The EU AI Act, officially Regulation (EU) 2024/1689 of the European Parliament and of the Council, is the world's first comprehensive legal framework dedicated to artificial intelligence. Signed on 13 June 2024 and published in the Official Journal of the European Union on 12 July 2024, it entered into force on 1 August 2024. It was amended by Regulation (EU) 2026/1744 (the "Digital Omnibus"), published on 24 July 2026.
Its objective is twofold: to protect the fundamental rights of European citizens against the potential risks of AI, while enabling the development of trustworthy AI in the European Union. The regulation takes a risk-based approach: the higher the potential risk of an AI system, the stricter the obligations imposed on it.
The EU AI Act is not a data protection law. It complements the GDPR without replacing it. If you use AI and process personal data, both texts apply simultaneously.
The regulation applies to any organisation that places AI systems on the European market or puts them into service in the European Union, regardless of its geographical location. A US, Canadian or Japanese company that deploys an AI system used in Europe is therefore affected.
A provider is any person or organisation that develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. A company that develops an AI tool and puts it into service for its own use is therefore also the provider of that tool.
A deployer is any person or organisation using an AI system under its authority, in a professional context. If you purchase and use AI-based recruitment software to analyse applications, you are a deployer. Deployers have their own obligations, distinct from those of providers.
The regulation classifies AI systems into four categories according to their potential risk level:
Practices prohibited since 2 February 2025 (Article 5). Examples: social scoring, harmful manipulation, emotion recognition at work or school, real-time remote biometric identification in public spaces for law enforcement (with strict exceptions).
Uses listed in Annex III (employment, education, credit, biometrics, essential services, justice…) or safety components of regulated products (Annex I). Obligations: risk management, documentation, human oversight, logging, registration in the EU database. Applicable from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Chatbots, generated content, deepfakes (Article 50). Tell people they are interacting with AI, mark generated content. Applicable since 2 August 2026.
Spam filters, product recommendations, AI in video games. No specific obligation beyond staff AI literacy measures (Article 4).
Systems classified as high-risk are subject to a set of detailed obligations before being placed on the market and throughout their entire operational life:
Providers must maintain complete technical documentation describing the system: purpose, training data, architecture, performance, limitations, bias testing. This documentation must be available on request from supervisory authorities.
High-risk systems must allow effective human oversight. This means that qualified persons must be able to understand the system's capabilities and limitations, monitor its operation, intervene or stop it, and not blindly rely on its decisions.
A risk management system must be established, maintained and documented throughout the lifecycle of the AI system. This system must identify reasonably foreseeable risks, assess them and implement appropriate management measures.
High-risk systems must automatically record relevant events (logs) during their operation, to enable traceability of decisions and possible post-deployment investigations.
Providers must design their systems so as to allow deployers to understand how they work. Clear instructions for use and information on performance, limitations and residual risks must be provided.
Regulation (EU) 2026/1744 (the Digital Omnibus), published in the Official Journal on 24 July 2026, postponed high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). See our dedicated page.
Violations of the EU AI Act can result in significant financial penalties, calculated as a percentage of annual global turnover:
For SMEs and start-ups, the lower of the two amounts applies (Article 99(6)). Market surveillance authorities in each Member State investigate and sanction; the European Commission is competent for providers of general-purpose AI models.
General-purpose AI models (GPAI) - such as GPT, Claude, Gemini or Llama - have been subject to a specific regime since August 2025 (Articles 51-56). These models are trained on large amounts of data and can perform a wide range of distinct tasks.
Model-specific obligations fall on model providers. If your company builds a product on such a model through an API, it is in principle the provider of its own AI system: its obligations depend on what that system does (transparency, possibly high risk). See our GPAI guide.
Does your product talk to people using a model such as ChatGPT, Claude, Gemini or Mistral? Since 2 August 2026, they must know they are interacting with AI (Article 50).
17 questions for a first indicative estimate. Free.
Start the pre-assessmentSelf-assessment tool, not legal advice.