EU AI Act compliance
Know which AI Act obligations apply to you, and evidence them
The AI Act regulates AI by what it does, not by what it is called. Classify every system, meet the duties already in force, and prepare high-risk systems for 2 December 2027.
The basics
What is the EU AI Act?
The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is the European Union's horizontal law on AI. It applies to organisations that place AI systems on the EU market or use them in the EU, wherever those organisations are based.
It takes a risk-based approach. A small set of practices is prohibited outright. AI used in sensitive areas such as employment, credit, education or critical infrastructure is high-risk and must meet strict requirements. Systems that interact with people or generate content carry transparency duties, and providers of general-purpose AI models have their own obligations.
In 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high-risk deadlines back and narrowed the high-risk scope. The prohibitions, the general-purpose AI rules and the Article 50 transparency duties did not move.
Timeline
When each obligation applies
Status is calculated from today's date, so this table stays current.
| Applies from | Obligation | Reference | Status |
|---|---|---|---|
AI Act enters into force The regulation is published and the staggered application periods begin. | Art. 113 | In force | |
Prohibited practices Unacceptable-risk AI is banned, including social scoring, manipulative techniques and untargeted facial-image scraping. | Art. 5 | In force | |
General-purpose AI models Providers of general-purpose AI models must meet documentation, copyright and transparency duties. Fine-tuning can make you a provider. | Art. 51–56 | In force | |
Transparency obligations People must be told when they interact with AI, and synthetic audio, image, video and text must be marked. Applies regardless of risk class. | Art. 50 | In force | |
Content-marking grace period ends Systems already on the market must apply machine-readable marking to generated content. The disclosure duty itself applied from August. | Art. 50(2) | Upcoming | |
High-risk systems (Annex III) Risk management, data governance, technical documentation, human oversight and conformity assessment for stand-alone high-risk AI. | Art. 6–49, Annex III | Upcoming | |
High-risk AI in regulated products (Annex I) High-risk obligations for AI embedded in products covered by EU harmonisation legislation. | Art. 6(1), Annex I | Upcoming |
Risk classes
Four risk classes, plus rules for general-purpose AI
Classification depends on the use case and your role, not on the model. One system can carry more than one set of duties.
Prohibited
Art. 5Practices with unacceptable risk, such as social scoring, manipulative techniques that cause significant harm, untargeted scraping of facial images and emotion recognition at work or in education.
Must be withdrawn or never deployed.
2 February 2025
High-risk
Art. 6–49, Annex I and IIIAI used in Annex III areas, including recruitment and worker management, creditworthiness, education, essential services, biometrics and critical infrastructure, or as a safety component of regulated products.
Risk management, data governance, technical documentation, logging, human oversight, accuracy and conformity assessment.
2 December 2027 (Annex III) · 2 August 2028 (Annex I)
Transparency
Art. 50Systems that interact with people, generate synthetic audio, images, video or text, perform emotion recognition or create deep fakes, whatever their risk class.
Tell people they are dealing with AI, mark generated content in a machine-readable way, disclose deep fakes.
2 August 2026
Minimal risk
Art. 95 (voluntary codes)Everything else, such as spam filters, forecasting or recommendation features outside the sensitive areas.
No specific obligations. Good governance and AI literacy measures are still expected.
—
Provider or deployer
Your role decides your duties
Most organisations are deployers of some systems and providers of others. Fine-tuning, rebranding or changing a system's intended purpose can turn a deployer into a provider (Art. 25).
| Obligation | Provider | Deployer |
|---|---|---|
| Risk management system (high-risk) | Required | Use as instructed |
| Technical documentation and conformity assessment | Required | — |
| Human oversight | Design for it | Assign competent people |
| Logging and record-keeping | Enable logs | Keep logs |
| Fundamental rights impact assessment | — | Public bodies and certain private deployers |
| Tell people they are interacting with AI (Art. 50) | Required | — |
| Disclose deep fakes and emotion recognition (Art. 50) | — | Required |
Simplified overview. Obligations depend on the system and the context of use.
How AIMS helps
From scoping to evidence in one workspace
AIMS turns the Act into a workflow your teams can follow and an auditor can check.
Inventory and classification
Register every AI system, determine your role and classify it under Articles 5, 6 and 50.Requirements mapped to owners
Each obligation that applies becomes a tracked requirement with an owner, evidence and a due date.Impact assessments
Run fundamental rights impact assessments and AI impact assessments with the right stakeholders.Documentation and audit trail
Keep technical documentation, logs and decisions in one place, ready for a market surveillance authority or notified body.
EU AI Act FAQ
Does the EU AI Act apply to companies outside the EU?
Is our customer service chatbot high-risk?
What did the Digital Omnibus change?
Does using a model through an API make us a general-purpose AI provider?
What are the penalties?
Is ISO/IEC 42001 certification enough for the AI Act?
General information about the regulation, not legal advice. Obligations depend on your role and the systems you operate.
Find out where you stand in 30 minutes
Bring your AI use cases. We will classify them with you and show how AIMS tracks the obligations that apply.