The EU AI Act is the world's first comprehensive law governing artificial intelligence. It became legally binding on August 1, 2024, and classifies AI systems by risk level, from banned systems to minimal-risk tools, with obligations that scale with the risk. If you deploy AI to EU users, build AI products, or use AI APIs in your business, the EU AI Act applies to you.
This guide explains what the law requires, who it covers, and what the key deadlines are, without the legal jargon.
TL;DR: The EU AI Act is the world's first comprehensive AI law. It classifies AI systems into four risk tiers: unacceptable risk (banned), high risk (heavily regulated), limited risk (disclosure required), and minimal risk (no obligations). If you deploy AI in hiring, credit scoring, biometric identification, medical devices, or critical infrastructure, you are in the high-risk tier. High-risk systems require a conformity assessment, registration in the EU database, and human oversight before deployment. The law applies to any company targeting EU users, including US companies.
What the EU AI Act Is
The EU AI Act (Regulation 2024/1689) is a regulation passed by the European Parliament and Council. Unlike a directive, it applies directly in all EU member states without needing national implementation legislation.
Its core logic: the higher the risk an AI system poses to people's rights, safety, or health, the more it is regulated.
The law covers AI systems, software that can generate outputs (predictions, recommendations, decisions, content) for a given set of objectives. It does not cover AI research, national security AI, or AI used solely for military or defense purposes.
The Four Risk Tiers
Tier 1: Unacceptable Risk (Banned)
These AI systems are prohibited outright in the EU:
- Social scoring by governments or public authorities, assigning scores to citizens based on behavior, social status, or personal characteristics
- Real-time biometric identification in public spaces for law enforcement (with narrow exceptions)
- Emotion recognition in workplaces and educational institutions
- AI that exploits vulnerabilities of people based on age, disability, or social or economic situation
- Biometric categorization based on sensitive attributes (race, religion, political opinion, sexual orientation)
- Predictive policing based on profiling or personality traits rather than objective factual data
If your AI system does any of these, it cannot operate in the EU. This prohibition applied from February 2, 2025.
Tier 2: High Risk (Heavily Regulated)
High-risk AI systems can operate, but only after meeting significant requirements before deployment. The law defines high-risk AI in two ways:
AI safety components of regulated products (the first pathway) covers AI embedded in products already subject to EU safety regulation: machinery, medical devices, vehicles, aviation, toys, elevators, and others. Under Article 6(1), the AI is high-risk when it is the product or its safety component and the product needs a third-party conformity assessment. These rules apply from August 2, 2028.
AI systems in Annex III domains (the second pathway) covers eight sectors where AI decisions significantly affect individuals:
- Critical infrastructure (energy, water, transport, digital infrastructure)
- Education (admissions, assessment, evaluation of learners)
- Employment and HR (recruitment, screening, performance evaluation, promotion, task allocation)
- Essential services (credit scoring, life and health insurance, emergency services)
- Law enforcement (risk assessment, polygraphs, crime analytics, evidence assessment)
- Migration and asylum (risk assessment, verification of documents, examination of applications)
- Administration of justice (legal research, dispute resolution)
- Democratic processes (influencing elections)
If your AI system substantially influences decisions in these domains, it is high-risk.
High-risk systems must do all of the following:
- Implement a risk management system and maintain it throughout the lifecycle
- Conduct data governance, document training data, test for bias
- Produce technical documentation before deployment
- Maintain an event log for traceability
- Ensure transparency, inform deployers what the system does and its limitations
- Implement human oversight mechanisms
- Achieve accuracy, robustness, and cybersecurity standards
- Register in the EU AI database before deployment
- Undergo a conformity assessment (self-assessment for most, third-party for biometric systems)
The full high-risk requirements apply from December 2, 2027 for Annex III systems and from August 2, 2028 for AI in Annex I products such as medical devices. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since July 27, 2026, moved them from August 2, 2026 and August 2, 2027.
Tier 3: Limited Risk (Disclosure Required)
AI systems with specific transparency risks. The primary example: chatbots and AI-generated content.
- AI systems that interact with humans must disclose they are AI (unless obvious from context)
- Deepfake images, video or audio must be disclosed as AI-generated, and so must AI-generated text published to inform the public on matters of public interest
- Emotion recognition systems must disclose their use to those affected
Basic chatbot disclosure and the other Article 50 duties apply from August 2, 2026. The EU Digital Omnibus gave generative systems already on the market before that date until December 2, 2026 for machine-readable marking (Article 50(2)), and its new nudification ban applies from December 2, 2026.
Tier 4: Minimal Risk (No Obligations)
The vast majority of AI systems: spam filters, AI in video games, AI-powered recommendation systems (Netflix, Spotify), AI writing assistants used for personal productivity, AI grammar checkers. These have no mandatory obligations under the EU AI Act.
Providers of minimal-risk systems may voluntarily adopt a code of conduct. No enforcement mechanism applies.
General-Purpose AI Models (GPAI)
The EU AI Act creates a separate category for foundation models, AI models trained on large datasets that can perform many tasks: GPT-4, Claude, Gemini, Llama, Mistral, and similar.
All GPAI providers must:
- Maintain technical documentation
- Comply with EU copyright law for training data
- Publish a detailed summary of training data
- Implement a policy for respecting copyright opt-outs
GPAI models with systemic risk: defined as those trained with more than 10²⁵ floating-point operations (roughly the scale of GPT-4 and above), must additionally:
- Conduct adversarial testing (red-teaming)
- Report serious incidents to the European AI Office
- Ensure cybersecurity protections
- Report on energy consumption
GPAI model rules applied from August 2, 2025.
Who Enforces the EU AI Act
European AI Office, oversees GPAI models and the consistent application of the regulation across member states. Created in early 2024 within the European Commission.
National competent authorities, each EU member state designates one or more authorities to supervise the AI Act at the national level. Germany has designated the Federal Network Agency; France has CNIL and ANSSI jointly; the UK has the AI Safety Institute (though the UK is not subject to the EU AI Act post-Brexit).
Penalties:
- Unacceptable risk violations: up to €35 million or 7% of global annual turnover
- High-risk system violations: up to €15 million or 3% of global annual turnover
- Providing incorrect information to authorities: up to €7.5 million or 1% of global annual turnover
For SMEs and startups, fines are calculated on the lower of the fixed amount or the percentage of turnover.
Key Dates at a Glance
| Date | What Applies |
|---|---|
| August 1, 2024 | Law enters into force |
| February 2, 2025 | Prohibited AI systems must comply |
| August 2, 2025 | GPAI model rules apply |
| August 2, 2026 | GPAI enforcement powers activate; transparency duties (chatbot disclosure, deepfake disclosure, AI watermarking under Article 50) |
| December 2, 2026 | Watermarking deadline for generative systems already on the market before August 2, 2026; nudification ban (new from EU Digital Omnibus) |
| December 2, 2027 | Annex III high-risk AI system requirements (extended from August 2, 2026) |
| August 2, 2028 | High-risk AI in Annex I regulated products (products already under EU safety law) |
What This Means for Small Teams
Most small teams are not affected by the high-risk tier. If you use AI for internal productivity (writing, summarizing, coding), customer support chatbots, or content generation, you are in the minimal-risk or limited-risk tier. Your primary obligation is disclosure: tell users when they are talking to AI.
You are in the high-risk tier if your product screens or ranks job applicants, scores creditworthiness, prices or assesses risk for life or health insurance, makes decisions about access to essential public services, evaluates students for admission or assessment, or processes biometric data for identification. If that describes your AI system, December 2, 2027 is your compliance deadline. As the provider you need a conformity assessment, a risk management system, technical documentation, and an EU AI database registration before placing it on the EU market.
The GPAI rules apply if you are developing a foundation model, training on large datasets to produce a general-purpose model. Startup teams building fine-tuned models on top of foundation models are generally not GPAI providers. A team that places its product on the market under its own name is the provider of that AI system (Article 3(3)), so if the product is used in a high-risk area, the provider duties are its own; a team that only uses the tool internally is a deployer.
Transparency rules apply regardless of risk tier if you run a customer-facing chatbot. The chatbot must disclose it is an AI system unless that's obvious. This is already standard practice, and the disclosure requirement applies from August 2, 2026.
Correction (October 13, 2026): An earlier version said chatbot disclosure applies from December 2, 2027 and that all AI watermarking starts December 2, 2026. Article 50 applies from August 2, 2026; only systems already on the market before then get until December 2, 2026 for watermarking.
Correction (October 17, 2026): An earlier version listed all insurance risk as high-risk and left biometrics out of the eight Annex III areas. Annex III point 5(c) covers only life and health insurance, and point 1 covers biometrics (consolidated AI Act).
Correction (October 19, 2026): An earlier version said startups selling a product built on a fine-tuned model are deployers. Under Article 3(3) a company that places an AI system on the market under its own name is its provider; deployers are those using a system under their authority (Article 3(4)) (consolidated AI Act).
Correction (October 23, 2026): An earlier version put medical AI under the December 2, 2027 high-risk date and said Annex I products follow product safety timelines. AI in medical devices is high-risk through Article 6(1) and Annex I when the device needs a third-party conformity assessment, and those rules apply from August 2, 2028 (consolidated AI Act, Article 113).
How the EU AI Act Differs from GDPR
GDPR regulates how you handle personal data. The EU AI Act regulates how you build and deploy AI systems. They overlap but are not the same law.
GDPR still applies when your AI processes personal data, which most AI systems do. The EU AI Act adds requirements on top, not instead of, GDPR. A high-risk AI system that processes personal data must comply with both.
The biggest practical difference: GDPR is about data rights (consent, access, deletion). The EU AI Act is about system design (risk assessment, human oversight, documentation). You need both.
Next Steps
If you are trying to assess whether your AI system is high-risk, work through the EU AI Act Annex III High-Risk Checklist, it maps each of the eight Annex III domains to specific system types.
For a full compliance roadmap for small teams, see the EU AI Act Compliance Guide for Small Teams, which covers the complete requirements in deployment order.
If you build on top of a GPAI model (OpenAI, Anthropic, Google), see the EU AI Act August 2026 compliance checklist for a breakdown of GPAI provider obligations and what deployers inherit.
