The AI Compliance Staircase: Which AI obligations apply from analytics to autonomous decisions?

Which model is the AI Compliance Staircase based on?

The staircase builds on Gartner's Analytic Ascendancy Model (2012) with four analytics stages: Descriptive, Diagnostic, Predictive and Prescriptive. With each stage, business value rises — and the share of decision-making shifts step by step from human to machine. That shifting share of decision-making is precisely the regulatory lever.

Our observation: As autonomy increases, governance effort typically grows. The analytics stages follow Gartner; the compliance mapping is an original format by Mag. Eiler & Partner OG. The staircase is a maturity and orientation model, not a legal classification: whether a system is high-risk AI is determined by its intended purpose, the role (provider or deployer), the Annex III category and the exemptions in Art. 6(3) – not by the degree of autonomy. A recommendation system with a human final decision can be high-risk AI; an autonomous workflow need not be. The points listed per stage should therefore be read separately as statutory obligations, voluntary standards (such as ISO/IEC 42001) and governance recommendations.

Stage 1 — Descriptive: "What happened?"

Reports and dashboards are usually not yet an AI system under the AI Act; GDPR, BCBS 239-style data quality and NIS2/DORA basics apply.

• Typical systems: Reports & BI dashboards — regulatory reporting, Power BI/Fabric dashboards, portfolio/claims reports.
• Obligations: usually not yet an AI system within the meaning of Art. 3 AI Act; GDPR principles, data quality (BCBS 239 logic), NIS2/DORA baseline hygiene.
• Key question: Is your data foundation robust enough to build models on later?

Stage 2 — Diagnostic: "Why did it happen?"

Chatbots and Copilot trigger AI literacy under Art. 4 (since 2 February 2025) and labelling under Art. 50 (since 2 August 2026).

• Typical systems: AI assistants and chatbots (internal/customer-facing), Copilot use, RAG over internal documents.
• Obligations: Art. 50 AI Act (since 2 Aug 2026, NOT postponed by the Digital Omnibus) — disclosure of AI interaction; Art. 4 AI Act (since 2 Feb 2025) — AI literacy; shadow-AI inventory; GDPR for customer data in context.
• Key question: Do users know they are talking to an AI — and what its limits are?

Stage 3 — Predictive: "What will happen?"

Scoring and forecasting need validation governance and an Annex III check per use case; high-risk duties apply from 2 December 2027.

• Typical systems: Scoring, fraud detection, churn/claims forecasting, self-service analytics.
• Obligations: Validation governance (model risk, method logging, drift monitoring); Annex III assessment per use case — creditworthiness assessment and life/health insurance pricing are explicitly high-risk (Annex III No. 5); document the classification decision per use case (a duty for providers under Art. 6(4), a governance recommendation for deployers); high-risk obligations from 2 Dec 2027; ISO/IEC 42001/23894/42005; Art. 10 data governance for high-risk; DORA; works-council involvement for HR-related predictions.
• Key question: Who validates the models — and who detects faulty predictions when business users without statistical training run the analyses?

Stage 4 — Prescriptive: "What should be done?" (autonomous decision)

If classified as high-risk, Art. 9–15, 17 and 26 AI Act apply from 2 December 2027, plus Art. 22 GDPR and possibly a FRIA.

• Typical systems: Automated credit decisions, dynamic underwriting/pricing, automated claims settlement, agentic workflows.
• Obligations (where classified as high-risk): high-risk programme Art. 9–15, 17, 26 (from 2 Dec 2027), insofar as the specific system is actually high-risk AI under Art. 6 and Annex III; Art. 14 — human oversight by design, with express safeguards against automation bias (para. 4 lit. b); Art. 22 GDPR (automated individual decision-making); FMA model-governance expectations; management liability (Sec. 84 Austrian Stock Corporation Act / Sec. 39 Austrian Banking Act); FRIA where applicable (Art. 27).
• Key question: Is human oversight effectively designed and evidenced — or merely asserted on paper?

Why is the staircase also a timeline?

The immediate obligations of the lower stages already apply: Art. 4 since 2 February 2025, Art. 50 since 2 August 2026. The high-risk obligations for Annex III systems apply from 2 Dec 2027 — regardless of the stage on which a high-risk system sits. The staircase orders the sequence of topics; the legal classification determines the scope.

Which stage is your institution on?

Answer a few questions on deployment and compliance coverage — you receive your position on the staircase, your compliance gap and the obligations that apply next.