The EU AI Act is the European Union regulatory framework for artificial intelligence. It does not impose the same obligations on every AI product or organisation. Compliance depends on what the technology is, its intended purpose, the operator's role, its risk classification and which provisions of the Act apply to that activity.
What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI. It is a European Union regulation that establishes rules for AI systems, general-purpose AI models, and the organisations that develop, provide, import, distribute or use them. The Act entered into force on 1 August 2024 and applies through a phased timetable set in Article 113. It is not a voluntary code, a technical standard, or a single compliance checklist applied identically to every product. Its structure is risk-based: it prohibits defined practices, sets requirements for high-risk systems, creates targeted transparency duties, and imposes separate duties on providers of general-purpose AI models. Reading the consolidated text is essential, because the 2026 amendments changed application dates and added new prohibitions.
Where should analysis start: the system and its intended purpose?
Analysis should start with the AI system or model and its intended purpose, before any risk label is considered. Intended purpose is the use for which a system is intended by the provider, including the specific context and conditions of use, as specified in the instructions for use, promotional material and technical documentation. The first step is to determine whether the technology meets the Article 3(1) definition of an AI system, or whether a general-purpose AI model is involved, and to record what the system is designed and supplied to do, who will use it, and who will be affected by it. The same underlying model can sit inside several systems with different purposes, and each system needs its own assessment. A vague purpose, such as improving decisions in general, cannot be tested against the annexes and should be specified before classification begins.
How does the risk structure work?
The Act separates four layers that are often confused. Article 5 prohibits defined practices outright, subject to the exceptions and conditions stated in that article. Article 6 and Annexes I and III identify high-risk systems, through a product route and a use-case route, subject to the Article 6(3) filter. Article 50 creates targeted transparency duties for specified interactions and synthetic content, which can apply to systems that are not high-risk. Chapter V creates separate duties for providers of general-purpose AI models, including models with systemic risk. These layers can overlap in one product: a system can be high-risk and also subject to transparency duties, and can be built on a general-purpose model with its own duties. Many ordinary AI uses fall outside the high-risk category while still facing literacy, transparency, data protection and sectoral duties.
Who can have obligations under the Act?
Obligations attach to defined roles, not to company types. A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, except where the use is personal and non-professional. Importers place on the market systems bearing a third-country person's name, distributors make systems available in the supply chain, and authorised representatives act under a written mandate for providers established outside the Union. Product manufacturers can also be treated as providers in the circumstances Article 2 and Article 25 set. One organisation can hold several roles at once, for different systems or for different activities, and Article 25 can change the role where branding, substantial modification or intended purpose changes. Roles must therefore be recorded activity by activity.
Which AI Act rules are already relevant in 2026?
By late 2026, several stages of the phased timetable have already begun to apply. General provisions, including AI literacy under Article 4 and the original prohibited practices under Article 5, apply from 2 February 2025. General-purpose AI model rules under Chapter V and governance provisions apply from 2 August 2025. Regulation (EU) 2026/1744 entered into force on 27 July 2026 and amended the application dates in Article 113. The majority of the remaining rules, including Article 50 transparency rules, apply from 2 August 2026, with enforcement for the applicable rules. Organisations should not rely on pre-amendment timelines that omitted later changes, and should check the consolidated text and the Commission AI Act Service Desk timeline for the provision that governs their system, rather than treating 2 August 2026 as the date on which the whole Act began.
Continue with what the EU AI Act is.
Which high-risk dates should businesses still track?
Not every high-risk provision follows the same date. Chapter III Sections 1 to 3 high-risk rules apply for Annex III systems under Article 6(2) from 2 December 2027, and for Annex I product-embedded systems under Article 6(1) from 2 August 2028, under Article 113 as amended by Regulation (EU) 2026/1744. Those dates were 2 August 2026 and 2 August 2027 respectively before the Omnibus amendments, so older summaries give the wrong dates and should not be relied on. A further date falls between them: 2 December 2026, when the two new Article 5 prohibitions apply and the Article 50(2) transition ends for certain systems already placed on the market before 2 August 2026. Member States should also have at least one AI regulatory sandbox operational by 2 August 2027, in the Service Desk wording, which states should have rather than a hard obligation. Classification and documentation should begin well before the relevant date, because the evidence work takes time.
What does a practical compliance sequence look like, and what does it not decide?
A practical sequence is to inventory AI systems and models, document intended purpose, identify operator roles, screen prohibited practices under Article 5, determine risk classification under Article 6 with the annexes, check transparency duties under Article 50 and model duties under Chapter V, identify documentation and conformity requirements, implement human oversight and monitoring, and track the application dates that govern each provision. Each step should be recorded with the evidence examined, the conclusion, the reviewer and the revisit trigger, so that a later reviewer or authority can follow the reasoning. This pillar guide does not decide whether any particular system is prohibited or high-risk, what any particular organisation must do for a specific system, or whether a classification is correct. Those determinations need the full facts and the consolidated text, confirmed with a competent authority or legal adviser where the answer is contested or consequential.
Frequently asked questions
Does the EU AI Act apply to every AI system?
The Act can apply to many AI systems, but the obligations differ depending on the system, its intended purpose, the operator role, the risk classification and the other regulatory conditions. Scope must be checked under Article 2, the definitions under Article 3, and the classification under Articles 5 and 6, before any conclusion about duties is drawn.
Does every AI system become high-risk under the AI Act?
No. High-risk classification is a specific regulatory assessment under Article 6 and the annexes, subject to the Article 6(3) filter. Many AI systems are not high-risk even though other AI Act requirements, such as AI literacy or transparency duties, and other laws, may still apply.
What should a company check first for AI Act compliance?
A useful first sequence is to identify the AI system or model, document its intended purpose, determine the organisation's operator role, and then assess prohibited practices, high-risk classification, transparency duties and application dates, recording the evidence and the reviewer at each step.
Why do AI Act deadlines matter when classifying an AI system?
Different parts of the Act follow different application dates, as amended by Regulation (EU) 2026/1744, so organisations need to know both what requirements apply and when those requirements become applicable for the relevant system or role. A correct classification with the wrong date can lead to a system being supplied too early or to work being delayed that should already have begun.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗