Regulation · EU · Reg. 2024/1689
The EU AI Act
The widest-reaching AI law in force. What it asks, of whom, and by when.
- Status
- In force, phasing in
- In force since
- 1 August 2024
- Standalone high-risk
- 2 December 2027
- Latest change
- Digital Omnibus, 2026
In brief
One Regime, Four Risk Tiers
The Act sorts each AI system into a risk tier and attaches obligations to the tier. A small set of practices is banned outright. A defined list of high-risk uses carries the full obligations. A few uses owe only transparency. Everything else is largely unregulated.
It reaches outside the EU. A provider elsewhere who places a system on the EU market is in scope, and so is a deployer whose system's output is used in the EU. It is also still changing: the 2026 Digital Omnibus postponed the heaviest high-risk deadlines and left the literacy, transparency and prohibition duties on their original dates.
- Tier 1 · Article 5
- Unacceptable. Banned practices: social scoring, manipulative or exploitative AI, untargeted scraping for facial recognition, and more.
- In force · Feb 2025
- Tier 2 · Annex III / I
- High-risk. Employment, credit, education, biometrics, essential services, critical infrastructure. The full obligation set.
- From 2 Dec 2027
- Tier 3 · Article 50
- Limited (transparency). Chatbots, emotion recognition, and synthetic or manipulated content must disclose that AI is at work.
- In force · Aug 2026
- Tier 4
- Minimal. Everything else. No tier-specific obligations. The AI-literacy provision (Art. 4) still applies; voluntary codes of conduct are encouraged.
- Art. 4 only
Where it meets the others
Where the AI Act Meets the Other Regimes
One fact about a system, and each regime that asks for it.
- One serious incident
- EU AI Actreports a serious incident (Art. 73)15 days; 2 days if widespread; 10 days on a death
- GDPRnotifies a personal-data breach (Art. 33)72 hours
- NIS2reports a significant incident (Art. 23)24 h warning, 72 h notice, one month
- DORAreports a major ICT incident (Art. 19)time limits set under Art. 20
- MDRreports a serious incident (Art. 87)15 days
Art. 73(9) and (10) narrow the AI Act's report where equivalent sector reporting applies. Check the consolidated text before relying on a date.
- One impact assessment
- EU AI Actfundamental-rights impact assessment (Art. 27)may cross-refer to the DPIA (Art. 27(4))
- GDPRdata protection impact assessment (Art. 35)before processing
Who owes what
Your Duties Depend on Your Role
The same system carries different duties for whoever builds it, deploys it, imports it, or represents a provider outside the EU.
- Provider
- You build it or place it on the market. The heaviest duties. Risk management, data governance, technical documentation, logging, human oversight, conformity assessment, registration, and post-market monitoring.
- Deployer
- You use it under your own authority. Operate it as instructed, keep human oversight, monitor for issues, and run a fundamental-rights impact assessment where required. Data-protection duties run in parallel.
- Importer
- You bring a third-country system to the EU. Verify the provider completed conformity assessment, that documentation and the CE marking are in place, before the system reaches the market.
- Authorised representative
- You represent a non-EU provider. The provider's EU point of contact. Hold the documentation, cooperate with authorities, and be the address the regulator can reach.
Illustrative, not exhaustive.
Timeline
The Dates, and Which Have Passed
Application phases in over several years. The Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) moved the standalone high-risk deadline to December 2027, but left the earlier duties in place.
- Feb 2025
- Prohibited practices (Art. 5) apply, with the AI-literacy provision (Art. 4).
- Live
- Aug 2025
- General-purpose AI model obligations (Art. 51–55) apply.
- Live
- 2 Aug 2026
- Article 50 transparency obligations apply; synthetic-content marking follows in Dec 2026.
- Live
- 2 Dec 2027
- Standalone high-risk (Annex III) obligations apply, including the deployer's duty to give oversight to competent, trained people (Art. 26(2)); product-embedded (Annex I) follows 2 Aug 2028.
- Upcoming
Source: Official Journal of the EU · EU AI Act as amended by the Digital Omnibus · Check the consolidated text before relying on a date.
Penalties
Penalties Scale With the Breach
Fines are set as the higher of a fixed ceiling or a percentage of worldwide annual turnover. For SMEs and start-ups, the lower of the two applies.
- €35M / 7%
- Deploying a prohibited AI practice under Article 5.
- €15M / 3%
- Non-compliance with most other obligations, including the high-risk provider and deployer duties.
- €7.5M / 1%
- Supplying incorrect, incomplete, or misleading information to authorities.
Check the consolidated text before relying on a figure.
The regimes alongside it
The Regimes That Apply Alongside It
- Reg. 2016/679
GDPR for AI
Data protection. Lawful basis, impact assessments (DPIAs) and people's rights, wherever AI uses personal data.
In forceRead the guide - Dir. 2022/2555
NIS2 Directive
Cyber resilience for essential and important entities. The management body is personally responsible.
In forceRead the guide - Dir. 2024/2853
Product liability
Software, AI included, becomes a product under EU liability law. A defect can be presumed where it breaks a safety requirement meant to prevent the harm, which may include the EU AI Act.
Applies 9 Dec 2026Read the guide - Reg. 2022/2554
DORA for financial firms
Operational resilience of the financial system. ICT risk, third-party oversight, resilience testing.
In forceRead the guide
FAQ
Common Questions
Yes. The Act binds deployers, not only providers. If you put an AI system into use under your own authority in the EU, you carry deployer obligations under Article 26, and for certain high-risk uses a fundamental-rights impact assessment under Article 27, regardless of who built the system.
Article 99 sets three tiers, each the higher of a fixed sum or a percentage of global annual turnover: up to EUR 35 million or 7% for prohibited practices (Article 5); up to EUR 15 million or 3% for breaching high-risk or other obligations; and up to EUR 7.5 million or 1% for supplying incorrect or misleading information.
The Act applies in phases. The Article 5 prohibited-practice bans and AI-literacy duties applied from 2 February 2025; general-purpose AI model rules from 2 August 2025; general application, including Article 50 transparency, from 2 August 2026; standalone high-risk systems under Annex III from 2 December 2027; and high-risk systems that are safety components of regulated products under Annex I from 2 August 2028.
No. The provider's Article 9 risk assessment addresses engineering risks; the deployer's fundamental-rights impact assessment under Article 27 assesses impact on affected persons' rights in the deployer's particular deployment context. Both are required and serve different purposes.
Article 99 requires penalties to be proportionate, taking into account the organisation's size and economic viability alongside the nature and gravity of the infringement. This can reduce the quantum but does not eliminate enforcement risk.
Not automatically. The high-risk classification under Article 6 and Annex III turns on the use case (for example recruitment, worker management, or access to essential services), not on whether the system is sold externally. An in-house high-risk deployment still triggers the deployer obligations.
The Act is extraterritorial. If your system is placed on the EU market, or its output is used in the EU, you are in scope wherever you are established.
Deployers carry their own duties. Article 26(2) requires human oversight by people with the competence, training and authority for it, alongside monitoring and, where required, a fundamental-rights impact assessment. Article 4 also asks for AI literacy among the people who work with the system.
Standalone high-risk obligations, Article 26(2) among them, apply from 2 December 2027. Article 4's literacy provision, transparency (since August 2026) and the prohibitions already apply. Use the extra time to do the work properly before the standards arrive.
Your next step