Organizations Use It

Mandated for EU market access, it mitigates legal risks, ensures compliance, enhances trust, and provides competitive edge through certified safety in high-stakes sectors like healthcare, finance, employment.

Implementation Overview

Phased rollout (6-36 months); involves AI inventory, classification, QMS development, conformity assessments, post-market monitoring. Targets providers/deployers EU-wide; requires cross-functional governance, documentation, audits.

MLPS 2.0 (Multi-Level Protection Scheme) Details

What It Is

MLPS 2.0 (Multi-Level Protection Scheme 2.0) is China's legally enforceable regulatory framework for hierarchical protection of information systems. Mandated by the 2016 Cybersecurity Law (Article 21), it classifies networks into five levels based on compromise impact to national security, social order, and public interests, requiring commensurate technical, governance, and organizational controls.

Key Components

Common controls in physical security, networks, data protection, operations
Extended requirements for cloud, IoT, big data, industrial systems
~100+ detailed controls per level via GB/T standards (e.g., GB/T 22239-2019)
**Compliance modelself-classification, third-party audits (Level 2+), PSB filing/approval

Why Organizations Use It

Mandatory for all China network operators, avoiding fines/suspensions
Enhances resilience, aligns with ISO 27001/NIST
Enables market access, procurement in finance/energy/telecom
Builds regulator trust, reduces enforcement risks

Implementation Overview

Phased: inventory/classify, gap analysis, remediate, audit, monitor
Targets enterprises in China; complex for multinationals
Requires local PSB engagement, annual re-evals (Level 3+)

Key Differences

Aspect	EU AI Act	MLPS 2.0 (Multi-Level Protection Scheme)
Scope	AI systems by risk levels (prohibited to minimal)	All networks by cybersecurity impact levels
Industry	All sectors, EU/global via output nexus	All network operators in China
Nature	Mandatory EU regulation with fines	Mandatory Chinese law enforced by PSBs
Testing	Conformity assessments, notified bodies	Third-party audits, PSB approvals
Penalties	Up to 7% global turnover fines	Fines, operations suspension, inspections

Scope

EU AI Act

AI systems by risk levels (prohibited to minimal)

MLPS 2.0 (Multi-Level Protection Scheme)

All networks by cybersecurity impact levels

Industry

EU AI Act

All sectors, EU/global via output nexus

MLPS 2.0 (Multi-Level Protection Scheme)

All network operators in China

Nature

EU AI Act

Mandatory EU regulation with fines

MLPS 2.0 (Multi-Level Protection Scheme)

Mandatory Chinese law enforced by PSBs

Testing

EU AI Act

Conformity assessments, notified bodies

MLPS 2.0 (Multi-Level Protection Scheme)

Third-party audits, PSB approvals

Penalties

EU AI Act

Up to 7% global turnover fines

MLPS 2.0 (Multi-Level Protection Scheme)

Fines, operations suspension, inspections

Frequently Asked Questions

Common questions about EU AI Act and MLPS 2.0 (Multi-Level Protection Scheme)

EU AI Act FAQ

MLPS 2.0 (Multi-Level Protection Scheme) FAQ

You Might also be Interested in These Articles...

Top 5 Reasons Automation Tools Like Vanta Slash SOC 2 Type 2 Timelines from Months to Weeks

Automation tools like Vanta cut SOC 2 Type 2 prep from 6 months to 6 weeks, saving 70% costs. See SignWell examples, AWS/Okta/GitHub integrations. CISOs: Get fi

From Hygiene to Governance: How to Scale Cyber Essentials into a Full ISO 27001 ISMS in 2026

Discover how to scale Cyber Essentials into a full ISO 27001 ISMS in 2026. Reuse evidence, map controls, meet DORA & NIS2 rules and win enterprise contracts.

The CIS Controls v8.1 Evidence Pack: What Auditors Ask For (and How to Produce Proof Fast)

Fail CIS Controls v8.1 audits due to missing evidence? Get the blueprint: exact artifacts auditors want, repository structure, and automation from security tool

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how EU AI Act and MLPS 2.0 (Multi-Level Protection Scheme) compare against other standards

Other EU AI Act Comparisons

Other MLPS 2.0 (Multi-Level Protection Scheme) Comparisons

What It Is

Key Components

Four-tier risk classification: unacceptable, high, limited, minimal.

High-risk requirements: risk management (Article 9), data governance (Article 10), documentation, human oversight, cybersecurity (Article 15), conformity assessment, CE marking.

GPAI duties: technical documentation, systemic risk evaluations.

Enforcement via AI Office, national authorities, fines up to 7% global turnover.

What It Is

Key Components

Common controls in physical security, networks, data protection, operations

Extended requirements for cloud, IoT, big data, industrial systems

~100+ detailed controls per level via GB/T standards (e.g., GB/T 22239-2019)

**Compliance modelself-classification, third-party audits (Level 2+), PSB filing/approval

Aspect

EU AI Act

MLPS 2.0 (Multi-Level Protection Scheme)

Scope

AI systems by risk levels (prohibited to minimal)

All networks by cybersecurity impact levels

Industry

All sectors, EU/global via output nexus

All network operators in China

Nature

Mandatory EU regulation with fines

Mandatory Chinese law enforced by PSBs

Testing

Conformity assessments, notified bodies

Third-party audits, PSB approvals

Penalties

Up to 7% global turnover fines

Fines, operations suspension, inspections