EU AI Act
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. It regulates AI by risk tier and applies extraterritorially to anyone whose AI, or its output, is used in the EU.
The EU AI Act entered into force on 1 August 2024 and applies in stages. Rather than treating all AI the same, it sorts systems into risk tiers — prohibited, high-risk, limited-risk and minimal — and attaches obligations proportionate to the risk each poses to health, safety and fundamental rights. The staging matters more than the tiers for planning purposes: the Article 5 prohibitions and the Article 4 AI-literacy duty have applied since 2 February 2025, general-purpose AI model obligations since 2 August 2025, the Article 50 transparency duties since 2 August 2026, the Annex III high-risk regime from 2 December 2027, and high-risk AI embedded in products already regulated under Annex I from 2 August 2028.
- Reg. (EU) 2024/1689
- Art. 4
- Art. 5
- Art. 50
- Art. 113
EU AI Act: why it matters
The Act is a regulation, not a directive: it binds directly in all 27 member states with no national transposition to wait for, so there is no local-law gap to plan around. Its penalty ceilings are set against worldwide annual turnover — up to €35 million or 7% for a prohibited practice, up to €15 million or 3% for most other breaches — which puts it in GDPR territory rather than product-safety territory. And because obligations attach to a role rather than to a company type, an ordinary software buyer can be bound as a deployer without ever having built a model.
EU AI Act in practice
A German insurer that buys an off-the-shelf claims-triage model is not the provider, but it is the deployer of an Annex III system, so it inherits Article 26 duties from December 2027 and must budget for human oversight and log retention now. The same insurer's marketing chatbot is separately caught by Article 50 today — a live obligation, not a future one. The practical result is that one company usually holds several roles across several deadlines at once, and the compliance plan has to be per-system rather than company-wide.
EU AI Act: the mistake people make
Treating "the EU AI Act deadline" as a single date. There is no single date: prohibitions and AI literacy already bite, transparency already bites, and the heavy high-risk regime arrives later. Companies that plan for one deadline routinely miss the ones that have already passed.
EU AI Act: common questions
- Is the EU AI Act already in force?
- Yes. It entered into force on 1 August 2024. The prohibitions in Article 5 and the AI-literacy duty in Article 4 have applied since 2 February 2025, GPAI model obligations since 2 August 2025, and the Article 50 transparency duties since 2 August 2026. The Annex III high-risk obligations follow on 2 December 2027.
- Does the EU AI Act replace the GDPR?
- No. They run in parallel. The GDPR governs personal data; the AI Act governs the AI system itself, including systems that never touch personal data. A high-risk AI system processing personal data has to satisfy both, and a Fundamental Rights Impact Assessment does not discharge a GDPR data protection impact assessment.
- What are the maximum fines under the EU AI Act?
- Up to €35 million or 7% of total worldwide annual turnover for engaging in a prohibited AI practice, whichever is higher; up to €15 million or 3% for breaching most other obligations; and up to €7.5 million or 1% for supplying incorrect or misleading information to authorities.
EU AI Act: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.