EU AI Act Compliance Guide
Several obligations are already in force: prohibited AI practices since , AI literacy requirements (Article 4) since , and GPAI model rules since . High-risk AI system obligations apply from (updated via EU AI Omnibus, ).
What is the EU AI Act?
The EU AI Act (Regulation 2024/1689) is the European Union's landmark legislation establishing a harmonised legal framework for artificial intelligence. It applies to providers, deployers, importers, distributors, and product manufacturers placing or putting AI systems into service in the EU market — regardless of where those companies are established.
The regulation takes a risk-based approach, imposing requirements proportional to the potential harm an AI system could cause. Non-compliance can result in fines of up to €35 million or 7% of global annual turnover.
The Four Risk Tiers
The EU AI Act classifies all AI systems into one of four risk categories, each with a different compliance burden.
Unacceptable Risk
BANNEDAI systems deemed a clear threat to fundamental rights are prohibited outright.
- Subliminal manipulation or deceptive techniques
- Exploitation of vulnerabilities of specific groups
- Social scoring by public authorities
- Real-time remote biometric ID in public spaces (with narrow exceptions)
- Emotion recognition in workplaces and schools
High Risk
STRICT OBLIGATIONSSystems posing significant risk to health, safety, or fundamental rights. Permitted but subject to extensive requirements before market placement.
- Critical infrastructure management (water, electricity, transport)
- Education and vocational training (admissions, grading)
- Employment: CV screening, interview analysis, task allocation
- Essential private/public services: credit scoring, benefits assessment
- Law enforcement and border control
- Administration of justice and democratic processes
Limited Risk
TRANSPARENCY OBLIGATIONSSystems that interact with people must disclose that the user is interacting with an AI, or that content is AI-generated.
- Chatbots and conversational AI
- Deepfake generation systems
- AI-generated text published for public information
Minimal Risk
FEW OBLIGATIONSThe vast majority of AI systems fall here — spam filters, AI-enabled video games, inventory management tools. No mandatory requirements, though voluntary codes of conduct are encouraged.
Key Obligations for High-Risk Systems
Providers of high-risk AI systems must satisfy all of the following before placing a system on the EU market.
Risk Management System
Establish, implement, document and maintain a continuous risk management process throughout the entire lifecycle of the AI system.
Data Governance
Training, validation and testing data must meet quality criteria: relevance, representativeness, freedom from errors, and completeness.
Technical Documentation
Detailed technical documentation must be drawn up before the system is placed on the market and kept up to date throughout its lifecycle.
Human Oversight
Systems must be designed to allow effective oversight by natural persons during the period of use, including the ability to intervene or halt.
Accuracy & Cybersecurity
Systems must achieve an appropriate level of accuracy, robustness, and cybersecurity, and must perform consistently throughout their lifecycle.
Conformity Assessment
Before market placement, providers must undergo a conformity assessment — either self-assessment or third-party audit, depending on the use case.
Deployer vs Provider: which are you?
The EU AI Act assigns different obligations depending on your role. Most companies are deployers, not providers — and that distinction decides how much documentation you actually need.
Deployer (most companies)
You use a third-party AI system under your own authority — including building features on top of the OpenAI or Anthropic API. Using ChatGPT, Copilot, Gemini, or an API inside your own app makes you a deployer.
Deployer duties (Art. 26) are lighter: use the system per the provider's instructions, ensure human oversight, inform affected people, keep logs, and run a Fundamental Rights Impact Assessment where required. You do not draw up the provider's technical documentation or conformity declaration.
Provider
You develop an AI system, train or substantially fine-tune a model, or place an AI system on the market under your own name or brand. Simply calling a third-party API does not make you a provider.
Providers carry the full Art. 16 obligations: risk management system, data governance, technical documentation, conformity assessment, CE marking, and post-market monitoring.
Enforcement Timeline
Regulation enters into force
The EU AI Act officially entered into force 20 days after publication in the Official Journal.
Prohibited practices banned
Unacceptable risk AI systems (Article 5) are prohibited. Governance bodies and AI Office established.
GPAI model obligations
Rules for general-purpose AI (GPAI) models apply, including transparency obligations and codes of practice.
High-risk system obligations
Standalone high-risk AI systems (Annex III) must fully comply. Extended from August 2026 via EU AI Omnibus agreement (May 2026).
Embedded high-risk systems
High-risk AI systems embedded in regulated products (medical devices, machinery, toys, lifts, watercraft) must comply.
Official Sources & Further Reading
Primary regulatory texts and official guidance referenced in this guide.
EU AI Act — Full Regulation Text
Regulation (EU) 2024/1689 — complete legal text as published in the EU Official Journal
EUR-Lex ↗European Commission — AI Act Hub
Official EC page on the AI Act regulatory framework, implementation status, and guidance documents
European Commission ↗EU AI Office
The EU body responsible for overseeing GPAI models and coordinating with national market surveillance authorities
European Commission ↗Article-by-Article Navigator
Plain-language breakdown of every article in the EU AI Act with explanatory notes and cross-references
Future of Life Institute ↗Article 5 — Prohibited AI Practices
Complete list of AI applications unconditionally banned in the EU, in force since February 2025
AI Act Navigator ↗Annex III — High-Risk AI Categories
The definitive list of use cases classified as high-risk under Annex III, requiring full compliance obligations
AI Act Navigator ↗How ComplyLayer helps with EU AI Act