Artificial intelligence is becoming a core part of how companies build products, analyze data, and automate decisions. As AI adoption grows, regulators are introducing new rules to manage its risks.
The EU AI Act is the first comprehensive regulation on artificial intelligence from a major regulator. It sets requirements for organizations that develop or use AI systems, and it is being phased in through 2028.
If your company builds AI systems, or uses AI systems built by others, and the system or its output is placed on the market or used in the EU, the regulation may apply to you. Your obligations depend on your role (provider, deployer, importer, or distributor) and on how the AI system is used.
Some requirements already apply. Prohibitions and AI literacy requirements have applied since February 2025, and transparency rules and AI Office enforcement powers since August 2026. Understanding what applies to you now, and what is coming, is the first step to reducing regulatory risk.
What Is the EU AI Act?
The EU AI Act is a regulatory framework designed to ensure AI systems are safe, transparent, and accountable.
It takes a risk-based approach, so obligations vary with the potential impact of an AI system. Most of the text covers prohibited practices and high-risk systems. It also sets transparency duties for certain AI systems and leaves most other AI largely unregulated. In practice, this is often described as four tiers:
Prohibited Risk
Certain AI practices are banned because they pose unacceptable risks to fundamental rights.
High Risk
AI systems that could significantly affect people's health, safety, or fundamental rights must meet strict requirements.
Limited Risk (Transparency Obligations)
Certain AI systems, such as chatbots and generative AI, must meet transparency obligations, for example telling users they are interacting with AI or marking AI-generated content.
Minimal Risk
Most AI systems fall here and have no specific obligations under the Act, though AI literacy requirements apply to providers and deployers of all AI systems.
Transparency rules apply based on how an AI system is used, so a system can be high-risk and also subject to them. Before you can comply, you need to identify and classify the AI systems you build and use.
Who Must Comply With the EU AI Act?
The EU AI Act applies across industries. Organizations affected include:
- Providers (developers) placing AI systems on the EU market or putting them into service in the EU, wherever they are established
- Deployers (organizations using AI systems in a professional capacity) that are located or established in the EU
- Providers and deployers in other countries where the AI system's output is used in the EU
- Importers and distributors of AI systems
- Providers of general-purpose AI (GPAI) models
Many technology companies, SaaS providers, and enterprise platforms will fall within scope.
If you build or use AI and your system or its output reaches the EU, check whether you are a provider or a deployer. Most obligations fall on providers of high-risk systems. Deployers have fewer.
Key EU AI Act Compliance Requirements
Providers of high-risk AI systems carry most of the Act's obligations. Deployers of high-risk systems have a smaller set of duties. Key requirements for providers include:
Risk Management
Providers must establish a risk management system that runs throughout the system's lifecycle. It must identify and mitigate risks to health, safety, and fundamental rights.
Data Governance
Training, validation, and testing data must be relevant, sufficiently representative, and, as far as possible, free of errors and complete for the intended purpose.
Technical Documentation
High-risk AI systems must have detailed documentation describing:
- System architecture
- Training data sources
- Testing procedures
- System limitations and intended use
Providers must also keep logs, give deployers instructions for use, and maintain a quality management system. Authorities can request this documentation to assess compliance.
Transparency
Article 50 requires transparency in four situations, whatever the system's risk level:
- AI that interacts directly with people must tell users they are interacting with AI
- Providers of generative AI must mark outputs in a machine-readable format so they are detectable as AI-generated
- Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them
- Deployers of deepfakes, or of AI-generated text published to inform the public on matters of public interest, must disclose that the content is AI-generated
These rules apply from August 2, 2026.
Human Oversight
Providers must design high-risk AI systems so humans can oversee them effectively. Deployers must put that oversight into practice, including the ability to review or override AI outputs.
Post-Market Monitoring
Compliance does not end at launch. Providers must monitor high-risk systems after they are placed on the market and report serious incidents to the relevant authorities.
Conformity Assessment and Registration
Providers must complete a conformity assessment, issue an EU declaration of conformity, apply the CE marking, and register the system in the EU database for high-risk AI systems.
AI Literacy
Providers and deployers of any AI system must take measures to support the AI literacy of staff and others who operate AI systems on their behalf. This has applied since February 2, 2025.
General-Purpose AI Models
Providers of GPAI models have had obligations since August 2, 2025. These include technical documentation, information for downstream providers, a copyright-compliance policy, and a public summary of training content. Models with systemic risk face added duties: model evaluations, risk mitigation, serious-incident reporting, and cybersecurity protections. The voluntary GPAI Code of Practice can be used to demonstrate compliance.
Key Dates
Date | What applies |
|---|---|
August 1, 2024 | The Act enters into force |
February 2, 2025 | Prohibited practices and AI literacy requirements apply |
August 2, 2025 | GPAI model obligations, governance rules, and penalty provisions apply |
August 2, 2026 | Article 50 transparency obligations apply and the AI Office's enforcement powers begin. Generative AI systems already on the market have until December 2, 2026 to meet the machine-readable marking requirement |
December 2, 2026 | Prohibitions on AI that generates non-consensual intimate imagery and child sexual abuse material apply |
December 2, 2027 | High-risk obligations apply for Annex III use cases, such as hiring and credit decisions |
August 2, 2028 | High-risk obligations apply for AI in products covered by Annex I EU product legislation |
Dates reflect the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026. High-risk dates were originally earlier. High-risk AI intended for use by public authorities has until August 2, 2030.
Penalties for Non-Compliance
The EU AI Act introduces significant penalties, and fines scale with the type of violation. For each tier, the cap is the fixed amount or the percentage of total worldwide annual turnover, whichever is higher:
- Prohibited AI practices: up to €35 million or 7%
- Most other obligations, including provider, deployer, and Article 50 transparency duties: up to €15 million or 3%
- Supplying incorrect, incomplete, or misleading information to authorities: up to €7.5 million or 1%
For SMEs and start-ups, each cap is whichever amount is lower. The Digital Omnibus extends this lower-cap treatment to "small mid-cap" companies for the second and third tiers. Providers of GPAI models are subject to a separate fines regime enforced by the European Commission.
These penalties make AI governance a priority for executive leadership.
How Companies Can Prepare
Preparing for the EU AI Act requires a structured approach. Organizations should start with these steps:
- Identify AI systems used across the organization
- Confirm your role (provider, deployer, importer, or distributor) for each system
- Classify systems by risk level
- Conduct a gap analysis against EU AI Act requirements
- Establish governance and oversight
- Implement monitoring and documentation processes
- Train staff on AI literacy and review your Article 50 transparency practices
These steps form the foundation of an AI governance program aligned with regulatory expectations.
Download our EU AI Act Guide and EU AI Act Compliance Checklist for a clear overview of the regulation, its requirements, and its impact. Use them as a practical roadmap to start building your EU AI Act compliance strategy.