What is the EU AI Act?
The EU AI Act is the world's first comprehensive horizontal legal framework to govern artificial intelligence. Designed to foster trustworthy AI in Europe, it ensures systems are safe, transparent, traceable, non-discriminatory, and under human oversight.
Implementation Timeline
To give organizations sufficient time to prepare, the AI Act implements a phased enforcement timeline over several key milestones:
In Force
The AI Act officially becomes EU law.
Prohibitions Apply
Strict bans on unacceptable risk AI systems (e.g. social scoring, untargeted facial scraping) take effect.
General Purpose AI (GPAI)
Governance and transparency rules for foundation models (like LLMs) and general-purpose AI systems apply.
High-Risk AI (Annex III)
The majority of obligations for high-risk systems (education, HR, biometrics, critical infrastructure) become active.
High-Risk AI (Annex I)
AI systems integrated into products requiring third-party safety assessments (medical devices, aviation, automotive) must comply.
Find out if your company is in scope
Does your organisation fall under Annex I (Essential) or Annex II (Important) entities?
The 4 AI Risk Categories Explained
The cornerstone of the AI Act is its risk pyramid. Organizations must evaluate where their AI systems fall to determine their specific regulatory roadmap:
Prohibited AI Systems
Banned entirely. Includes social scoring by governments, untargeted scraping of CCTV, cognitive behavioral manipulation, and subliminal techniques.
Strictly Regulated AI
Allowed but subject to severe requirements. Examples: CV screening, credit scoring, biometrics, critical infrastructure management, medical devices.
Transparency Mandatory
Subject to basic disclosure rules. Providers must clearly notify users they are interacting with AI (e.g. chatbots, deepfakes, generated audio/text).
Unregulated
No obligations under the AI Act. This represents the vast majority of AI systems in use today, such as spam filters, translation, or AI video games.
Obligations: Providers vs. Deployers
Obligations for High-Risk AI systems are heavily asymmetric, splitting responsibilities between those who build the software and those who implement it professionally:
Obligations for Providers (Developers)
- ✔Risk Management System: Establish an iterative risk management loop across the entire product lifecycle.
- ✔Data Governance: Use high-quality, representative datasets to train models, minimizing toxic biases.
- ✔Technical Documentation: Compile complete compliance logs and register the system in the EU database.
- ✔Automatic Logging: Design traceability features, logging active usage sessions automatically.
- ✔Human Oversight: Incorporate interface controls that allow effective real-time human intervention.
Obligations for Deployers (Users)
- ✔Follow Instructions: Ensure professionals utilize the system in strict alignment with provider documentation.
- ✔Eingangsdaten überwachen: Provide input data that is objectively accurate and relevant for the high-risk task.
- ✔Log Management: Maintain system-generated operation logs for at least 6 months to support audits.
- ✔Rights Impact Assessment (FRIA): Perform a formal Fundamental Rights Impact Assessment prior to rollout (for public bodies/banks).
- ✔Anomaly Reporting: Immediately suspend operations and notify the provider if any critical bias is detected.
Find out if your company is in scope
Does your organisation fall under Annex I (Essential) or Annex II (Important) entities?
Practical Roadmap: How to Prepare
Even with phased timelines, preparing now is critical to prevent compliance bottlenecks. Implement these structured steps immediately:
Conduct an AI Inventory
Document all AI software currently used or planned within your company (including external APIs, SaaS products, and custom models).
Determine the Risk Category
Assess each system against the AI Act risk categories to map which require severe controls and which only need simple transparency notices.
Review Supplier Agreements
Require clear conformity statements and liability clauses from software vendors providing AI-enabled modules.
Establish an AI Governance Policy
Create internal guidelines for AI procurement, usage boundaries, monitoring, and clear employee responsibilities.
Train Your Employees
Promote AI literacy across the organization, helping teams recognize risk levels, biases, and compliance requirements.
Practical Compliance Tools & Frameworks
To ease the transition from regulatory text to operational reality, organizations can leverage official guidelines, interactive self-assessments, and specialized technical auditing frameworks:
ALTAI Assessment Tool
The Assessment List for Trustworthy AI (ALTAI) is the EU's official practical checklist. It guides enterprises through interactive questionnaires covering ethics, data governance, safety, and human agency.
AI Act Compliance Checker
Interactive community and legal-tech web applications designed to map your specific AI architecture. These tools assist in determining whether your AI model represents a Prohibited, High, or Limited risk.
AI Bias Auditing (AIF360 & Fairlearn)
Open-source toolkits like IBM's AI Fairness 360 (AIF360) and Fairlearn help engineers assess and mitigate bias in AI training datasets and machine learning models, meeting Article 10's strict data governance rules.
InterpretML (Explainable AI)
Transparency is a core requirement of the EU AI Act. InterpretML is an open-source library that helps developers train interpretable models and generate post-hoc explanations for complex black-box algorithms.
Frequently Asked Questions
What is the EU AI Act?
The EU AI Act (Regulation EU 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. It introduces a risk-based classification system, placing strict obligations on AI systems depending on the level of risk they pose to safety, health, and fundamental rights.
Does the AI Act apply to non-EU companies?
Yes. The AI Act has a broad extraterritorial scope. It applies to any provider who places AI systems or models on the EU market, and to any deployer located inside the EU. It also applies to providers and deployers located outside the EU if the output produced by their AI system is used inside the European Union.
What are the risk categories under the AI Act?
The AI Act divides AI systems into four risk levels: 1) Unacceptable Risk (prohibited, e.g., social scoring, biometric categorization), 2) High Risk (strictly regulated, e.g., critical infrastructure, recruitment, law enforcement), 3) Limited Risk (transparency obligations, e.g., chatbots, deepfakes), and 4) Minimal/No Risk (unregulated, e.g., spam filters, video games).
What are the penalties for non-compliance?
Penalties are extremely severe. Violating prohibited AI practices can lead to administrative fines of up to €35 million or 7% of global annual turnover, whichever is higher. Violations of other obligations (such as high-risk systems requirements) can result in fines up to €15 million or 3% of global turnover.
How does the AI Act overlap with GDPR and NIS2?
The AI Act is complementary to both. While GDPR protects personal data processed by AI systems, and NIS2 ensures the cybersecurity of network and information systems hosting or utilizing AI, the AI Act specifically regulates the safety, transparency, and ethical boundaries of the AI models themselves.
Official Sources & References
For authoritative research, always reference the official EU documentation directly:
- ↗Official AI Act Text (Regulation EU 2024/1689) — The complete legislative publication in the Official Journal of the EU.
- ↗European Commission AI Office — The EU Commission's official department handling GPAI codes of practice and guidelines.
Parallel Cybersecurity Obligation: NIS2
Deploying high-risk AI requires strict network and data security. Under NIS2, critical organizations must implement rigid cybersecurity frameworks. Check if your business is in scope.
Start NIS2 Scope Checker →