The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI law, and its obligations no longer sit on the horizon — the general application date of 2 August 2026 has passed, which means the transparency duties, deployer obligations, and high-risk requirements now apply to most AI systems placed on or used in the EU market. If your organization deploys a customer-facing chatbot, embeds a third-party LLM into workflows, or uses AI in hiring, credit, or access decisions, the Act applies to you — and it applies extraterritorially, wherever the output is used in the EU.
The Act entered into force on 1 August 2024 with obligations phased in stages rather than a single deadline. Understanding which stage applies to which obligation is the first compliance task.
The Staged Timeline
- 2 February 2025 — prohibited practices (Article 5) and AI literacy obligations (Article 4) apply. Untargeted facial-image scraping, social scoring, manipulative techniques, and workplace emotion recognition are banned.
- 2 August 2025 — general-purpose AI (GPAI) model obligations, governance structures, and the penalty framework take effect.
- 2 August 2026 — general application: transparency duties (Article 50), high-risk rules for Annex III systems, deployer obligations, and the regulatory sandbox requirement now apply.
- 2 August 2027 — obligations extend to high-risk AI embedded in Annex I regulated products (machinery, toys, medical devices, and similar) and to certain legacy GPAI and public-sector systems.
Who Is in Scope: Providers and Deployers
The Act distinguishes providers (organizations that develop or substantially modify an AI system and place it on the market under their own name) from deployers (organizations that use an AI system under their own authority). Most businesses are deployers — but the line shifts: rebranding a third-party model, substantially modifying it, or repurposing a general-purpose system for a high-risk use can reclassify you as a provider, with the full compliance burden that carries.
Obligations also attach to importers, distributors, and authorized representatives, and the Act reaches non-EU companies whose AI output is used in the EU — the same extraterritorial logic as GDPR.
The Risk Tiers
Everything in the AI Act flows from a four-tier risk classification:
- Prohibited (Article 5): social scoring, manipulative or exploitative techniques, untargeted facial-recognition database building, emotion inference in workplaces and schools, and most real-time remote biometric identification in public spaces. These carry the maximum penalty tier.
- High-risk (Annex III): AI used in biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services, law enforcement, migration, and administration of justice. This is where compliance work concentrates: risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and robustness.
- Transparency-risk (Article 50): systems that interact with humans or generate synthetic content — chatbots, emotion-recognition systems, deepfakes, AI-generated text published on matters of public interest.
- Minimal-risk: everything else — spam filters, recommenders, most internal automation. No obligations, though codes of conduct are encouraged.
Article 50: The Transparency Duty Almost Everyone Missed
The most broadly applicable provision is Article 50. Since August 2026, AI systems that interact directly with people — customer support chatbots, voice agents, conversational assistants — must inform users they are interacting with AI, unless that is obvious from context. Generative AI outputs must be marked as artificially generated or manipulated in a machine-readable way where feasible; deepfakes require visible disclosure. Emotion-recognition and biometric-categorization systems must disclose their operation to the persons exposed.
For most companies this means a concrete, near-term task list: audit every customer-facing AI touchpoint for disclosure, verify your model providers mark generated content, and review publication workflows for AI-authored text on matters of public interest.
Deployer Duties Under Article 26
If you deploy a high-risk AI system — CV screening, biometric access control, AI triage in essential services — Article 26 imposes operational duties: use the system in accordance with its instructions, assign human oversight to competent staff, ensure input data is relevant and sufficiently representative for your use case, retain logs under your control for at least six months, inform workers before deploying in the workplace, and inform natural persons when the system contributes to decisions about them. Deployers of certain systems must also complete a fundamental rights impact assessment (FRIA) under Article 27 before use.
GPAI Models and the Foundation-Model Layer
Providers of general-purpose AI models — the foundation-model layer — face their own regime: technical documentation, a policy to comply with EU copyright law, and a sufficiently detailed summary of training content. Models with systemic risk (trainings above 10^25 FLOPs) carry additional duties: model evaluation, adversarial testing, incident reporting, and cybersecurity protections. Deployers do not inherit these obligations, but the documentation GPAI providers must publish is what you will rely on for your own risk classification and Art. 26 duties.
Penalties
- Up to EUR 35M or 7% of global turnover — prohibited practices.
- Up to EUR 15M or 3% — most other violations, including deployer and transparency breaches.
- Up to EUR 7.5M or 1% — supplying incorrect or misleading information to authorities.
GPAI fines sit in a separate regime administered by the Commission's AI Office, up to EUR 15M or 3%.
A Practical Compliance Sequence
- Inventory your AI systems. Include third-party models embedded in products and internal tools — shadow AI included.
- Classify each system. Prohibited? Annex III high-risk? Article 50 transparency-risk? Minimal? Document the reasoning.
- Fix transparency first. Chatbot disclosures and synthetic-content marking are cheap, fast, and already enforceable.
- Map deployer duties for high-risk systems. Oversight, logs, worker notification, FRIA where required.
- Build the management system. The Act rewards demonstrable governance — and ISO/IEC 42001 provides the certifiable scaffolding (risk processes, documentation, accountability) regulators and procurement teams increasingly expect.
Start With a Readiness Baseline
Our free ISO 42001 AI Readiness Assessment scores your AI governance posture across clauses 4–10 and the Annex A controls — in your browser, with a downloadable PDF report. The EU AI Act glossary entry and the ISO/IEC 42001 Annex A control list are useful references while you classify systems. If you deploy customer-facing AI, our AI agent development practice builds disclosure, logging, and oversight hooks in by design — or request a quote for a compliance review of your AI footprint.
Frequently Asked Questions
Does the AI Act apply to companies outside the EU?
Yes, where the AI system's output is used in the EU. A US or UK company whose chatbot serves EU customers, or whose screening tool evaluates EU candidates, is in scope under the same extraterritorial logic as GDPR.
Do we have to disclose that customers are talking to a chatbot?
Yes — Article 50 has applied since 2 August 2026. AI systems interacting directly with natural persons must inform them they are interacting with AI, unless obvious from context. A short, conspicuous notice at the start of the interaction satisfies it.
Is using a third-party LLM enough to make us a provider?
Usually not — calling a model API as a deployer stays a deployer role. You become a provider if you place an AI system on the market under your own name, substantially modify a GPAI model, or repurpose a general system into a high-risk use case.
Does ISO/IEC 42001 certification equal AI Act compliance?
No — certification is evidence of governance maturity, not a legal safe harbor. But an AIMS gives you the inventory, risk process, and documentation machinery the Act assumes you have, and harmonized standards (still being finalized) will provide presumption-of-conformity routes once published.
What is the deadline most companies actually face?
It already passed: 2 August 2026 brought transparency duties, deployer obligations, and Annex III high-risk rules into force. The remaining milestone is 2 August 2027 for AI embedded in regulated products. Compliance now is catch-up, not preparation.
