EU AI Act Summary: What It Is, Who It Covers, and What You Must Do
The EU AI Act in five minutes: the four risk tiers, key dates (high-risk from Dec 2027), the penalty tiers, who it covers, and the five steps to take now.
Regulation (EU) 2024/1689 entered into force on 1 August 2024. It is the world's first binding horizontal law for artificial intelligence — meaning it cuts across sectors and sits above product-specific rules. The core mechanism is a risk-based framework: your obligations depend entirely on what your AI system does, not on the technology it runs on. If that sounds simpler than the GDPR, the high-risk stack will revise that impression.
For a deeper treatment of the Act's full scope and governance structure, see the comprehensive EU AI Act guide. This page is the quick-reference version: five-minute reading, all the essentials.
What the EU AI Act Actually Is
The Act is a directly applicable EU Regulation — no national implementing legislation is needed, and it applies uniformly across all 27 member states. Its full citation is Regulation (EU) 2024/1689 of the European Parliament and of the Council. The regulation is risk-based: it does not ban AI. It assigns legal obligations to the top two risk tiers and largely leaves the remaining systems to voluntary codes.
The regulation is extraterritorial. You must comply if you place an AI system on the EU market, if you deploy one within the EU, or if the output of your AI system is used in the EU — regardless of where your company is incorporated or your servers are hosted. A US company offering AI-assisted credit decisions to European banks falls under the Act on the same terms as a firm in Munich.
The Four Risk Tiers
Unacceptable risk — banned (Article 5)
Certain applications are prohibited outright. They have been illegal since 2 February 2025. The list includes AI that manipulates people subliminally (Article 5(1)(a)), exploits vulnerabilities of specific groups to cause harm (Article 5(1)(b)), operates social-scoring systems that harm access to services (Article 5(1)(c)), deploys real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions (Article 5(1)(h)), profiles individuals to predict criminal offending purely on that profiling basis (Article 5(1)(d)), uses emotion recognition in workplaces or educational institutions (Article 5(1)(f)), or scrapes facial images from the internet to build recognition databases (Article 5(1)(e)).
If your system touches any of these, the conversation ends there. Remove or redesign.
High risk — the full obligation stack (Article 6 + Annex III)
This is where the regulation spends most of its words. A system is high-risk if it falls into one of the eight Annex III areas: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services (including creditworthiness scoring and health/life insurance risk pricing); law enforcement; migration, asylum and border control; and administration of justice and democratic processes.
Classification happens under Article 6. Even within these areas, an Article 6(3) filter applies: if a system poses no significant risk of harm — for example, it performs a narrow procedural task or does preparatory work without influencing individual decisions — it is not high-risk. But any system that profiles natural persons is always high-risk regardless of that filter.
High-risk providers inherit a dense obligation stack: a risk management system (Article 9), data and data governance requirements (Article 10), technical documentation per Annex IV (Article 11), record-keeping and logging (Article 12), transparency to deployers (Article 13), human oversight measures (Article 14), accuracy, robustness and cybersecurity requirements (Article 15), a quality management system (Article 17), and a conformity assessment under Article 43 before going to market. Deployers of high-risk systems carry their own duties under Article 26, including monitoring, log retention, and — for public bodies and certain service deployers — a Fundamental Rights Impact Assessment under Article 27.
Limited risk — transparency duties only (Article 50)
Systems that interact directly with natural persons must disclose that fact. Article 50 requires, among other things, that users are told when they are interacting with a chatbot or AI system (Article 50(1)), that synthetic audio, image, video and text content is marked as AI-generated (Article 50(4)), and that emotion-recognition or biometric-categorisation systems disclose their operation to individuals (Article 50(3)). These duties apply from 2 August 2026. No conformity assessment, no technical documentation pack — disclosure and marking only.
Minimal risk — no mandatory obligations
Everything outside the tiers above. Spam filters, recommendation engines for non-critical content, most productivity tools used internally. No mandatory compliance obligations apply, though the Act encourages voluntary codes of conduct. Most general-purpose productivity tools sit here for the typical deploying company — unless the use case falls into an Annex III area.
GPAI: A Separate Cross-Cutting Category (Chapter V)
General-purpose AI models — the large foundation models on which many applications are built — are governed separately under Chapter V (Articles 51–56). GPAI is not a fifth risk tier. The obligations attach to the model itself, not to its downstream uses.
All GPAI providers must meet baseline obligations under Article 53: technical documentation, downstream transparency information, a copyright compliance policy, and a training-data summary. Models with systemic risk — those trained above 10²⁵ FLOPs or designated by the Commission under Article 51 — face additional duties under Article 55: model evaluation, adversarial testing, incident reporting to the AI Office, and cybersecurity measures.
Chapter V has applied since 2 August 2025. If you build applications on top of a foundation model, the GPAI obligations stay with the model provider. Your obligation is to classify the system you build by what it does — and if that use falls into Annex III, you step into the high-risk stack as a provider under Article 16, potentially via the Article 25 role-shift mechanism.
Who It Covers
The Act defines four roles: provider (develops the system or places it on the market under its own name — Article 16 obligations, the heaviest), deployer (uses it professionally under their authority — Article 26 obligations), importer (brings a non-EU provider's system to the EU market — Article 23), and distributor (makes it available in the supply chain — Article 24). A deployer or distributor becomes a provider if it puts its own name on a system, substantially modifies it, or materially changes its intended purpose (Article 25).
Most companies that adopt third-party AI tools are deployers. Companies that build and ship AI features in their own products are typically providers.
The Key Dates
| Date | What happens |
|---|---|
| 2 February 2025 | Article 5 prohibitions and Article 4 AI literacy apply. Already in force. |
| 2 August 2025 | GPAI obligations (Chapter V), governance, AI Office, and penalties (Article 99) apply. Already in force. |
| 2 August 2026 | General application of the Act, including Article 50 limited-risk transparency. |
| 2 December 2027 | High-risk stand-alone systems (Annex III) must comply. |
| 2 August 2028 | High-risk AI embedded in Annex I regulated products must comply. |
The 2027 and 2028 dates reflect the Digital Omnibus, agreed politically in May 2026, which deferred the original 2 August 2026 high-risk deadline. That deferral applies only to the high-risk regime — the prohibitions, GPAI rules, and penalties timeline were not affected.
For the full annotated timeline, see the EU AI Act compliance timeline.
Penalties (Article 99)
Three tiers, each calculated as whichever is higher — the fixed amount or the percentage of total worldwide annual turnover for the preceding financial year:
€35,000,000 or 7% (Article 99(3)) — breach of the Article 5 prohibitions. Deploying a prohibited application carries the highest ceiling in the Act.
€15,000,000 or 3% (Article 99(4)) — non-compliance with most other obligations. This covers the full high-risk obligation stack, provider and deployer duties, and Article 50 transparency failures. The Art 50 transparency tier sits here, not at the lower €7.5M level.
€7,500,000 or 1% (Article 99(5)) — supplying incorrect, incomplete, or misleading information to notified bodies or competent authorities.
SME and start-up cap (Article 99(6)): for smaller companies, the fine is capped at the lower of the fixed amount or the percentage. A company with €2M annual turnover faces a ceiling of €60,000 (3%), not €15M, for a high-risk breach. That is still material, and it does not shield against the reputational damage of a public finding.
For a full breakdown of how these tiers are calculated and applied, see the EU AI Act penalties guide.
Five Things to Do Now
1. Build your AI inventory. List every AI system your company builds or deploys. For each, record the data inputs, the decision scope, the user population, and your role (provider or deployer). You cannot classify what you have not catalogued.
2. Screen for Article 5 violations. Review each system against the prohibitions. If any use case touches subliminal manipulation, social scoring, workplace emotion recognition, or real-time biometric ID in public spaces, escalate immediately. These are live violations.
3. Classify under Article 6 and Annex III. For each system that survives the Article 5 screen, check whether it falls into an Annex III area. If it does, apply the Article 6(3) filter: does it profile natural persons? Does it pose a significant risk of harm? Documenting this assessment is itself a compliance step.
4. Confirm your AI literacy obligations are met. Article 4 requires that all staff working with AI systems have sufficient AI literacy for their role. This has applied since 2 February 2025, and it covers all AI — not just high-risk systems.
5. Start the high-risk documentation now. The 2027 deadline sounds distant. The Annex IV technical documentation pack, the Article 9 risk management system, and the Article 43 conformity assessment take months to assemble, particularly if your training data governance is undocumented. Starting late means compressing the hardest work into the worst window.
Confir's rule-based classification engine walks you through Articles 5 and 6 via plain-English checklists, derives your role, and generates the Annex IV technical documentation pack and the Article 47 Declaration of Conformity automatically. From €600/year, no consultants required.
Frequently Asked Questions
What is the EU AI Act in simple terms?
Regulation (EU) 2024/1689 is a binding EU law that sorts AI systems into four risk categories — banned, high-risk, limited-risk, and minimal-risk — and attaches legal obligations to the top two. Providers and deployers of high-risk AI must pass a conformity assessment, maintain technical documentation, and implement human oversight before going to market. The regulation applies across all 27 member states and reaches non-EU companies whose AI output is used in the EU.
Which AI systems are banned right now?
Article 5 prohibitions took effect on 2 February 2025 and are already in force. Banned uses include AI that manipulates people subliminally, scores individuals socially to harm their access to services, predicts offending based purely on profiling, recognises emotions in workplaces or schools, scrapes facial images without consent to build recognition databases, or identifies people in real time using biometrics in public spaces for law enforcement (outside narrow statutory exceptions). Violations carry fines of up to €35M or 7% of worldwide turnover under Article 99(3).
When do high-risk AI obligations actually apply?
Under the Digital Omnibus agreed in May 2026, the deadline for stand-alone high-risk AI systems listed in Annex III is 2 December 2027. High-risk AI embedded in products subject to EU product safety law (Annex I — medical devices, machinery, vehicles) must comply by 2 August 2028. The original 2 August 2026 date has been deferred; only Article 50 limited-risk transparency obligations land on that date.
What does "high-risk" actually require from a provider?
A high-risk provider must implement a risk management system (Article 9), maintain training-data governance documentation (Article 10), produce full technical documentation per Annex IV (Article 11), keep logs (Article 12), provide information to deployers (Article 13), build in human oversight mechanisms (Article 14), and meet accuracy and cybersecurity standards (Article 15). Before placing the system on the market, the provider must complete a conformity assessment (Article 43) and register the system in the EU database under Article 49.
What fine does an Article 50 transparency violation carry?
Article 50 breaches — failing to disclose that users are interacting with an AI, or failing to mark AI-generated synthetic media — fall under Article 99(4): €15,000,000 or 3% of worldwide annual turnover, whichever is higher. This is the mid-tier, not the €7.5M/1% tier. The lower tier applies only to supplying incorrect information to authorities (Article 99(5)).
Do GPAI rules apply to companies that just use foundation models?
No. The Chapter V obligations (Articles 51–56) bind the providers of GPAI models — the companies that train and distribute them. If you build an application on top of a foundation model, your obligation is to classify the system you create by its use. If that use falls into Annex III, you are a high-risk provider of that system under Article 16, potentially stepped up via Article 25. The GPAI provider's technical documentation and copyright obligations do not transfer to downstream deployers.
Does the EU AI Act apply to non-EU companies?
Yes. Article 2 applies extraterritorially to any provider placing an AI system on the EU market or putting it into service in the EU, and to any deployer using AI within the EU — regardless of where the company is established. If the output of your system reaches EU users, EU data subjects, or EU decision-making processes, you are in scope.
Related guides
- EU AI Act explained — full guide
- EU AI Act compliance timeline
- EU AI Act penalties — Article 99 breakdown
- risk classification levels guide
- Annex III high-risk systems
- risk management tools comparison
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 7-day free trial.
Start free trial →