The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. Formally adopted in 2024, it applies a risk-based approach that places increasingly strict obligations on AI systems according to the potential harm they can cause. This guide explains what your organisation needs to do — and by when.
Who Is in Scope?
Like GDPR before it, the EU AI Act has extraterritorial reach. You are in scope if:
- You develop or deploy AI systems used by people in the EU
- You are an AI system provider, deployer, importer, or distributor placing AI on the EU market
- Your company is incorporated outside the EU but your AI system's output is used within the EU
There is no small-business exemption for the prohibition of unacceptable-risk AI. SMEs do receive some proportionate treatment in the high-risk tier but are not exempt from substantive obligations.
The Four Risk Tiers
Unacceptable Risk — Banned from February 2025
- AI systems that manipulate people through subliminal techniques
- Social scoring of individuals by public authorities
- Real-time remote biometric identification in public spaces (with narrow exceptions)
- Predictive policing based purely on profiling
High Risk — Full Obligations from August 2026
High-risk systems are listed in Annex III and include:
- AI used in hiring, CV screening, and performance evaluation of workers
- Credit scoring and creditworthiness assessment tools
- AI used in access to education or vocational training
- Medical devices with AI safety components
- AI for essential public services such as water, gas, or traffic management
- Biometric categorisation and emotion recognition systems
Limited Risk — Transparency Obligations
- Chatbots must disclose they are AI-generated (Article 52)
- Synthetic audio/video (deepfakes) must be labelled as AI-generated
- Emotion recognition systems must notify users they are being assessed
Minimal Risk — Voluntary Codes of Conduct
The vast majority of AI applications (spam filters, recommendation engines, AI game characters) fall into minimal risk. No mandatory obligations apply, though the Commission encourages voluntary codes of practice.
Key Enforcement Dates
| Date | Obligation |
|---|---|
| August 2024 | Regulation enters into force |
| February 2025 | Prohibitions on unacceptable-risk AI apply |
| August 2025 | Rules on General Purpose AI (GPAI) models and governance bodies apply |
| August 2026 | High-risk AI system obligations fully enforced (Annex III) |
| August 2027 | Full regulation applies to all remaining AI systems |
High-Risk AI Provider Obligations (Annex III)
If your AI system is classified as high-risk, you must:
- Establish a risk management system documented throughout the system's lifecycle
- Use sufficiently representative training, validation, and testing datasets
- Maintain technical documentation demonstrating how the system meets requirements
- Implement automatic record-keeping (logging) for traceability
- Provide clear instructions for use to deployers
- Enable human oversight mechanisms — including the ability to stop the system
- Achieve appropriate accuracy, robustness, and cybersecurity
- Register the AI system in the EU database before placing it on the market
- Conduct a conformity assessment (self-assessment or third-party depending on use case)
Penalties for Non-Compliance
- Prohibited AI violations: up to €35 million or 7% of worldwide annual turnover
- Other obligations (high-risk): up to €15 million or 3% of turnover
- Incorrect information to authorities: up to €7.5 million or 1% of turnover
Practical First Steps for 2025
- Inventory all AI systems — create a registry of every AI system you develop, procure, or deploy
- Classify each system's risk tier — map use cases against Annex III to identify high-risk systems
- Assess your highest-risk systems first — conduct gap assessments against Annex III obligations
- Implement an AI governance policy — aligned to ISO 42001 for internationally recognised best practice
- Document your human oversight mechanisms — particularly for any system that affects individuals' rights