The EU AI Act

Regulation (EU) 2024/1689 — the EU AI Act — is the first horizontal law to regulate artificial intelligence across an entire economic bloc. It applies to anyone placing an AI system on the EU market or putting one into service in the Union, and reaches providers established outside the EU whose system output is used inside it. This section is the entry point to Confir's coverage of the Regulation: what it says, whom it binds, when each obligation starts, and what compliance requires.

The Act is product-safety legislation, not a code of ethics or a voluntary framework. Obligations attach to a system based on what it does and the context it operates in, not the technology behind it: a rule-based scoring tool and a neural network doing the same job carry the same obligations.

How the Regulation is structured

The Act sorts AI systems by risk; the tier determines the obligation stack.

Prohibited practices (Article 5). Eight practices are banned outright: subliminal manipulation, exploitation of vulnerabilities, social scoring, real-time remote biometric identification in public spaces (narrow law-enforcement carve-outs), post-remote biometric identification, emotion recognition in workplaces and educational institutions, biometric categorisation inferring sensitive attributes, and individual criminal-risk assessment based purely on profiling. No consent mechanism, safeguard, or human-review step cures a prohibited system. The social-scoring prohibition in Article 5(1)(c) is not confined to public authorities — private actors are bound too.

High-risk (Article 6). Two routes in. Article 6(1) covers AI acting as a safety component of a product already regulated under the Annex I harmonisation legislation. Article 6(2) covers systems whose intended purpose falls within one of the eight Annex III use-case areas: biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential public and private services, law enforcement, migration and border control, and administration of justice and democratic processes. Article 6(3) offers a narrow exemption for systems posing no significant risk of harm — but it never applies to a system that profiles natural persons. High-risk carries the bulk of the Regulation: risk management (Article 9), data governance (Article 10), technical documentation (Article 11 and Annex IV), logging (Article 12), transparency to deployers (Article 13), human oversight (Article 14), accuracy and cybersecurity (Article 15), conformity assessment (Article 43), the EU Declaration of Conformity (Article 47 and Annex V), CE marking (Article 48), registration (Article 49), and post-market monitoring (Article 72).

Limited risk — transparency (Article 50). Chatbots must disclose that they are AI, synthetic media must be marked, and emotion-recognition and biometric-categorisation systems must notify the people they process.

Minimal risk. Everything else. No Act-specific obligations, though the GDPR, product-safety law, and sector rules still apply.

GPAI sits apart. General-purpose AI models are governed by a separate chapter — Chapter V, Articles 51 to 56 — rather than by the four tiers. Those obligations fall on the model provider regardless of the tier of any downstream system.

Who it binds

The Regulation assigns duties by role, not by company size.

• Provider — develops an AI system and places it on the market under its own name. Carries the heaviest obligations, including conformity assessment.
• Deployer — uses a system under its own authority in a professional capacity. Must follow the instructions for use, ensure human oversight, and, where Article 27 applies, carry out a Fundamental Rights Impact Assessment before deployment.
• Importer — places a third-country provider's system on the EU market, and must verify conformity assessment is complete before importing.
• Distributor — makes a system available in the supply chain, and must check the required documentation and CE marking are present.

Roles are not fixed. Under Article 25, a deployer, importer, or distributor becomes a provider — inheriting the full provider stack — by putting its own name on a high-risk system, substantially modifying it, or changing its intended purpose. This is how many organisations acquire obligations they never planned for.

The phased timeline

The Act entered into force in August 2024 and applies in stages:

• 2 February 2025 — Article 5 prohibitions and Article 4 AI literacy obligations.
• 2 August 2025 — GPAI model obligations.
• 2 August 2026 — general Article 50 transparency obligations.
• 2 December 2026 — Article 50(2) machine-readable marking of synthetic content.
• 2 December 2027 — stand-alone high-risk systems listed in Annex III.
• 2 August 2028 — high-risk AI embedded as a safety component in Annex I products.

The two high-risk dates come from the Digital Omnibus, adopted in June 2026 (European Parliament on 16 June, Council on 29 June); it enters into force on publication in the Official Journal. The deferral moved the deadline, not the workload — Articles 9 to 15 alone take most organisations six to nine months to evidence properly.

Penalties sit in Article 99. Breach of the Article 5 prohibitions carries up to €35,000,000 or 7% of total worldwide annual turnover, whichever is higher. Other high-risk and transparency breaches carry lower ceilings. These are maxima, not fixed or automatic fines.

Where to start

If the Regulation is new to you, read in this order: what the Act is; whether it applies to you at all, including the extraterritorial reach in Article 2; how to classify your systems under Article 6 and Annex III; which role you hold under Articles 16 and 26; then your timeline. Country pages cover national implementation, which varies by Member State even though the Regulation applies directly everywhere; Article pages go clause by clause.

How Confir helps

Confir turns the Regulation into a worked process. Guided intake establishes each system's intended purpose and context, then a deterministic, rule-based engine classifies it against Article 6 and Annex III and scopes the controls that follow — Annex IV technical documentation, the Article 27 FRIA where required, the EU Declaration of Conformity, Article 50 transparency, and Article 73 incident reporting. Every decision traces back to the rule that produced it, recorded in an immutable audit log under Article 12.