EU AI Act

What is the EU AI Act?

The Artificial Intelligence Act, Regulation (EU) 2024/1689, is the European Union’s horizontal law on AI. As a regulation, it applies directly in every Member State without needing national transposition. It entered into force on 1 August 2024, with obligations applying in stages.

In July 2026 the EU adopted Regulation (EU) 2026/1744, the Digital Omnibus on AI. It amends the Act to simplify implementation and to move back several deadlines, most importantly for high-risk AI systems.

Purpose and objectives

The Act aims to improve how the internal market functions and to promote human-centric, trustworthy AI, while ensuring a high level of protection of health, safety and fundamental rights. It does this by:

• banning a limited set of AI practices considered unacceptable;
• setting requirements for high-risk AI systems and obligations for those who build and use them;
• imposing transparency duties for certain AI interactions and AI-generated content;
• regulating general-purpose AI (GPAI) models, with extra duties for those posing systemic risk;
• creating an EU and national governance and enforcement structure.

Who does it apply to?

The Act assigns obligations by role:

One organisation can hold several roles. A deployer that substantially modifies a high-risk system, or puts its own name on it, can become its provider.

The risk-based structure

General-purpose AI models sit alongside this structure. Their providers must keep technical documentation, provide information to downstream providers, have a copyright policy and publish a summary of training content. Models with systemic risk must also perform evaluations, mitigate risks, report serious incidents and maintain cybersecurity.

Core requirements for high-risk AI

Providers of high-risk AI systems must, among other things:

• operate a risk management system across the life cycle;
• apply data governance to training, validation and testing data;
• prepare technical documentation and enable automatic logging;
• give deployers clear instructions for use;
• design for effective human oversight;
• achieve appropriate accuracy, robustness and cybersecurity;
• run a quality management system;
• complete the relevant conformity assessment, draw up an EU declaration of conformity, affix CE marking and register in the EU database;
• carry out post-market monitoring and report serious incidents.

Deployers must use systems according to the instructions, assign competent human oversight, monitor operation, keep logs under their control, and inform affected workers where relevant. Public bodies, and certain private deployers such as those assessing creditworthiness, must carry out a fundamental rights impact assessment before use.

Application timeline

See the open questions below. Confirm dates against the consolidated text before relying on them for a compliance plan.

Governance and enforcement

The European Commission’s AI Office supervises general-purpose AI models and supports consistent application. The European AI Board brings together Member State representatives. Each Member State designates national competent authorities, including market surveillance authorities, to enforce the rules on AI systems.

Fines are tiered. For prohibited practices, the maximum is the higher of €35 million or 7% of total worldwide annual turnover. For most other obligations, it is the higher of €15 million or 3%. For supplying incorrect or misleading information to authorities, it is the higher of €7.5 million or 1%. Lower caps apply to SMEs and start-ups.

Implementation lifecycle

1. Inventory AI systems and models. Include those embedded in products and those bought from vendors.
2. Classify each one. Is it prohibited? High-risk under Annex I or III? Subject to transparency duties? Is it a GPAI model?
3. Determine your role for each system: provider, deployer, importer or distributor.
4. Gap-assess against the obligations for that role and tier.
5. Build the management infrastructure. Risk management, data governance, documentation, logging, human oversight, QMS and incident processes.
6. Prepare for conformity assessment and registration where required.
7. Monitor. Post-market monitoring, incident reporting and tracking of guidance, codes of practice and standards.

Evidence and documentation

For high-risk providers, the key artefacts include the risk management file, data governance records, technical documentation (its content is specified in an annex to the Act), logs, instructions for use, the quality management system documentation, conformity assessment records, the EU declaration of conformity, registration details and post-market monitoring plans. Deployers should keep records of human oversight assignments, monitoring, logs and, where required, the fundamental rights impact assessment.

Common misconceptions and pitfalls

• “It only affects EU companies.” Extraterritorial reach is broad.
• “All AI is high-risk.” Most AI systems fall outside the high-risk categories. Classification must be done case by case.
• “The delay means nothing to do until 2027.” Prohibitions, GPAI duties and transparency obligations already apply, and high-risk preparation takes time.
• Confusing the Act with GDPR. Both can apply to the same system. The AI Act does not replace data protection law.

Relationship with other frameworks