EU AI Act

The EU AI Act is the first comprehensive law regulating artificial intelligence across a major economy. Rather than treating all AI the same way, it sorts AI systems into categories based on the risk they pose. A small number of uses, such as social scoring by public authorities, are banned outright. Systems used in sensitive areas, such as hiring, credit, education and critical infrastructure, must meet detailed requirements before they can be used. Chatbots and AI-generated content must be disclosed, and providers of general-purpose AI models have their own obligations. Most other AI is left largely unregulated. This risk-based structure is the defining feature of the law.

The Act was adopted as Regulation (EU) 2024/1689 and entered into force on August 1, 2024, with obligations phased in over several years. In 2026, the EU adopted a Digital Omnibus on AI, Regulation (EU) 2026/1744, which postponed the main high-risk obligations and made other changes. Like the GDPR, the AI Act applies to organizations outside the EU when their AI systems are placed on the EU market or their outputs are used in the EU. For legal, compliance, risk, technology and product teams, it sets the benchmark for AI regulation worldwide.

Definition of the EU AI Act

The EU AI Act is a regulation establishing harmonized rules for the development, placing on the market, putting into service and use of AI systems in the European Union, using a risk-based approach that sets obligations for providers, deployers, importers and distributors according to the level of risk an AI system presents.

Its risk tiers are described under EU AI Act risk categories, it sets specific duties for general-purpose AI models and it is a major driver of AI compliance programs.

Key Obligations

Prohibited practices include harmful manipulation, exploiting vulnerabilities, social scoring, certain uses of real-time remote biometric identification in public spaces and emotion recognition in workplaces and schools. The 2026 omnibus added a ban on AI systems that generate non-consensual intimate images of identifiable people or child sexual abuse material.

High-risk AI systems must have risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, and many must undergo conformity assessment before use.

Deployers of high-risk systems must use them according to instructions, assign human oversight, monitor them and, in some cases, carry out a fundamental rights impact assessment. These assessments are described further under AI impact assessment.

Transparency obligations require disclosure when people interact with chatbots, labeling of deepfakes and machine-readable marking of AI-generated content.

Providers and deployers must take measures to support AI literacy among staff who work with AI.

Timeline

Prohibited practices and AI literacy obligations have applied since February 2, 2025.

Obligations for general-purpose AI models have applied since August 2, 2025.

Most transparency obligations apply from August 2, 2026, with a grace period until December 2, 2026 for marking content from generative systems already on the market.

After the 2026 omnibus, requirements for high-risk systems listed in Annex III, such as those used in employment and credit, apply from December 2, 2027.

Requirements for high-risk AI embedded in products covered by EU product safety law, listed in Annex I, apply from August 2, 2028.

Importance of the EU AI Act in AI Governance

The Act sets binding requirements. Organizations that provide or use AI in the EU must meet its obligations or face significant penalties.

It shapes global practice. Many organizations apply its approach worldwide rather than maintain different standards by region, and other jurisdictions have drawn on it. Customers outside Europe also increasingly ask suppliers about AI Act readiness.

It also makes risk tiering standard. Classifying AI systems by risk, and matching controls to that risk, is now a core expectation of AI governance.

The EU AI Act and Financial Management

Fines can reach 35 million euros or 7% of worldwide annual turnover for prohibited practices, and 15 million euros or 3% for most other breaches, whichever is higher, with lower caps for smaller companies.

Compliance costs for high-risk systems include documentation, testing, quality management, conformity assessment and ongoing monitoring.

Identifying which systems are high-risk early lets organizations budget for compliance, or redesign uses to avoid falling into the category.

Vendor contracts should allocate responsibilities between providers and deployers, since each carries different obligations.

Common Challenges

Determining whether a system is an AI system, and which risk category it falls into, can require detailed legal analysis.

Many organizations are deployers of AI built by others and must rely on providers for documentation and assurances. Contracts and vendor reviews are therefore an important part of compliance.

Detailed rules continue to evolve through technical standards, Commission guidance and amendments such as the 2026 omnibus.