Complete Guide To EU Artificial Intelligence Act (AI Act)

The EU Artificial Intelligence Act—Regulation (EU) 2024/1689—sets legally binding rules for any AI system placed on the European market or whose outputs reach EU users, making it the first horizontal, risk-based AI law anywhere. Whether you build models, integrate third-party tooling, or simply deploy chatbots to serve customers, the Act creates new duties and exposes you to eye-watering fines of up to 7 % of global turnover per infringement. Entry into force was 1 August 2024; compliance obligations phase in from February 2025 to August 2027, meaning preparation time is limited.

This practical guide cuts through the legal jargon and explains exactly what you need to know: the Act’s scope and key definitions, its four-tier risk classification, the timeline and enforcement mechanics, the concrete obligations for providers, users, importers, and distributors, and the penalties for falling short. We also map the regulation to GDPR, NIS2, product safety rules, and sector-specific requirements, before giving you a step-by-step compliance checklist that engineering, legal, and leadership teams can act on immediately. Let’s get you ready—well before the auditors come knocking.

At a Glance: What the EU AI Act Actually Is

Regulation (EU) 2024/1689—better known as the EU Artificial Intelligence Act— is a directly applicable EU regulation, not a directive. That means its articles bite automatically in every Member State without the need for national transposition, much like the GDPR did in 2018. The goal is two-fold: safeguard fundamental rights and safety while at the same time giving companies legal certainty to innovate responsibly with AI. To achieve this, the Act introduces a horizontal, risk-based toolkit that spans every sector from finance to healthcare, grading systems from “minimal” to “unacceptable” risk with matching legal duties.

Scope and Definitions You Need to Know

Before drawing up a compliance plan, master the core vocabulary:

AI system: “a machine-based system designed to operate with varying levels of autonomy and that, for explicit or implicit objectives, infers from input data how to generate outputs—such as predictions, content, recommendations or decisions—that can influence physical or virtual environments.”
General-purpose AI (GPAI): an AI system capable of serving a wide range of distinct tasks, irrespective of how it is subsequently fine-tuned or deployed.
Provider: any natural or legal person who develops—or has developed—an AI system with a view to placing it on the market or putting it into service under their name or trademark.
User (often called “deployer”): a person or entity using an AI system under its authority, excluding private, non-professional use.
Importer: Union-established party that places on the EU market an AI system bearing the name or trademark of an entity located outside the Union.
Distributor: actor in the supply chain—other than provider or importer—who makes an AI system available without modifying it.

Territorial reach is broad: any system placed on the EU market or whose output is used in the EU falls under the Act, no matter where the developer sits. Carve-outs exist for purely military or national-security applications, R&D prototypes not yet marketed, and personal hobby projects.

Key Principles Embedded in the Act

The regulation folds longstanding ethical concepts into enforceable law:

Human agency and oversight
Technical robustness and safety
Privacy and data governance
Transparency and explainability
Diversity, non-discrimination and fairness
Societal and environmental well-being

These mirror the OECD AI Principles and the EU’s earlier “Ethics Guidelines for Trustworthy AI,” but now carry regulatory teeth.

Regulation vs. Existing Soft-Law Guidelines

Until 2024, AI governance in Europe relied on voluntary frameworks like the EU AI Pact or corporate codes of ethics. The AI Act changes the game: compliance is mandatory, auditable, and backed by fines up to €35 million or 7 % of global revenue. In other words, declarations of “ethical AI” are no longer enough—organisations must produce conformity assessments, CE markings, and verifiable logs or risk being barred from the EU market.

Timeline, Legal Status, and Enforcement Phases

The EU Artificial Intelligence Act travelled from proposal to binding law in just over three years—light-speed by Brussels standards. Because it is a Regulation, most articles apply automatically across the bloc without national transposition. What does change over time is which obligations bite first. The timetable below shows the political milestones that got us here and sets the stage for the phased-in compliance duties your organization must now calendar.

Date	Milestone	Significance
21 Apr 2021	Commission publishes draft AI Act	Formal start of legislative process
9 Dec 2023	Parliament & Council reach political deal	Core text largely locked
13 Mar 2024	European Parliament final vote (523-46)	Democratic approval secured
21 May 2024	Council of the EU adoption	Last legislative hurdle cleared
10 Jul 2024	Text published in Official Journal	Legal countdown begins
1 Aug 2024	Regulation (EU) 2024/1689 enters into force	“Day 0” for all future deadlines

The entry-into-force date triggers a series of staggered application dates spread over three years. This design gives providers, users, importers, and distributors breathing room to build conformity processes, upgrade models, and train staff—yet it also means auditors will expect demonstrable progress well before 2027.

Enforcement Roadmap: What Applies When

6 months | 1 Feb 2025
- Prohibited AI practices (Art. 5) must be off the market—no excuses.
12 months | 1 Aug 2025
- Transparency duties for deepfakes, chatbots, and emotion recognition kick in.
- Codes of practice for general-purpose AI (GPAI) expected; voluntary but highly recommended.
24 months | 1 Aug 2026
- High-risk system requirements start: risk management, data governance, technical documentation, human oversight, and CE marking preparations.
- Providers must register high-risk systems in the new EU database.
36 months | 1 Aug 2027
- Full regime applies, including biometric identification systems, notified-body conformity assessments, and mandatory EU declaration of conformity for all high-risk AI.
- Market surveillance authorities gain power to order recall or withdrawal for non-compliant products.

Transitional clauses allow high-risk systems already lawfully in use before August 2026 to stay on the market until they undergo a “substantial modification.” Plan upgrades carefully to avoid accidentally resetting the compliance clock.

Institutions and Supervisory Bodies

Three layers of oversight enforce the EU Artificial Intelligence Act:

EU AI Office (European Commission) – Coordinates guidance, maintains the GPAI register, and can impose fines on systemic model providers.
National Competent Authorities – One per Member State; handle inspections, complaints, and day-to-day market surveillance.
Notified Bodies – Independent conformity assessment organizations that audit high-risk systems before CE marking.

These actors collaborate through the European Artificial Intelligence Board (EAIB), which issues harmonized interpretive notes—think of it as the AI equivalent of the GDPR’s EDPB. Stay alert to their guidance; it will shape how your technical files and risk assessments are judged in practice.

The Four-Tier Risk Classification Framework

At the heart of the EU Artificial Intelligence Act (AI Act) sits a traffic-light model that determines how tough the rules get: the higher the risk to people’s rights and safety, the heavier the compliance load. Every AI system must be mapped to one of four classes—unacceptable, high, limited, or minimal. The classification drives everything else: documentation depth, testing rigor, oversight, and, ultimately, market access.

Risk tier	Typical examples	Core legal consequence	First application date*
Unacceptable	Social scoring, real-time biometric ID in public spaces, manipulative “nudge” engines	Total ban; withdrawal and fines up to €35 m / 7 %	1 Feb 2025
High	CV-screening tools, medical-diagnosis software, credit-worthiness scoring, autonomous driving modules	Conformity assessment, CE marking, registry entry, post-market monitoring	1 Aug 2026 (biometrics: 1 Aug 2027)
Limited	Chatbots, deepfake generators, emotion-analysis widgets	Transparency notice and basic user controls	1 Aug 2025
Minimal	AI-powered spam filters, video-game NPCs	No mandatory rules; voluntary codes only	Already in effect

* Calculated from the 1 Aug 2024 entry into force date.

The framework is dynamic: if you add new features or change target users, your system may jump a tier, triggering fresh duties.

Unacceptable Risk: Prohibited AI Practices

Article 5 draws a red line under uses the EU considers inherently incompatible with fundamental rights. These include:

Subliminal techniques that materially distort behavior
Exploiting vulnerabilities of minors or persons with disabilities
Indiscriminate real-time biometric identification in publicly accessible spaces (narrow law-enforcement carve-outs apply)
Social scoring by public authorities
Predictive policing based solely on profiling or location data

Such systems must never hit the EU market. National authorities can order immediate recall, and penalties top the Act’s fine ladder.

High-Risk AI Systems: Annex III Categories

A system lands in the high-risk bucket if it is either:

A safety component of a product already regulated (e.g., under the Machinery or Medical Device Regulations), or
Listed in Annex III’s eight sensitive domains—biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice.

Once classed as high risk, providers must operate a quality management system, perform a risk-management cycle, and secure a conformity assessment—sometimes via an external notified body. Users (deployers) inherit logging, oversight, and incident-reporting duties.

Limited Risk: Transparency Obligations

Limited-risk tools aren’t harmless, but the EU believes user awareness mitigates most dangers. Makers of chatbots, generative-AI art engines, or synthetic-voice services must:

Inform users they are interacting with AI (“This image is AI-generated”)
Disclose deepfake content in a machine-readable watermark
Refrain from covertly collecting personal data beyond what is strictly necessary

Failing to provide the notice downgrades the system straight to non-compliance territory and invites administrative fines.

Minimal/Negligible Risk: No Mandatory Rules

Spam filters, predictive text in email, or AI that optimizes HVAC energy use generally fall here. The EU Artificial Intelligence Act (AI Act) imposes no hard obligations, but it actively encourages voluntary codes, regulatory sandboxes, and adherence to international standards like ISO/IEC 42001. Keeping light documentation and basic bias tests is still a smart move—regulators can reclassify borderline cases if evidence of harm emerges.

Core Obligations for Providers, Deployers, and Other Actors

The EU Artificial Intelligence Act spreads compliance duties across the entire supply chain. Because liability follows function, not company size, you first have to determine which hat you are wearing—provider, user (deployer), importer, or distributor—and then layer on any risk-specific requirements. Missing the correct classification is a common audit finding, so treat the mapping exercise as step zero of your program.

Providers of High-Risk Systems

Providers shoulder the heaviest burden because they control design decisions. Key tasks:

Set up a documented Quality Management System (QMS) that covers data governance, risk management, change control, and cybersecurity.
Run an ex-ante conformity assessment. Most Annex III systems can self-assess, but biometric ID, medical devices, and other safety-critical use cases require a notified body.
Compile technical documentation: model architecture, training data lineage, evaluation metrics, robustness tests, human-oversight mechanisms, and post-market monitoring plan.
Draft an EU Declaration of Conformity, affix the CE marking, and register the system in the public AI database before first deployment.
Establish continuous post-market surveillance: log serious incidents, retrain when drift thresholds are crossed, and notify competent authorities within 15 days.

Neglecting any of these steps can trigger fines of up to €15 million or 3 % of global turnover—even if no harm occurs.

Users / Deployers of High-Risk Systems

Deployers convert code into real-world impact, so the Act gives them their own checklist:

Operate the system strictly according to the provider’s instructions and documented use case.
Carry out a Fundamental Rights Impact Assessment (FRIA) when the user is a public authority or when the AI influences access to essential services such as housing or credit.
Ensure qualified human oversight: staff must be trained, empowered to override outputs, and able to explain decisions to affected individuals.
Maintain logs for at least six years, including input data, output, human interventions, and performance anomalies.
Report serious incidents to both the provider and national authority without “undue delay,” typically interpreted as 72 hours.

Importers and Distributors

Actors who introduce or pass along AI systems in the EU have gate-keeping duties:

Verify that the CE marking, EU Declaration of Conformity, and instructions exist and match the marketed functionality.
Refrain from supplying the product if they know—or should know—that it is non-compliant; instead, inform the provider and competent authority.
Keep a register of complaints and recalls, making it available to authorities on request.
Cooperate in corrective actions, including product withdrawals or software patches.

General-Purpose AI (Foundation Models) Obligations

The Act adds bespoke rules for creators of GPAI or foundation models that could be embedded anywhere:

Provide comprehensive technical documentation and a summary of the datasets used, including license status and geographic origin.
Publish a statement of copyright compliance and, where feasible, implement opt-out mechanisms for protected works.
Conduct and document systemic-risk testing if the model exceeds the compute threshold in Annex XI (think 10^25 FLOPs). Extra duties kick in for “systemic GPAI” such as offering reference implementations and cooperating with the EU AI Office.
Open-source models enjoy lighter touch obligations, yet must still watermark generated content and supply usage instructions detailing foreseeable limitations.

By aligning your internal controls with the role-specific checklists above, you can close the most glaring compliance gaps long before the August 2026 and 2027 enforcement deadlines hit.

Technical and Organizational Requirements to Achieve Compliance

The EU Artificial Intelligence Act does not prescribe one-size-fits-all blueprints. Instead, it defines outcome-oriented “essential requirements” and leaves you free to choose the controls that prove them. The trick is to blend engineering good practice with regulatory hygiene, so that every model update or data refresh automatically drops into a repeatable compliance pipeline. The five building blocks below translate the Act’s legal articles into concrete tasks your product, data, and legal teams can own.

Data Governance and Management

Bad data equals regulatory kryptonite. Article 10 forces providers of high-risk AI to document and justify every byte that enters the pipeline.

Curate datasets that are relevant, representative, error-free, and up to date for the intended population.
Maintain a “data sheet” for each corpus: source, collection date, licensing terms, preprocessing steps, bias checks, and retention period.
Track lineage in a version-controlled repository so you can roll back if an authority demands corrections.
Perform bias and imbalance testing using statistically sound methods (χ², KS-test, or model-agnostic fairness metrics) and log mitigation actions.

Keep the full trail—raw data, scripts, test results—accessible for 10 years; the Act’s look-back window is long.

Risk Management Framework

Article 9 requires a continuous and documented process that mirrors ISO 31000 and the draft ISO/IEC 23894.

Identify hazards: misuse scenarios, adversarial attacks, data drift.
Analyze impact and likelihood; score them on a common scale (e.g., risk = probability × severity).
Decide controls: technical safeguards, human oversight, contractual limits.
Verify controls after each major update; feed findings into the next sprint.

Store everything in a living risk register; regulators expect to see timestamps, owners, and closure evidence.

Human Oversight and Transparency by Design

Articles 14 and 52 convert “human-in-the-loop” talk into mandatory design tasks.

Define the oversight mode: in-the-loop (manual approval), on-the-loop (real-time alerts), or over-the-loop (post-hoc audits).
Embed explainability layers: saliency maps, counterfactual examples, simplified decision rules.
Provide override and fallback options that are both technically workable and organizationally authorized.
Offer plain-language user notices (“You are interacting with an AI system”) and expose confidence scores where feasible.

Robustness, Accuracy, and Cybersecurity

Under Article 15, models must stay within declared error rates and resist malicious interference.

Establish minimum performance thresholds; monitor accuracy, precision, recall, and calibration drift in production.
Run adversarial-resilience tests (FGSM, PGD, data poisoning) before each release.
Harden infrastructure in line with NIS2 and ETSI EN 303 645: secure APIs, role-based access, encrypted model checkpoints.
Prepare fallback plans—safe-mode defaults, human review escalation—when performance drops below tolerance bands.

Record-Keeping, Logging, and CE Documentation

If it’s not written down, it never happened—a mantra that becomes law in Articles 11 and 19.

Document	Key Contents	Retention
Technical File	model architecture, training data summary, evaluation metrics, cybersecurity controls	Life-cycle + 10 yrs
Logs	inputs, outputs, override events, performance stats, incidents	≥ 6 yrs
EU Declaration of Conformity	conformity statement, standards applied, provider details	Publicly available
Post-Market Monitoring Plan	KPIs, reporting channels, trigger thresholds	Continuously updated

Automate log capture where possible; use immutable storage or append-only ledgers so evidence survives forensic scrutiny. Once the dossier is complete, affix the CE marking and submit the system to the EU database—only then may it hit the market.

By hard-wiring these technical and organizational controls into your development life-cycle, you transform compliance from a last-minute scramble into an always-on capability the auditors will recognize—and reward.

Penalties, Remedies, and Litigation Exposure

The EU Artificial Intelligence Act does not rely on polite nudges; it deploys a stick big enough to make executives wince. Financial sanctions mirror the GDPR’s scale, yet the Act also empowers authorities to pull products off shelves, order data deletion, or force model retraining if risks remain unmitigated. Fines are capped by whichever is higher—an absolute euro amount or a percentage of the previous year’s worldwide turnover—so even early-stage start-ups avoid complacency. The table below summarizes the sanctioned tiers:

Violation type	Max fixed fine	Max % of global turnover	Typical triggers
Prohibited practices (Art. 5)	€35 m	7 %	Social scoring, illegal biometric mass surveillance
High-risk obligations (Arts. 8–15)	€15 m	3 %	Missing conformity assessment, flawed data governance
Information & registration failures	€7.5 m	1 %	Inaccurate technical docs, late incident reporting
Routine non-compliance notice	€500K	n/a	Minor breaches after warning

Supervisory authorities can impose daily penalty payments to accelerate remediation. Products that still pose “serious risk” face compulsory recall or market withdrawal—a reputational hit no PR plan can mask.

Administrative Sanctions vs. Civil Liability

Regulatory fines are not the end of the story. The forthcoming AI Liability Directive (AILD) and revamped Product Liability Directive (PLD) open parallel paths for private damage claims. Victims injured by an AI decision will enjoy:

A rebuttable presumption of causality when providers breach AI Act duties, easing the burden of proof.
Extended disclosure rights, letting plaintiffs request logs and risk assessments that would normally stay in-house.
Harmonized rules across Member States, yet national tort law may still provide stricter standards (e.g., Dutch wrongful-act doctrine).

Companies could therefore face a one-two punch: a multimillion-euro administrative fine followed by civil class actions, especially in areas like credit denial or discriminatory hiring.

Redress Mechanisms and Whistleblower Protection

Individuals and NGOs may lodge complaints directly with their national competent authority or the EU AI Office. Authorities must investigate within a “reasonable period” and can grant interim measures, including suspension orders. Affected persons also retain judicial remedies—injunctions, compensation suits, and appeals against supervisory decisions.

Employees who spot wrongdoing are shielded under the EU Whistleblowing Directive:

Confidential reporting channels are mandatory for firms with 50+ staff.
Retaliation—dismissal, demotion, intimidation—is expressly forbidden.
Whistleblowers may escalate externally to regulators or the press if internal routes fail.

Establishing a well-advertised, anonymous reporting line is therefore both a legal requirement and an early-warning system that can save you from costlier enforcement down the road.

Mapping the AI Act to GDPR, NIS2, Product Safety, and Sector Rules

The EU Artificial Intelligence Act (AI Act) is not a standalone island. It plugs into a crowded compliance ocean that already includes data-protection, cybersecurity, and vertical safety frameworks. Ignoring those cross-currents is risky: an AI system that ticks every AI Act box can still violate the GDPR or NIS2, and vice-versa. Below we highlight the key touchpoints so your legal, security, and product teams can build a single, integrated control map instead of juggling four separate checklists.

Overlap With GDPR and ePrivacy

Lawful basis & purpose limitation: personal-data processing inside a high-risk model must satisfy at least one GDPR ground (often legitimate interest or consent).
Automated decision-making limits: Article 22 GDPR restricts fully automated decisions with legal or significant effects; the AI Act’s human-oversight requirement often acts as the technical safeguard that unlocks Article 22(2)(b) or (c) exemptions.
Joint-controller scenarios: when a deployer fine-tunes a GPAI provided by a vendor, both may become joint controllers under GDPR—plan Data Processing Agreements accordingly.
Transparency duty double-tap: the AI Act mandates user disclosures (“AI-generated”), while GDPR Articles 12-14 demand privacy notices detailing data flows, retention, and rights. Draft one layered notice that covers both.

Cybersecurity and NIS2 Synergies

NIS2 calls for risk assessments, incident response, and supply-chain security for “essential” and “important” entities. The AI Act mirrors that by requiring robustness testing, vulnerability monitoring, and breach reporting within 15 days. Leverage one SOC workflow:

Run adversarial-robustness tests during the AI Act conformity assessment.
Feed the results into the NIS2 risk register.
Use the same 72-hour incident-reporting playbook for both regimes.

Integration With Existing Product Legislation

If your AI is a safety component of a regulated product (medical device, machinery, toy, lift, automotive system), you must perform a single conformity assessment that covers:

General-safety or performance requirements under sector law; and
AI Act essentials (risk management, data governance, human oversight).

Harmonised standards under the New Legislative Framework will soon reference both sets of requirements, allowing one technical file and one CE marking.

Sector-Specific Examples

Financial services: combine AI Act logging with EBA guidelines on anti-money-laundering to evidence model fairness and explainability.
Energy grid management: mesh AI Act risk controls with ENTSO-E cybersecurity requirements for SCADA systems.
Automotive: UNECE WP.29 mandates software-update governance; integrate those update logs into your AI Act post-market monitoring.
Healthcare: pair ISO 13485 QMS artifacts with the AI Act’s dataset documentation to avoid redundant audits.

International Comparisons

Global companies must reconcile the EU Artificial Intelligence Act (AI Act) with emerging rules elsewhere:

Jurisdiction	Key instrument	Notable divergence
US	Executive Order & NIST AI RMF	Voluntary but may become federal procurement baseline
China	Interim Gen-AI Measures	Real-name registration & content filtering obliged
UK	Pro-innovation Framework	Regulator-specific guidance, no horizontal law yet

By mapping overlaps early, multinational teams can design control frameworks that satisfy the strictest rule set first, then dial down where local laws are lighter.

Practical Compliance Checklist and Best Practices

Turning the articles and recitals of the EU Artificial Intelligence Act (AI Act) into day-to-day practice can feel daunting. The trick is to break the journey into bite-sized actions that legal, product, and security teams can own. Use the 12-step roadmap below as a living project plan—review it at every sprint demo and board meeting until August 2027.

Inventory every AI or algorithmic component in production and R&D.
Classify each system’s risk tier and your actor role (provider, user, importer, distributor).
Map applicable laws (GDPR, NIS2, sector rules) and identify overlaps.
Perform a gap analysis against AI Act essential requirements.
Design or update your Quality Management System (QMS).
Stand up a multidisciplinary governance structure.
Draft technical documentation templates and start populating them.
Build data-governance and bias-testing pipelines.
Run initial conformity assessments or dry-run audits.
Train staff—engineers, risk owners, and customer support.
Launch post-market monitoring and incident-reporting workflows.
Schedule periodic reviews and continuous-improvement loops.

Readiness Assessment and Gap Analysis

Kick off with a spreadsheet or ticket board listing: system name, purpose, training data sources, risk level, existing controls, and open gaps. Assign each gap an owner and a deadline. Re-score residual risk after every closure; regulators love seeing that iterative improvement trail.

Building the Right Governance Structure

Put people, not only policies, in charge:

AI compliance officer: single throat to choke.
Cross-functional ethics committee: product, legal, security, HR.
External reviewer or notified-body liaison.
Tight link with your DPO and CISO to avoid siloed decision making.

Document meeting cadence, decision rights, and escalation paths.

Documentation and Tools

Standardize artefacts so engineers aren’t reinventing the wheel:

Template	Purpose	Recommended format
Model Card	Capabilities, limits, metrics	Markdown + JSON
Data Sheet	Source, licensing, bias tests	Spreadsheet
Transparency Report	User-facing disclosure	HTML / PDF
Fundamental Rights IA	Public-sector deployers	Form-based tool

Open-source help: EU AI Toolkit, ISO/IEC 42001 draft checklists, and GitHub repos for bias metrics.

Vendor and Supply-Chain Management

Flow AI Act duties downstream:

Add conformity-assessment warranties and audit rights to contracts.
Require suppliers to share model cards, robustness test results, and incident logs.
Set up a shared Slack or ticket queue for rapid vulnerability disclosure.

Continuous Monitoring and Model Lifecycle Updates

Pre-deployment, in-use, and post-deployment monitoring should run off the same telemetry stack. Trigger a re-assessment when:

Input data distribution shifts (KL divergence > preset threshold).
Accuracy drops below the declared minimum.
A serious incident or near-miss is logged.

Close the loop with quarterly governance reviews and an annual external audit—proof that compliance is not a one-off project but a standing capability.

FAQ: Quick Answers to Common Questions

Is the EU AI Act already in force?
Yes. Regulation (EU) 2024/1689 entered into force on 1 August 2024. However, most concrete obligations phase in later: banned practices disappear by February 2025, transparency rules start August 2025, high-risk duties arrive August 2026 (biometrics August 2027). So the clock is ticking even though full application is still staged.

What are the four risk levels?
The EU Artificial Intelligence Act groups systems into (1) Unacceptable risk—totally prohibited; (2) High risk—allowed only after conformity assessment and CE marking; (3) Limited risk—mainly transparency duties (e.g., chatbots, deepfakes); and (4) Minimal risk—no hard rules but voluntary codes encouraged. Your first job is to map each model to one of these tiers.

Has the Act replaced national AI strategies?
No. Member States may keep or create national strategies, sandboxes, and funding schemes. The Act simply harmonizes regulatory requirements so businesses face one rulebook across the EU. Local initiatives must not contradict the Regulation’s risk framework or undermine its enforcement mechanisms.

Do startups have exemptions?
Not really. The rules apply regardless of company size because risk, not revenue, drives obligations. That said, sandboxes, lighter documentation for some GPAI models, and Commission-funded guidance aim to reduce administrative friction for SMEs. Ignoring compliance because you are “small” is a dangerous misconception.

How does the AI Act treat open-source models?
Releasing model weights publicly does not exempt you. You must still provide training-data summaries, watermark generated content, and publish usage instructions. Obligations are lighter than for closed commercial models, but if your open-source system becomes “systemic GPAI,” extra testing and reporting duties kick in.

Is the Act a Directive?
No. It is a Regulation—directly applicable in every Member State without national transposition. Think of it like the GDPR: once it entered into force, the legal obligations existed EU-wide, and only practical enforcement guidance can vary locally.

What happens if my provider is outside the EU?
Territorial reach follows output, not headquarters. If an overseas vendor’s system is marketed in the EU or its results are used here, the provider must meet EU AI Act requirements and designate an EU-based legal representative. Deployers inside the Union still carry user obligations, so choose suppliers carefully.

Key Takeaways

Still skimming? Here is the cheat-sheet:

The EU Artificial Intelligence Act (AI Act) is no longer a draft—it has been in force since 1 August 2024 and brings the first horizontal, risk-based AI law anywhere.
Risk tiering drives everything: unacceptable systems are banned, high-risk systems need CE marking and registry entry, while limited- and minimal-risk tools face lighter—but not zero—duties.
Non-compliance is expensive: up to €35 million or 7 % of global turnover for prohibited practices, plus potential civil liability under forthcoming EU directives.
Obligations sit across the supply chain: providers, users, importers, and distributors each have specific checklists, and general-purpose models now have bespoke rules.
The Act does not replace GDPR, NIS2, or product-safety laws; you must mesh all frameworks into one integrated governance program.

Need help turning legal text into working code, policies, and contracts? The technology and privacy lawyers at Law & More can perform a rapid AI Act readiness scan, draft the required documentation, and guide you through conformity assessment—before the auditors come knocking.