EU AI Act
The EU AI Act: deadlines, risk categories and requirements
In short
The EU AI Act is Regulation (EU) 2024/1689, the European Union's binding law on artificial intelligence. It sorts AI systems by risk: banned practices, high-risk systems with strict obligations, transparency duties for certain systems, and minimal-risk systems. It applies to providers and deployers inside the EU and to organisations outside it whose AI output is used in the EU.
Key takeaways
- The Act entered into force on 1 August 2024 and applies in stages. Prohibitions and AI literacy have applied since 2 February 2025, and general-purpose AI obligations since 2 August 2025.
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, is adopted law (in force 27 July 2026). It moved the high-risk dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Risk tier and role decide your obligations. Work out whether you are a provider or a deployer for each system before anything else.
- Maximum fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, whichever is higher.
- The Act reaches organisations outside the EU when their AI system's output is used in the EU.
- Dates and guidance are still moving. Confirm the current position on the Commission's AI Act pages before relying on any deadline.
What is the EU AI Act?
The EU AI Act is the first comprehensive horizontal law on AI. It is a regulation, so it applies directly in every Member State without national transposition. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024.
It takes a risk-based approach. Obligations scale with the harm an AI system could cause, and they fall on the organisations that build, import, distribute or use those systems. National authorities enforce most of it. The Commission's AI Office oversees general-purpose AI models.
This page is general information, not legal advice. Whether a specific system is in scope, and which tier it falls into, can need a lawyer's view.
Who does the EU AI Act apply to?
It applies to providers placing AI systems or general-purpose AI models on the EU market, to deployers established or located in the EU, and to providers and deployers in other countries where the system's output is used in the EU (Article 2). It also covers importers, distributors, product manufacturers and authorised representatives.
The Act sets out exclusions, including AI used exclusively for military, defence or national security purposes, scientific research and development, and purely personal non-professional use.
| Role | Who they are | Main duties |
|---|---|---|
| Provider | Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name | Meet the high-risk requirements, run a quality management system (Article 17), carry out conformity assessment (Article 43), register the system (Article 49) |
| Deployer | Uses an AI system under its own authority in a professional capacity | Use per instructions, assign human oversight, monitor, keep logs, inform affected people (Article 26) |
| Importer / distributor | Brings a non-EU system to the market, or makes one available in the supply chain | Verify that conformity steps were done before supplying |
A deployer can become a provider by putting its name on a high-risk system, making a substantial modification, or changing its intended purpose (Article 25).
What are the EU AI Act risk categories?
There are four: unacceptable risk (prohibited), high risk, limited risk (transparency obligations) and minimal risk. General-purpose AI models are regulated separately, by what the model can do rather than by use case.
Annex III covers eight areas: biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and border control, and justice and democratic processes. An Annex III system that does not pose a significant risk can be exempted under Article 6(3), but the provider must document that assessment, and profiling of people always counts as high risk.
| Tier | Basis | Consequence |
|---|---|---|
| Unacceptable | Practices banned by Article 5, such as harmful manipulation, social scoring, and untargeted scraping of facial images | Prohibited. Highest fine tier applies |
| High risk | Safety components or products under Annex I laws, or uses listed in Annex III, under Article 6 | Full requirements in Articles 9 to 15, plus provider and deployer duties |
| Limited risk | Systems that interact with people or generate synthetic content (Article 50) | Transparency: tell people they face AI, and mark synthetic content |
| Minimal risk | Everything else, such as spam filters | No specific obligations. Voluntary codes of conduct |
What are the EU AI Act deadlines?
The Act applies in stages. As of 3 October 2026, the high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. The Digital Omnibus on AI, which made that change, is adopted and in force. It is no longer a proposal.
The Commission proposed the Omnibus on 19 November 2025. Parliament and Council reached political agreement on 7 May 2026, Parliament endorsed it on 16 June, and the Council adopted it on 29 June. Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026.
| Date | What applies |
|---|---|
| 1 Aug 2024 | Entry into force |
| 2 Feb 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) |
| 2 Aug 2025 | General-purpose AI obligations and governance rules |
| 2 Aug 2026 | Most remaining rules, including Article 50 transparency and enforcement powers; Annex III high-risk date moved by the Omnibus |
| 2 Dec 2026 | Two new prohibitions added by the Omnibus (non-consensual intimate imagery and child sexual abuse material); end of the short grace period for some machine-readable marking duties |
| 2 Dec 2027 | High-risk systems listed in Annex III |
| 2 Aug 2028 | High-risk systems that are, or are safety components of, products under Annex I laws |
Details of the Omnibus, including grace periods and simplifications for smaller companies, are in the regulation itself. Check the Commission's AI Act Service Desk timeline for the current position and use a lawyer for edge cases.
What are the EU AI Act requirements for high-risk systems?
Providers of high-risk systems must meet seven technical requirements in Articles 9 to 15 and run a quality management system under Article 17. Deployers have separate duties under Article 26.
- Article 9: a risk management system across the lifecycle.
- Article 10: data and data governance, including bias examination.
- Article 11: technical documentation, drawn up before the system is placed on the market.
- Article 12: automatic logging of events.
- Article 13: transparency and instructions for use for deployers.
- Article 14: human oversight designed into the system.
- Article 15: accuracy, robustness and cybersecurity.
- Article 43: conformity assessment before market placement, then an EU declaration of conformity and CE marking.
- Article 49: registration in the EU database.
- Article 72: post-market monitoring. Article 73: reporting serious incidents to authorities, generally within 15 days, with shorter deadlines for the gravest cases.
- Article 26: deployers use the system as instructed, assign trained human oversight, monitor it, keep logs they control for at least six months, and inform workers and affected people where required.
- Article 27: certain deployers, such as public bodies and those using AI for credit scoring or life and health insurance pricing, must assess the impact on fundamental rights before first use.
What are the penalties under the EU AI Act?
Article 99 sets three tiers of maximum administrative fines. The higher of the fixed amount and the percentage of worldwide annual turnover applies, except for SMEs, including start-ups, where the lower applies.
| Infringement | Maximum fine |
|---|---|
| Prohibited practices (Article 5) | EUR 35 million or 7% of worldwide annual turnover |
| Most operator obligations, including provider, deployer and transparency duties | EUR 15 million or 3% |
| Supplying incorrect, incomplete or misleading information to authorities | EUR 7.5 million or 1% |
These are ceilings. Authorities weigh the gravity and duration of the breach, the operator's size, cooperation, intent and any action taken to limit harm. Fines for providers of general-purpose AI models are set in Article 101 and imposed by the Commission.
What does the EU AI Act require of general-purpose AI models?
Providers of general-purpose AI (GPAI) models must keep technical documentation, give information to downstream providers, have a copyright compliance policy and publish a summary of training content. Obligations have applied since 2 August 2025.
Models presumed to carry systemic risk (the Act's starting presumption is training compute above 10^25 floating-point operations) face extra duties: model evaluation, adversarial testing, serious incident reporting and cybersecurity protection. The AI Office supervises these models.
How should an organisation prepare for the EU AI Act?
Start with what you have, then classify it, then close gaps in order of risk.
- Build an inventory of AI systems, including those embedded in vendor products and any used without approval.
- Decide your role for each: provider, deployer, importer or distributor.
- Check each system against Article 5 prohibitions, then Annex III and Annex I, then Article 50.
- For high-risk systems, plan the Article 9 to 15 work, documentation and conformity route against the 2027 and 2028 dates.
- Support AI literacy now with training and role-based guidance. Article 4 has applied since February 2025, in the lighter form the Omnibus left it.
- Record decisions and evidence, and review them when a system, vendor or regulation changes.
How AIGovernr helps
AIGovernr lets you register AI systems, run a scope check and an EU AI Act classification (Article 5, Annex III and Article 50), and see the controls and evidence that apply to the resulting tier. Classifications are kept in history and flagged when a system's facts change. It supports your assessment. It does not certify a system or make an organisation compliant, and it is not legal advice.
Frequently asked questions
When does the EU AI Act fully apply?
There is no single date. Prohibitions and AI literacy have applied since 2 February 2025 and general-purpose AI rules since 2 August 2025. Most other rules apply from 2 August 2026. High-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. Confirm on the Commission site.
Has the EU AI Act high-risk deadline been delayed?
Yes. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the high-risk dates from 2 August 2026 to 2 December 2027 for Annex III systems and from 2 August 2027 to 2 August 2028 for systems under Annex I product laws.
Does the EU AI Act apply to companies outside the EU?
Yes, in two main cases. A non-EU provider that places an AI system or general-purpose model on the EU market is covered. So is a non-EU provider or deployer whose system's output is used in the EU. Importers and distributors in the EU carry their own duties.
What is the difference between a provider and a deployer?
A provider develops an AI system, or has it developed, and places it on the market under its own name. A deployer uses a system under its own authority in a professional setting. Providers carry most design and conformity duties. Deployers carry operational duties under Article 26, and can become providers if they modify a system substantially.
How much can you be fined under the EU AI Act?
Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other obligations, and EUR 7.5 million or 1% for supplying misleading information. The higher figure applies, except for SMEs, where the lower figure applies. These are maximums.
Is a chatbot high risk under the EU AI Act?
Usually not. A customer-service chatbot normally falls under limited risk, so users must be told they are interacting with AI. It becomes high risk only if used for a purpose listed in Annex III, for example screening job applicants or deciding access to essential services.
Is AI literacy a legal requirement?
Yes, in a lighter form than before. Article 4 has applied since 2 February 2025, and the Digital Omnibus reworded it: providers and deployers must now take measures to support the AI literacy of their staff and of others operating AI on their behalf. Training and role-based guidance remain the practical way to show you have done so. Check the current consolidated text.
Does ISO/IEC 42001 certification prove EU AI Act compliance?
No. ISO/IEC 42001 is a voluntary management-system standard. It can support governance, but it is not a harmonised standard cited in the Official Journal, so it gives no legal presumption of conformity. Obligations must still be met requirement by requirement.
Sources
Facts on this page were checked against these primary sources on 3 October 2026. This guide is general information, not legal advice.
Put this into practice
Register your AI systems, see which obligations apply, and keep controls and evidence in one workspace.
Start free