EU AI Act: Complete Guide to Rules, Deadlines and Compliance

by David Porter

Monday, 10 August 2026 at 11:11

thumbnail_eu-ai-act-complete-guide-to-ru

The EU AI Act is the European Union’s cross-sector rulebook for artificial intelligence. It regulates particular AI practices, systems and general-purpose AI models according to what they do, where they are used and which actor controls them. The law can prohibit a use entirely, impose product-style requirements on a high-risk system, require transparency around a chatbot or deepfake, regulate a general-purpose model at model level, or leave a low-risk application largely outside mandatory controls.

The Act entered into force on August 1, 2024 and became generally applicable on August 2, 2026. That does not mean every provision started on the same date. Prohibited practices and AI-literacy duties began applying in February 2025. General-purpose AI model obligations began in August 2025. Article 50 transparency duties took effect in August 2026. The 2026 Digital Omnibus on AI then moved the main high-risk system requirements to December 2027 for Annex III use cases and August 2028 for AI embedded in regulated products.

This staggered structure is why a one-line summary such as “the AI Act started in 2026” is misleading. An organization may already have enforceable duties under Article 4 or Article 50 while preparing for high-risk requirements that will apply later. A company can also occupy several legal roles at once: deployer of a workplace assistant, provider of a branded customer tool, and downstream modifier of a general-purpose model.

For the date-by-date sequence, use our EU AI Act timeline. For a practical implementation route, go directly to the EU AI Act compliance checklist.

EU AI Act at a glance

Question	Short answer
What is the EU AI Act?	Regulation (EU) 2024/1689, as amended, establishing harmonized rules for AI across the EU
When did it become applicable?	Most provisions became applicable on August 2, 2026, but several duties started earlier and high-risk rules have later dates
Who can be covered?	Providers, deployers, importers, distributors, product manufacturers, authorized representatives, GPAI model providers and certain non-EU actors
Does it apply outside Europe?	Yes, in defined circumstances, including when a non-EU provider places AI on the EU market or an AI system’s output is used in the EU
What are the main regulatory layers?	Prohibited practices, high-risk systems, Article 50 transparency, GPAI model rules, AI literacy and voluntary measures for lower-risk systems
Are all generative AI tools high-risk?	No. Generative capability alone does not make an AI system high-risk, although GPAI and transparency obligations may apply
What is Article 4?	A duty for providers and deployers to take measures supporting AI literacy among relevant staff and other persons acting on their behalf
When do high-risk rules apply?	December 2, 2027 for Annex III systems and August 2, 2028 for Annex I product-related systems
What are the highest fines?	Up to €35 million or 7% of worldwide annual turnover for the most serious categories, subject to the Act’s penalty rules
Is compliance a one-time exercise?	No. Classification, documentation, monitoring, incidents, changes and vendor relationships require ongoing governance

What does the EU AI Act regulate?

The Act does not regulate “AI” as one undifferentiated technology. It creates several connected legal regimes.

Prohibited AI practices

Article 5 bans uses considered incompatible with EU values and fundamental rights. The original prohibitions include harmful manipulation, exploitation of vulnerabilities, certain social scoring, particular criminal-risk prediction, untargeted facial-image scraping, workplace and education emotion recognition, sensitive biometric categorization and most real-time remote biometric identification by law enforcement in public spaces.

The 2026 amendment added prohibitions addressing AI systems that generate or manipulate non-consensual intimate material and child sexual abuse material. Those new rules apply from December 2, 2026. Our guide to prohibited AI practices separates each ban from its conditions and exceptions.

High-risk AI systems

High-risk systems are permitted, but they face extensive requirements. There are two principal routes:

Annex I/product route: the AI is a safety component of, or is itself, a product covered by specified EU product-safety legislation and the product requires third-party conformity assessment.
Annex III/use-case route: the intended use falls within listed sensitive areas such as biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration or justice.

The system’s intended purpose matters. The same underlying model can support a low-risk writing assistant and a high-risk recruitment-ranking system. Detailed classification belongs in our guide to high-risk AI systems.

Transparency duties for particular AI systems

Article 50 covers situations in which people may mistake AI for a person or synthetic content for authentic material. Depending on role and use, it can require:

notice that a person is interacting directly with AI;
machine-readable marking of AI-generated or manipulated content;
disclosure of emotion-recognition or biometric-categorization use;
labeling of deepfakes;
and disclosure for certain AI-generated text on matters of public interest.

The rules are more specific than “label everything made with AI.” Human review, editorial responsibility, obviousness, artistic context and other conditions matter. See our Article 50 transparency guide.

General-purpose AI model obligations

Chapter V regulates providers of general-purpose AI models, or GPAI models, separately from the AI systems that use them. Baseline obligations include technical documentation, information for downstream providers, an EU copyright-compliance policy and a public summary of training content. Providers of GPAI models with systemic risk face additional evaluation, risk-management, incident-reporting and cybersecurity duties.

A company can therefore comply at two levels. A model provider may have Chapter V obligations, while the provider of a chatbot built on that model may have separate system-level duties. Our GPAI guide explains the distinction.

AI literacy

Article 4 applies broadly to providers and deployers of AI systems. Following the 2026 amendment, organizations must take measures to support the development of AI literacy among relevant staff and other people operating or using AI on their behalf. The provision no longer mandates any specific or “sufficient” level for each individual.

That does not make Article 4 optional. It makes the approach contextual. A copywriter using a generative assistant needs different guidance from an engineer validating a model or an employee overseeing a high-risk decision system. The practical requirements, records and training design are covered in our Article 4 guide.

Is a piece of software an “AI system” under the Act?

Classification begins with Article 3’s definition. An AI system is a machine-based system designed to operate with varying levels of autonomy, potentially adaptive after deployment, that infers from inputs how to generate outputs such as predictions, content, recommendations or decisions capable of influencing physical or virtual environments.

Several elements matter:

it is machine-based;
it has an explicit or implicit objective;
it has some operational autonomy;
it infers how to generate outputs from inputs;
and the output can influence an environment.

Not every spreadsheet formula, deterministic workflow or ordinary database automatically becomes an AI system. The Commission’s guidelines on the AI system definition are non-binding but useful when drawing the boundary.

A compliance inventory should record the relevant evidence rather than attaching the label “AI” because a vendor uses it in marketing. Document the system’s intended purpose, architecture, autonomy, outputs, users and operational context. If a product contains multiple components, classify the relevant system and use case rather than the brand as a whole.

Who is covered by the EU AI Act?

Article 2 gives the law substantial territorial reach. It can apply to:

providers placing AI systems or GPAI models on the EU market, wherever the provider is established;
deployers established or located in the EU;
non-EU providers and deployers when an AI system’s output is used in the EU;
importers and distributors;
product manufacturers placing a product and AI system on the market under their name or trademark;
authorized representatives of non-EU providers;
and affected persons located in the EU.

Important exclusions include purely personal non-professional use, certain pre-market research and development, systems or models developed solely for scientific research, and military, defense or national-security uses. These exclusions are not blanket exemptions from every other law. GDPR, employment law, consumer protection, intellectual-property rules, sectoral regulation and contractual duties may still apply.

Open-source status is also not a universal escape route. The Act contains particular treatment for free and open-source software and GPAI models, but prohibited practices, high-risk uses, transparency duties and systemic-risk obligations can still be relevant.

Provider, deployer and other legal roles

The Act assigns obligations according to role. The two most common are:

Provider: develops an AI system or GPAI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark.
Deployer: uses an AI system under its authority, other than in a purely personal non-professional activity.

Other roles include importer, distributor, product manufacturer and authorized representative. A company’s role can change. Rebranding a high-risk system, making a substantial modification or changing the intended purpose so the system becomes high-risk can cause another actor to assume provider responsibilities.

This is why “we only use a third-party API” is not a complete role analysis. A business may remain a deployer when it uses a vendor’s finished assistant internally. It may become a provider when it launches a customer-facing product under its own brand, materially modifies the system or defines a new high-risk intended purpose. Use our full guide to providers, deployers and other operators before allocating controls.

The four risk categories—and why they are only a starting point

The Commission often explains the AI Act using four levels:

unacceptable risk;
high risk;
transparency risk;
minimal or no risk.

This is a useful communication model, but compliance is not a simple ladder in which every system enters exactly one box. A generative assistant may be minimal-risk in its use case, subject to Article 50 as an interactive system, and based on a GPAI model whose provider has Chapter V duties. A high-risk system may also use a GPAI model and process personal data under GDPR.

A better classification sequence is:

Is the tool within territorial and material scope?
Does it meet the definition of an AI system or GPAI model?
Does Article 5 prohibit the practice?
Does Article 6 make the system high-risk under Annex I or Annex III?
Does Article 50 create transparency duties?
Is a GPAI model being placed on the market or materially modified?
Which actor is provider, deployer, importer, distributor or manufacturer?
Which other EU or national laws apply?

Our dedicated guide to EU AI Act risk categories provides a reusable decision tree and inventory fields.

What high-risk systems must eventually do

The core system requirements in Articles 8 to 15 include:

a continuous risk-management system;
data and data-governance controls where training, validation or testing datasets are used;
technical documentation;
automatic record-keeping and logs;
transparency and instructions for deployers;
effective human oversight;
and appropriate accuracy, robustness and cybersecurity.

Providers also face obligations around quality management, documentation retention, conformity assessment, registration, corrective action, post-market monitoring and serious-incident reporting. Importers and distributors perform supply-chain checks. Deployers must use systems according to instructions, assign competent human oversight, monitor operation, retain logs under their control and act when risks or incidents emerge.

Some deployers must conduct a fundamental rights impact assessment before first use. This applies to certain public bodies, private entities providing public services and specified essential-service use cases. It complements, rather than automatically replaces, a GDPR data-protection impact assessment.

The main requirements do not apply to every high-risk route on August 2, 2026. The Digital Omnibus moved:

Annex III high-risk requirements to December 2, 2027;
Annex I product-related high-risk requirements to August 2, 2028.

Those later dates are preparation time, not a reason to postpone inventory work. Data architecture, contracts, logging and quality-management systems can take longer to build than the legal transition period.

What Article 50 requires now

Article 50 has applied since August 2, 2026. It separates provider and deployer duties.

Provider obligations

Providers of direct-interaction AI systems must design them so people are informed that they are interacting with AI, unless this is obvious to a reasonably well-informed, observant and circumspect person in the circumstances.

Providers of AI systems that generate synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, subject to the Act’s technical and contextual conditions.

Systems placed on the market before August 2, 2026 received a narrow transition for Article 50(2) marking: providers must take the necessary steps by December 2, 2026. It is not a general grace period for all transparency obligations.

Deployer obligations

Deployers must provide disclosures in specified situations involving emotion recognition, biometric categorization, deepfakes and certain AI-generated public-interest text. The form must be clear and timely, with special treatment for artistic, satirical, fictional and analogous works.

The Commission’s final Article 50 guidelines and voluntary Code of Practice on Transparency of AI-generated Content help organizations demonstrate compliance. The legal duty still exists even when an organization does not sign the code.

What GPAI model providers must do

The GPAI obligations began applying on August 2, 2025 for models placed on the market from that date. Models already on the market before August 2, 2025 have until August 2, 2027 to comply.

Providers of GPAI models generally need to:

prepare and maintain technical documentation;
provide information and documentation to downstream AI-system providers;
implement a policy to comply with EU copyright law;
publish a sufficiently detailed summary of content used to train the model;
appoint an authorized representative when required;
and cooperate with the Commission and AI Office.

Providers of GPAI models with systemic risk must additionally perform model evaluations, adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting and cybersecurity protection.

The systemic-risk regime uses a rebuttable computational threshold and also allows Commission designation based on capabilities and impact. It is not accurate to assume that only one numerical training-compute value can ever bring a model into scope.

The voluntary GPAI Code of Practice has transparency, copyright, and safety and security chapters. Signing can provide a structured way to demonstrate compliance, but the statutory obligations come from the Act.

What Article 4 requires from ordinary organizations

Article 4 is one of the broadest provisions because it can apply even when an organization only uses common AI tools. The amended text requires providers and deployers to take measures to support the development of AI literacy among staff and other people dealing with the operation and use of AI systems on their behalf.

The Commission’s official Q&A makes several points clear:

no specific level of literacy must be guaranteed for every individual;
no certificate is required;
no fixed course length or format is prescribed;
no dedicated AI officer or governance board is mandated solely by Article 4;
internal records of training and guidance can document the measures taken;
and the program should reflect role, existing knowledge, system risk, context and affected people.

A workable program normally begins with an inventory. Staff cannot be trained for the systems and risks the organization has not identified. Common modules cover acceptable use, confidential data, personal data, hallucinations, output verification, bias, intellectual property, escalation and incident reporting. Role-specific modules then address procurement, development, human oversight or high-risk operation.

EU AI Act deadlines that matter

Date	What happened or becomes applicable
August 1, 2024	AI Act entered into force
February 2, 2025	Original prohibited practices and Article 4 AI-literacy duties began applying
August 2, 2025	GPAI model obligations and key governance provisions began applying
July 27, 2026	Digital Omnibus on AI entered into force
August 2, 2026	Most remaining provisions and Article 50 transparency duties became applicable; enforcement powers expanded
December 2, 2026	New prohibitions for non-consensual intimate material and child sexual abuse material apply; legacy Article 50(2) marking transition ends
August 2, 2027	Pre-August 2025 GPAI models must comply; national AI regulatory sandboxes must be operational
December 2, 2027	Main requirements for Annex III high-risk systems apply
August 2, 2028	Main requirements for Annex I product-related high-risk systems apply
August 2, 2030	Special transition ends for certain high-risk systems used by public authorities

These are headline dates. A contract, sectoral law, authority designation, standard, guideline or system change can create a different operational date. The full AI Act timeline explains legacy systems and transition rules.

Enforcement and fines

Most AI-system rules are enforced through national competent authorities and market-surveillance authorities. The European Commission and AI Office supervise GPAI model obligations and, following the 2026 amendment, have expanded competence for particular AI systems connected to GPAI providers and very large online platforms or search engines. The European Data Protection Supervisor supervises AI used by EU institutions within its remit.

The Act provides rights to lodge complaints and protections for people reporting infringements. Enforcement is not limited to fines. Authorities can request information, investigate, order corrective action, restrict or withdraw systems and use other national measures.

Headline administrative-fine ceilings include:

up to €35 million or 7% of worldwide annual turnover for prohibited practices and specified serious infringements;
up to €15 million or 3% for other obligations;
up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information in defined circumstances;
and up to 3% of worldwide annual turnover for GPAI-provider infringements under Article 101.

The applicable ceiling depends on the infringement and the size of the organization. SMEs and, after the Digital Omnibus, small mid-cap enterprises receive proportionality treatment in specified penalty calculations. Maximum figures are not automatic invoices. Authorities consider factors such as nature, gravity, duration, intent, mitigation, cooperation, affected people and prior infringements.

How the AI Act interacts with GDPR and other laws

The AI Act does not replace existing law.

GDPR and data protection

An AI system can comply with the AI Act and still violate GDPR. Personal-data processing needs a lawful basis, purpose limitation, data minimization, transparency, security and respect for data-subject rights. High-risk-system documentation does not automatically satisfy a data-protection impact assessment.

Employment and labor law

AI used in hiring, task allocation, performance monitoring or dismissal may fall within Annex III and also trigger national employment law, anti-discrimination rules, consultation requirements and collective agreements.

Product safety and sectoral regulation

Medical devices, machinery, vehicles, aviation and other regulated products remain subject to their existing frameworks. Annex I integrates AI requirements with product conformity assessment rather than replacing sectoral rules.

Digital Services Act and consumer law

Online platforms may have overlapping duties under the Digital Services Act. Consumer-protection law can address deceptive design, unfair commercial practices or unsafe products even when an AI system is not high-risk.

Copyright and trade secrets

GPAI providers have a specific copyright-policy obligation, while deployers and system providers still need licenses, usage rights and controls for inputs and outputs. Documentation-sharing duties also need to be balanced with trade-secret protections available in the Act.

A practical compliance workflow

1. Establish scope and ownership

Name a business owner for the program and involve legal, security, privacy, procurement, HR, product and operational teams. The owner coordinates evidence; specialists remain responsible for their domains.

2. Build an AI inventory

Record purchased tools, APIs, embedded features, internal models, automated decisions, pilot projects and employee-created workflows. Include shadow AI discovered through expense data, browser extensions, identity logs and surveys.

3. Define intended purpose and context

Describe what the system is supposed to do, who uses it, who is affected, what decisions it influences, which data it processes and whether a human can override it.

4. Assign legal roles

Determine provider, deployer, importer, distributor, product manufacturer, authorized representative and GPAI-model-provider status. Reassess after rebranding, fine-tuning, integration or changes to intended purpose.

5. Test prohibited-practice exposure

Do this before high-risk classification. A prohibited use cannot be made lawful merely by adding documentation or human review.

6. Classify high-risk and transparency obligations

Evaluate Annex I, Annex III and Article 6 exceptions. Then evaluate Article 50 separately. Record the reasoning, evidence and decision owner.

7. Identify GPAI dependencies

Record model provider, model version, deployment route, documentation received, licensing, modification and whether the organization may itself be placing a modified model on the market.

8. Implement Article 4 measures

Provide baseline and role-specific literacy measures. Keep attendance, materials, dates, target groups and update decisions.

9. Create controls and evidence

Controls may include access restrictions, data-loss prevention, output review, labeling, logging, model evaluation, human oversight, vendor due diligence, incident handling and change management.

10. Contract the value chain

Require suppliers to provide the information, instructions, logs, technical access and cooperation needed for your role. Allocate duties for updates, incidents, regulator requests, documentation and model changes.

11. Prepare for incidents and complaints

Define what counts as a serious incident, prohibited use, transparency failure, harmful output or rights complaint. Create escalation paths and preserve evidence.

12. Monitor legal and technical change

Track Commission guidance, harmonized standards, common specifications, national authority decisions and system updates. A classification can change when intended purpose, model, data or deployment context changes.

Common EU AI Act misconceptions

“The AI Act only applies to AI companies”

False. An employer, bank, school, hospital, public authority or retailer can be a deployer. An ordinary company can also become a provider by branding or materially modifying a system.

“Every chatbot is high-risk”

False. A chatbot may be subject to Article 50 and Article 4 without being high-risk. Context and intended purpose decide high-risk status.

“All high-risk rules already apply”

False. The main Chapter III requirements were moved to late 2027 and 2028, depending on the classification route.

“Article 4 requires a certified course”

False. The amended Article 4 does not prescribe a certificate, fixed duration or specific literacy level. It does require measures appropriate to the people, systems, risks and context.

“Putting a visible AI label on every output solves Article 50”

False. Article 50 contains different provider and deployer duties. Machine-readable marking, direct-interaction notice and visible disclosure are not interchangeable.

“Using an open-source model means the AI Act does not apply”

False. Some open-source exemptions exist, but they are conditional and do not remove all prohibited-practice, high-risk, transparency or systemic-risk obligations.

“The highest fine is what every violation costs”

False. The figures are maximum ceilings. Actual enforcement is case-specific and can involve non-monetary measures.

Frequently asked questions

Is the EU AI Act already in force?

Yes. It entered into force on August 1, 2024 and became generally applicable on August 2, 2026, with earlier and later dates for specific provisions.

Does the EU AI Act apply to UK or US companies?

It can. A non-EU company may be covered when it places an AI system or GPAI model on the EU market or when the output of its AI system is used in the EU, among other conditions.

Does the AI Act apply to ChatGPT use at work?

Article 4 can apply to the organization as a deployer, and Article 50 or other rules may apply depending on the use. Internal use of a general writing assistant is not automatically high-risk.

Is generative AI banned in Europe?

No. The Act permits generative AI but imposes model-level, transparency and use-specific obligations. Particular practices can be prohibited.

What is the difference between a GPAI model and an AI system?

A GPAI model is a broadly capable model that can be integrated into many systems. An AI system uses a model or other techniques to generate outputs in a specific operational context. The Act regulates both, through different chapters.

Who is responsible when a company buys an AI tool?

The vendor may be the provider and the customer the deployer, but roles depend on facts. Rebranding, substantial modification or a changed intended purpose can shift provider obligations.

Are recommendation systems high-risk?

Not automatically. The intended purpose and listed use case matter. A product recommendation engine usually differs legally from a system deciding access to essential services or employment.

Do high-risk systems need a CE mark?

High-risk providers generally need conformity assessment, an EU declaration of conformity, CE marking and registration under the applicable regime. The exact process depends on the system and product legislation.

Can an organization wait until 2027 to start high-risk compliance?

That is risky. Classification, data governance, contracts, logging, quality management and conformity preparation can require lengthy changes. Other duties, including Article 4 and Article 50, may already apply.

Where should a company start?

Start with an inventory, intended-purpose descriptions and role assignment. Then screen prohibited practices, high-risk routes, Article 50 and GPAI exposure. The compliance checklist turns that sequence into an operational plan.

Bottom line

The EU AI Act is not one deadline and not one risk label. It is a layered regime that regulates practices, systems, models and actors differently. The immediate duties in August 2026 include Article 4 literacy measures, existing prohibitions, GPAI obligations for relevant providers and Article 50 transparency. The most demanding high-risk-system requirements arrive later, in December 2027 and August 2028.

A defensible program therefore begins with facts: what the organization uses, what each system does, which people are affected, who controls the intended purpose, which model sits underneath it and which actor occupies each legal role. Classification must then be translated into controls, contracts, documentation, monitoring and evidence.

For current enforcement, guidance and political developments, follow AI World Today’s AI Act news hub.