We use cookies and similar storage that the site needs to work. With your permission, we would also like to use marketing cookies to understand which of our pages and campaigns interest you and, if we know who you are, to let our team follow up. You can change your mind at any time from Cookie settings at the foot of every page. Cookie Policy
Your duties turn on your role and your system's risk tier, and buyers carry duties as well as builders. A provider markets AI under its own name; a deployer uses it professionally and can become a provider by modifying a vendor's system.
Breaches can cost up to €35m or 7% of worldwide turnover, but enforcement is still being built. No public AI Act fines or formal investigations had been reported as of October 2026, and most Member States had not fully designated authorities.
The timetable is now fixed in law: new bans on 2 December 2026, high-risk duties in December 2027 and August 2028. The Digital Omnibus, adopted and in force since 27 July 2026, replaced standards-linked dates with fixed ones, so don't plan on further slippage.
What should you do now?
Inventory your AI. Record each system's role (provider or deployer), risk tier and EU exposure. Flag any fine-tuning or rebranding that could make you a provider.
Close today's gaps. Rule out prohibited uses, including the new bans from 2 December 2026. Ship AI-interaction notices, deepfake labels and watermarking. Document your literacy measures.
Start the high-risk build now for HR, credit, insurance and other Annex III uses, due 2 December 2027. Quality management, documentation, logging and oversight design take a long time to put in place.
Run one FRIA-plus-DPIA process that serves both the AI Act and the GDPR.
Tighten vendor contracts. Require AI Act compliance commitments, Code of Practice adherence or an equivalent, incident cooperation, and deployer documentation.
Which duties apply to you, and which already bite?
Duties attach to your role (Art. 3) and risk tier. Deployers have their own duties: literacy, transparency and, for high-risk uses, deployer obligations.
You can become a provider without building anything. Under Art. 25, a deployer becomes a provider if it:
rebrands a high-risk system;
substantially modifies one; or
repurposes a system into high-risk use.
Under the Omnibus, a system marketed as broadly applicable that does not exclude high-risk uses may be classed as high-risk. Using GPAI through an API does not make you a GPAI provider.
Duties that apply today
Duties that apply today
Duties that apply today
Who
Obligation
Who
All providers and deployers
Obligation
AI literacy (Art. 4). Since 27 July 2026, take measures to support staff AI literacy. No specific level is required.
Who
Everyone
Obligation
No prohibited practices (Art. 5), in force since 2 February 2025
Who
Providers
Obligation
Art. 50. Tell users they are dealing with AI, and watermark synthetic content (machine-readable marking). Generative systems already on the market before 2 August 2026 have until 2 December 2026 to watermark.
Who
Deployers
Obligation
Art. 50. Disclose emotion recognition and biometric categorisation. Label deepfakes and AI-generated public-interest text.
Who
GPAI providers (Art. 53)
Obligation
Technical documentation, information for downstream integrators, an EU copyright policy that honours text-and-data-mining opt-outs, and a public training-content summary
In addition: model evaluations, adversarial testing, systemic-risk mitigation, incident reporting to the AI Office, and cybersecurity
The Commission's final transparency guidelines (20 July 2026) say AI agents should disclose that they are artificial and whom they act for.
About 26 firms signed the voluntary GPAI Code of Practice (July 2025), including Google, Microsoft and OpenAI. Meta declined, and xAI signed only the safety and security chapter.
Duties for high-risk systems
High-risk systems are AI in regulated products (Annex I) or in sensitive uses such as employment and credit (Annex III).
Duties for high-risk systems
Duties for high-risk systems
Providers
Deployers (Art. 26)
Providers
Risk management (Art. 9); data governance (Art. 10)
Deployers (Art. 26)
Use the system according to its instructions; assign competent human oversight
Keep input data relevant; keep logs for at least 6 months
Providers
Instructions for use (Art. 13); human oversight (Art. 14); accuracy, robustness and cybersecurity (Art. 15)
Deployers (Art. 26)
Monitor the system; report risks and serious incidents
Providers
Quality management system (Art. 17)
Deployers (Art. 26)
Inform workers' representatives and affected people; Art. 86 gives a right to explanation
Providers
Conformity assessment, CE marking, EU database registration
Deployers (Art. 26)
Fundamental rights impact assessment (FRIA, Art. 27): public bodies, private bodies providing public services, and credit-scoring or life/health insurance pricing deployers
Providers
Post-market monitoring; serious-incident reports (Art. 73) within 15 days, 2 days if widespread or critical infrastructure is disrupted, 10 days after a death
Deployers (Art. 26)
What changes the workload
Conformity assessment. For most Annex III systems this is a self-assessment. Some biometric systems may need a notified body, which is an independent assessor.
Art. 6(3) exemption. Annex III systems posing no significant risk, such as narrow procedural tools, can fall outside the tier. They must still be registered.
Profiling is always high-risk.
Only draft Commission guidance on classification (19 May 2026) has been found.
Omnibus relief.
Lighter documentation and quality management for SMEs and the new small mid-cap (SMC) category: fewer than 750 staff, and turnover of €150m or less or a balance sheet of €129m or less.
Bias-detection use of sensitive personal data is allowed where strictly necessary.
GDPR overlap. The FRIA can build on a GDPR data protection impact assessment (DPIA) (Art. 27(4)).
How much could non-compliance cost, and who enforces it?
Penalties have applied since 2 August 2025.
How much could non-compliance cost, and who enforces it?
How much could non-compliance cost, and who enforces it?
Breach
Maximum fine
Breach
Prohibited practices (Art. 99(3))
Maximum fine
€35,000,000 or 7% of worldwide annual turnover
Breach
Most other obligations, incl. Art. 50 (Art. 99(4))
Maximum fine
€15,000,000 or 3%
Breach
Misleading information to authorities (Art. 99(5))
Maximum fine
€7,500,000 or 1%
Breach
GPAI providers, fined by the Commission (Art. 101, live since 2 August 2026)
Maximum fine
€15m or 3%
Breach
AI Office periodic penalties (Art. 75c)
Maximum fine
Up to 5% of average daily turnover per day
Large firms pay the higher figure. SMEs, start-ups and, since the Omnibus, small mid-caps pay the lower (Art. 99(6)–(6a)).
Who enforces
National market surveillance authorities (Art. 70) police most AI systems.
The EU AI Office supervises GPAI. It now also has exclusive competence over AI systems built on a provider's own GPAI model. The same applies to AI inside very large online platforms and search engines.
Enforcement so far
As of 17 June 2026, only 9 Member States had designated both required authorities; 6 had designated neither.
Germany named the Bundesnetzagentur as its authority from 29 July 2026.
No AI Act fines or formal investigations had been reported publicly as of October 2026. Expect early enforcement to be selective.
When do the remaining obligations take effect?
The Digital Omnibus, Regulation (EU) 2026/1744, is adopted law, in force since 27 July 2026. It also softened the literacy duty.
Adopted versus proposed
Adopted versus proposed
Item
Status
Item
Fixed high-risk dates: 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
Status
Adopted law (Omnibus)
Item
Commission's November 2025 plan to tie those dates to technical standards
Status
Proposal; according to the sources reviewed, the final law sets fixed dates instead
Item
AI medical devices: AI Act duties from 2 August 2028 through the existing notified-body assessment
Status
Adopted law
Item
Largely switching the Act off for medical devices
Status
Proposal, not law
Next milestones
2 December 2026. New bans on AI that generates non-consensual intimate imagery ("nudifiers") or child sexual abuse material (CSAM).
2 August 2027. GPAI models on the market before 2 August 2025 must comply.
2 December 2027 and 2 August 2028. Annex III (for example HR and credit), then Annex I high-risk obligations apply.
Standards are lagging. Harmonised standards give a "presumption of conformity": follow them and you are presumed compliant. By July 2026 only one, EN 18286:2026 on quality management, had been approved. Its Official Journal citation was still pending; the rest were still drafts.
Transition is not fully settled
Legacy high-risk systems. Those already on the market are reportedly caught only if substantially or significantly modified later. Sources word this differently, so confirm with counsel.
Public authorities. High-risk systems they use reportedly have until 2 August 2030; sources differ.
What is the AI Act, and who does it cover?
The AI Act, Regulation (EU) 2024/1689, is the world's first horizontal, risk-based AI law. "Horizontal" means it spans all sectors. Art. 2(1) follows your product and its outputs, not your headquarters.
Roles (Art. 3). Besides providers and deployers, importers, distributors and authorised representatives are covered.
Risk tiers
Prohibited (Art. 5). Examples include manipulative AI, social scoring, untargeted facial scraping, and emotion recognition at work or in education.
High-risk. AI in products under EU product-safety law, such as medical devices and machinery (Annex I). Also AI used in biometrics, critical infrastructure, education, employment, essential services (including credit scoring and life/health insurance pricing), law enforcement, migration and justice (Annex III).
Transparency (Art. 50). Chatbots, synthetic content and deepfakes.
Minimal risk. No specific duties.
GPAI models, such as large language models, follow a parallel track. AI literacy (Art. 4) applies to everyone.
Exclusions cover defence and national security, scientific R&D and personal use. Open-source releases are exempt unless high-risk, prohibited or covered by Art. 50.
Which dates matter?
Which dates matter?
Which dates matter?
Date
What happens
Date
1 Aug 2024
What happens
AI Act enters into force
Date
2 Feb 2025
What happens
Prohibitions and AI literacy apply
Date
2 Aug 2025
What happens
GPAI obligations, governance and penalties apply
Date
27 Jul 2026
What happens
Digital Omnibus (Reg. (EU) 2026/1744) in force; softened literacy duty
Date
2 Aug 2026
What happens
General application; Art. 50 transparency; Commission GPAI fining powers
Date
2 Dec 2026
What happens
Nudifier and CSAM bans; watermark grace period ends for generative systems already on the market
Date
2 Aug 2027
What happens
National sandboxes due (moved from 2026); older GPAI models must comply
Date
2 Dec 2027
What happens
Annex III high-risk obligations apply
Date
28 Jan 2028
What happens
Annex I Section A notified bodies must apply for designation
Date
2 Aug 2028
What happens
Annex I high-risk obligations apply (regulated products, incl. medical devices)
Date
2 Aug 2030
What happens
High-risk systems used by public authorities (reportedly; sources differ)