The widest-reaching AI law in force. What it asks, of whom, and by when.
In brief
One Regime, Four Risk Tiers
The Act sorts each AI system into a risk tier and attaches obligations to the tier. A small set of practices is banned outright. A defined list of high-risk uses carries the full obligations. A few uses owe only transparency. Everything else is largely unregulated.
It reaches outside the EU. A provider elsewhere who places a system on the EU market is in scope, and so is a deployer whose system's output is used in the EU. It is also still changing: the 2026 Digital Omnibus postponed the heaviest high-risk deadlines and left the literacy, transparency and prohibition duties on their original dates.
Tier 1 · Article 5
Unacceptable
Banned practices: social scoring, manipulative or exploitative AI, untargeted scraping for facial recognition, and more.
Penalties
Penalties Scale With the Breach
Fines are set as the higher of a fixed ceiling or a percentage of worldwide annual turnover. For SMEs and start-ups, the lower of the two applies.
Where the AI Act Meets the Other Regimes
One fact about a system, and each regime that asks for it.
EU AI Act
reports a serious incident (Art. 73)
15 days; 2 days if widespread; 10 days on a death
GDPR
notifies a personal-data breach (Art. 33)
72 hours
NIS2
reports a significant incident (Art. 23)
24 h warning, 72 h notice, one month
Duties Depend on the Role
The same system carries different duties for whoever builds it, deploys it, imports it, or represents a provider outside the EU.
You build it or place it on the market
The heaviest duties. Risk management, data governance, technical documentation, logging, human oversight, conformity assessment, registration, and post-market monitoring.
You use it under your own authority
Operate it as instructed, keep human oversight, monitor for issues, and run a fundamental-rights impact assessment where required. Data-protection duties run in parallel.
You bring a third-country system to the EU
The Dates
Application phases in over several years. The Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) moved the standalone high-risk deadline to December 2027, but left the earlier duties in place.
1 Aug 2024
The Act enters into force.
Live
2 Feb 2025
Prohibited practices (Art. 5) and AI literacy (Art. 4) apply.
Live
2 Aug 2025
The Regimes That Apply Alongside It
With our people
Michael Clark
Chief Executive Officer
Martin Dean
Chief Technology Officer
FAQ
Common Questions
Article 99 sets three tiers, each the higher of a fixed sum or a percentage of global annual turnover: up to EUR 35 million or 7% for prohibited practices (Article 5); up to EUR 15 million or 3% for breaching high-risk or other obligations; and up to EUR 7.5 million or 1% for supplying incorrect or misleading information.
The Act applies in phases. The Article 5 prohibited-practice bans and AI-literacy duties applied from 2 February 2025; general-purpose AI model rules from 2 August 2025; general application, including Article 50 transparency, from 2 August 2026; standalone high-risk systems under Annex III from 2 December 2027; and high-risk systems that are safety components of regulated products under Annex I from 2 August 2028.
The Act is extraterritorial. If your system is placed on the EU market, or its output is used in the EU, you are in scope wherever you are established.
Yes. The Act binds deployers, not only providers. If you put an AI system into use under your own authority in the EU, you carry deployer obligations under Article 26, and for certain high-risk uses a fundamental-rights impact assessment under Article 27, regardless of who built the system.
No. The provider's Article 9 risk assessment addresses engineering risks; the deployer's fundamental-rights impact assessment under Article 27 assesses impact on affected persons' rights in the deployer's particular deployment context. Both are required and serve different purposes.
White paper
The Classification Decision
Classify each use before Annex III obligations apply on 2 December 2027; every later obligation follows from it.
In force · Feb 2025
Tier 2 · Annex III / I
High-risk
Employment, credit, education, biometrics, essential services, critical infrastructure. The full obligation set.
From 2 Dec 2027
Tier 3 · Article 50
Limited (transparency)
Chatbots, emotion recognition, and synthetic or manipulated content must disclose that AI is at work.
In force · Aug 2026
Tier 4
Minimal
Everything else. No tier-specific obligations. The AI-literacy provision (Art. 4) still applies; voluntary codes of conduct are encouraged.
Art. 4 only
DORA
reports a major ICT incident (Art. 19)
time limits set under Art. 20
MDR
reports a serious incident (Art. 87)
15 days
Art. 73(9) and (10) narrow the AI Act's report where equivalent sector reporting applies. Check the consolidated text before relying on a date.
EU AI Act
fundamental-rights impact assessment (Art. 27)
may cross-refer to the DPIA (Art. 27(4))
GDPR
data protection impact assessment (Art. 35)
before processing
Verify the provider completed conformity assessment, that documentation and the CE marking are in place, before the system reaches the market.
You represent a non-EU provider
The provider's EU point of contact. Hold the documentation, cooperate with authorities, and be the address the regulator can reach.
Illustrative, not exhaustive.
General-purpose AI model obligations (Chapter V), governance, penalties and notified bodies apply; GPAI fines (Art. 101) excepted.
Live
27 Jul 2026
The Digital Omnibus's changes to sector laws (Art. 102–110) apply.
Live
2 Aug 2026
Everything else applies, including transparency (Art. 50) and GPAI fines.
Live
2 Dec 2026
New bans on non-consensual intimate imagery and child abuse material (Art. 5(1)(ba), (bb)) apply; generative AI already on the market must mark synthetic content (Art. 50(2)).
Upcoming
2 Aug 2027
General-purpose AI models on the market before 2 Aug 2025 must comply (Art. 111(3)).
Upcoming
2 Dec 2027
Standalone high-risk (Annex III) obligations apply, including the deployer's duty to give oversight to competent, trained people (Art. 26(2)).
Existing high-risk systems used by public authorities must comply (Art. 111(2)).
Upcoming
31 Dec 2030
AI in large-scale EU IT systems (Annex X) must comply (Art. 111(1)).
Upcoming
Source: Official Journal of the EU · EU AI Act as amended by the Digital Omnibus · Check the consolidated text before relying on a date.
Article 99 requires penalties to be proportionate, taking into account the organisation's size and economic viability alongside the nature and gravity of the infringement. This can reduce the quantum but does not eliminate enforcement risk.
Not automatically. The high-risk classification under Article 6 and Annex III turns on the use case (for example recruitment, worker management, or access to essential services), not on whether the system is sold externally. An in-house high-risk deployment still triggers the deployer obligations.
Deployers carry their own duties. Article 26(2) requires human oversight by people with the competence, training and authority for it, alongside monitoring and, where required, a fundamental-rights impact assessment. Article 4 also asks for AI literacy among the people who work with the system.
Standalone high-risk obligations, Article 26(2) among them, apply from 2 December 2027. Article 4's literacy provision, transparency (since August 2026) and the prohibitions already apply. Use the extra time to do the work properly before the standards arrive.
