EU AI Act

What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689, the EU's horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies directly in all 27 Member States.

It borrows from EU product-safety law, with conformity checks and CE marking, and adds the protection of fundamental rights such as privacy and equality.

Risk attaches to the intended use, not the technology. The same face-analysis model can be banned in one setting, high-risk in another and lightly regulated in a third. Our lesson on the risk pyramid walks through the logic.

Who does the EU AI Act apply to?

The Act places duties on "operators" along the AI value chain (Art. 3). Duties follow what you do with a system, not what your contract says.

Scope is extraterritorial under Art. 2. It covers providers placing AI on the EU market wherever they are based. It also covers non-EU providers and deployers whose AI output is used in the EU.

Key exclusions: AI used only for military, defense or national security; AI developed only for scientific research; and purely personal, non-professional use.

Roles can flip under Art. 25. A deployer or distributor becomes the provider of a high-risk system if it rebrands it, substantially modifies it, or repurposes it into high-risk. See provider vs deployer for worked examples.

How does the risk-based approach work?

The Act sorts AI uses into four tiers, plus a separate track for general-purpose AI models.

There are two doors into high-risk. Door one is Art. 6(1): AI that is a safety component of a product, or is itself a product, under Annex I product laws. The product must also need third-party conformity assessment. Door two is Art. 6(2): AI used in one of the eight Annex III areas.

Those areas are biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, and justice and democratic processes.

There is one narrow way out. Under Art. 6(3), an Annex III system is not high-risk if it only does a narrow procedural or preparatory task posing no significant risk. A system that profiles people is always high-risk. More on the high-risk AI system page.

General-purpose AI (GPAI) models follow Chapter V (Arts. 51 to 56). Every GPAI provider must keep technical documentation, inform downstream providers, adopt a copyright policy and publish a training-content summary (Art. 53). Models with systemic risk, presumed above 10²⁵ FLOPs of training compute, add evaluations, adversarial testing, incident reporting and cybersecurity (Art. 55). See general-purpose AI model.

When does the EU AI Act apply?

The Act applies in stages. The 2026 Digital Omnibus moved the high-risk dates but left the early milestones alone. The Commission's AI Act Service Desk timeline shows the amended dates.

High-risk systems already on the market before their application date are caught only if significantly changed afterward. The exception is systems used by public authorities, which must comply by 2 Aug 2030. Our AI Act clock lesson drills these dates.

What are the main obligations?

Obligations depend on your role and the system's tier.

Providers of high-risk AI

• Meet the seven requirements in Arts. 9 to 15. They cover risk management, data governance, technical documentation, logging, instructions for use and human oversight. The seventh is accuracy, robustness and cybersecurity.
• Run a quality management system (Art. 17).
• Complete a conformity assessment (Art. 43), sign an EU declaration of conformity (Art. 47) and affix the CE marking (Art. 48).
• Register Annex III systems in the EU database before launch (Art. 49).
• Monitor the system after launch (Art. 72) and report serious incidents (Art. 73). The deadline is 15 days after awareness, or 10 days if a person dies. It is 2 days for a widespread infringement or serious critical-infrastructure disruption.

Deployers of high-risk AI

• Use the system according to the provider's instructions (Art. 26).
• Assign human oversight to trained people with the authority to intervene.
• Check that input data under their control is relevant and sufficiently representative.
• Keep automatically generated logs for at least six months.
• Inform workers before workplace use, and tell people when a high-risk system helps make decisions about them.
• Complete a fundamental rights impact assessment before first use if they are a public body or a private entity providing public services (Art. 27). The duty also covers credit scoring and life or health insurance pricing. A FRIA can now cross-reference a DPIA; see FRIA vs DPIA.

Importers and distributors

Importers (Art. 23) and distributors (Art. 24) verify that a high-risk system carries the CE marking, declaration of conformity and instructions. They must not supply a system they have reason to believe does not conform.

Everyone

AI literacy under Art. 4 applies to providers and deployers of all AI systems. Since the Omnibus, they must take measures to support their staff's AI literacy, rather than guarantee a set level.

What are the penalties?

Fines under Art. 99 scale with the rule broken.

For most companies, the cap is whichever amount is higher. For SMEs, including start-ups, it is whichever is lower (Art. 99(6)). The Omnibus added Art. 99(6a), which extends the lower-of rule to small mid-cap enterprises (SMCs) for the €15 million and €7.5 million tiers only.

Example: a company with €2 billion in turnover that uses a prohibited practice faces up to €140 million. That is 7% of turnover, which beats €35 million.

Who enforces the EU AI Act?

Enforcement runs on two levels: national authorities for most AI systems and the Commission for GPAI models.

• National market surveillance authorities police AI systems on their markets. Each Member State must designate at least one, plus a notifying authority that oversees notified bodies (Art. 70).
• The AI Office, part of the European Commission, supervises GPAI models. Since the Omnibus, amended Art. 75 also makes it exclusively competent for AI systems built on a provider's own GPAI model, with some exclusions. The same applies to AI in very large online platforms and search engines.
• The European AI Board, made up of Member State representatives, advises and coordinates. It does not fine anyone.
• The European Data Protection Supervisor acts as the market surveillance authority for EU institutions.

Anyone can complain to a market surveillance authority (Art. 85). People affected by significant decisions based on Annex III high-risk AI have a right to an explanation (Art. 86).

What changed with the 2026 Digital Omnibus?

The Digital Omnibus on AI is Regulation (EU) 2026/1744. The Commission proposed it on 19 November 2025. It was signed on 8 July 2026, published on 24 July 2026 and entered into force on 27 July 2026.

What changed:

• Fixed high-risk dates. Annex III moved to 2 Dec 2027 and Annex I to 2 Aug 2028. The proposal had tied them to standards being ready.
• Two new prohibitions from 2 Dec 2026. One covers AI that generates non-consensual intimate or sexual images, video or audio of an identifiable person. The other covers AI that generates child sexual abuse material.
• Marking grace period. Generative systems on the market before 2 Aug 2026 have until 2 Dec 2026 for Art. 50(2) marking (new Art. 111(4)).
• AI literacy and bias data. Softer Art. 4 wording, and a new Art. 4a legal basis to process special-category data for bias detection.
• Small mid-caps. SME simplifications and the lower-of fine rule extended to SMCs for the two lower tiers.
• FRIA and DPIA. A FRIA may cross-reference a DPIA (Art. 27(4)), and the AI Office will provide a questionnaire template.

What did not change: the original prohibitions, GPAI obligations, penalty tiers, the Art. 50 date and the Art. 73 incident deadlines.

How does the AIGP exam test the EU AI Act?

The exam leans on classification, roles, dates and fines.

• Classify by use. If a question describes the technology but not the purpose, pick the answer that asks what the system is for.
• Watch the role flip. Rebranding, substantially modifying or repurposing a system into high-risk makes you the provider.
• Mind the date version. BoK v2.1 was approved in September 2025, before the Omnibus. Check whether a question asks about the law as adopted or as amended.
• Don't swap fine tiers. Remember 35/7, 15/3 and 7.5/1. The GDPR's €20 million or 4% is a separate regime.
• FRIA is a deployer duty. Conformity assessment, CE marking and registration are provider duties.

Our AI Act in one-liners lesson maps each key article to a single sentence.

Change log

• 7 Nov 2026: Page published.