The EU AI ActEverything enterprises
need to know.
The world's first comprehensive AI law is now enforceable. High-risk AI system requirements apply from August 2, 2026. Penalties reach €35 million or 7% of global annual turnover. This is your complete guide.
What is the EU AI Act?
The EU AI Act (Regulation 2024/1689) is the world's first binding comprehensive legal framework for artificial intelligence, published in the Official Journal of the European Union on July 12, 2024, and in force since August 1, 2024. It applies to any organization that develops, deploys, imports, or distributes AI systems that affect people in the European Union, regardless of where the organization is headquartered. The Act takes a risk-based approach: obligations are proportionate to the potential harm an AI system can cause.
Extraterritorial reach
Applies to any organization whose AI systems affect EU residents, regardless of headquarters. US, UK, and APAC companies serving EU markets are in scope.
Risk-tiered obligations
Four risk categories determine your obligations: unacceptable (banned), high risk (strict requirements), limited (transparency), minimal (none).
Staged enforcement
Obligations came into force on different dates. The most consequential high-risk requirements apply from August 2, 2026.
The Four Risk Tiers
Your obligations depend entirely on which tier your AI systems fall into.
AI practices posing unacceptable risk are prohibited outright, social scoring, real-time biometric surveillance in public spaces, manipulation of vulnerable groups, emotion recognition in workplaces and schools.
AI in healthcare, employment, credit, insurance, education, law enforcement, and critical infrastructure faces the most extensive obligations, risk management, documentation, logging, human oversight, and conformity assessment.
AI systems that interact with humans must disclose their AI nature. Chatbots, deepfakes, and AI-generated content face transparency obligations.
Spam filters, AI in video games, and most recommendation systems have no mandatory obligations. Voluntary codes of conduct apply.
Critical Deadlines
Regulation 2024/1689 becomes law across all 27 member states.
Unacceptable-risk practices banned; AI literacy duties begin.
General-purpose AI model rules, governance bodies, and penalties take effect.
Full obligations for Annex III high-risk AI systems and transparency rules.
High-risk AI in regulated products (Annex I) must comply.
Who Does the EU AI Act Apply To?
AI Providers
Organizations that develop an AI system or place it on the market under their own name. Providers of high-risk AI carry the heaviest load: risk management, technical documentation, conformity assessment, CE marking, and EU database registration.
AI Deployers
Organizations using AI systems in a professional capacity. Deployers of high-risk AI must follow instructions for use, assign human oversight, monitor operation, keep logs, and, in many cases, complete a Fundamental Rights Impact Assessment.
Importers and Distributors
Entities bringing non-EU AI systems into the EU market or making them available. They must verify conformity, CE marking, and documentation before placing systems on the market, and act on non-compliance.
GPAI Providers
Developers of general-purpose AI models must publish training data summaries, maintain technical documentation, and respect EU copyright law. Models with systemic risk face evaluations, incident reporting, and cybersecurity duties.
See how these roles play out in your industry, or get answers in the FAQ.
Track every regulatory milestone in one place with the EU AI Act Deadline Tracker.
Know where your AI systems stand before August 2026.
The 2-minute readiness assessment maps your AI deployments to the EU AI Act's risk tiers and shows where your compliance gaps are.