EU AI Act Compliance Guide Under the Current Consolidated Law

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law governing artificial intelligence. It was published in the Official Journal on 12 July 2024, entered into force on 1 August 2024, and has provision-specific application dates through 2028. This is not a directive that each Member State transposes differently. It is a regulation, directly applicable in all 27 EU Member States as each provision becomes applicable.

The law takes a risk-based approach. The EU AI Act requirements scale with the danger your AI system poses. If it does something harmless, like filtering spam, you won't face serious obligations. But if it makes decisions about who gets a loan, who passes an exam, or who gets hired, you're in high-risk territory with real documentation, oversight, and governance requirements.

Four types of actors are regulated: providers (who build or commission AI systems), deployers (who use them professionally), importers, and distributors. Most mid-market companies fall into the deployer category. And here's what trips people up: the Act has extraterritorial reach. If you're based outside the EU but your AI system's output is used within the EU, you're in scope. Full stop.

Across 113 articles and 13 annexes, the regulation covers everything from outright bans on certain AI practices to detailed technical documentation requirements for high-risk systems. If you want to start with the basics, our frequently asked questions about the EU AI Act cover the most common entry points. For a hands-on introduction, try the interactive EU AI Act training platform.

Does the EU AI Act apply to your organization?

Probably yes. If you're reading this, chances are you either build AI systems, use AI systems in your business, or sell them into the EU. Any of those puts you in scope.

Article 3 defines four roles. Providers develop AI systems and place them on the market under their own name — they carry the heaviest obligations, including conformity assessment, technical documentation, and post-market monitoring. Deployers use AI systems in a professional capacity. Most SMEs are deployers: they buy AI-powered tools from vendors and use them in operations. Deployer obligations are lighter than provider obligations but still real: human oversight, monitoring, recordkeeping, and in certain cases a fundamental rights impact assessment.

Then there's the trap nobody talks about until it's too late. Article 25 says that if you substantially modify a high-risk AI system or put your own name on it, you become a provider — with all the heavier obligations that come with it. I've seen this catch out at least three mid-market companies who thought they were just "customizing" a vendor tool. Use our Accidental Provider Classifier to check whether this applies to you.

Exemptions exist but they're narrow: purely personal or non-professional use, military and national security, and scientific R&D conducted before the system is placed on the market.

How the EU AI Act classifies AI systems by risk

The entire regulation hinges on one question: how risky is this AI system? The answer determines everything — what you must document, what oversight you need, whether you need a conformity assessment, and how much you can be fined.

Unacceptable risk — banned outright (Article 5)

Some AI practices are simply prohibited. No compliance pathway exists. These include social scoring by governments, subliminal manipulation, exploitation of vulnerable groups, untargeted facial recognition scraping, emotion recognition in workplaces and schools, biometric categorization that infers sensitive attributes like race or political opinion, predictive policing based solely on profiling, and most real-time remote biometric identification in public spaces. Penalties for deploying these systems reach up to €35 million or 7% of global annual turnover. For the full breakdown, read our guide on prohibited AI practices explained.

High-risk — heavy obligations (Annex III + Annex I)

This is where most compliance work happens. High-risk AI includes systems used in recruitment and employment decisions, credit scoring and financial access, insurance underwriting and pricing, education admissions and assessment, critical infrastructure, law enforcement, border control, and justice administration. These systems require conformity assessment, technical documentation, a risk management system, human oversight, data governance, logging, accuracy monitoring, and CE marking. The Annex III high-risk checklist maps every category in plain English. Use the Article 6(3) local exemption generator to check whether your specific system qualifies for an exemption.

Limited risk — transparency obligations (Article 50)

Systems that interact with people must be transparent about what they are. Chatbots must disclose they're AI. AI-generated content must be labeled. Deepfakes must be marked — the Grok deepfake crisis is a live example of why this matters. Emotion recognition systems must inform users they're being analyzed.

Minimal risk — no obligations

Spam filters, AI in video games, basic recommender systems. No specific obligations, though voluntary codes of conduct are encouraged.

What deployers must do: EU AI Act obligations for organizations using AI

Here's something I keep repeating in every assessment I run: your vendor's compliance doesn't automatically make you compliant. Even if the AI system you purchased has a CE mark and a full conformity assessment, you still have independent deployer obligations under Article 26. This catches people off guard.

Article 26 — deployer obligations (applicable 2 December 2027 for Annex III routes; 2 August 2028 for Annex I routes)

If you deploy a high-risk AI system, you must use it in accordance with the provider's instructions of use, implement human oversight measures appropriate to the risk, monitor system performance in production, maintain logs for a minimum of 6 months (longer if sector law requires it), conduct a fundamental rights impact assessment (FRIA) for systems used in public services or affecting natural persons, inform employees and their representatives when AI is used in workplace decisions, and report serious incidents to your national competent authority.

Article 4 — AI literacy (applied from February 2, 2025; amended from July 27, 2026)

This one is already live. Providers and deployers must take measures supporting sufficient AI literacy among relevant staff and other persons dealing with AI on their behalf, proportionate to the context and relevant knowledge, experience, education and training. An LMS completion certificate isn't enough. You need evidence that people understand what the system does, what it can't do, and how to exercise oversight. Our Article 4 AI literacy guide covers what "sufficient" actually looks like in practice.

Article 50 — transparency (generally applicable from 2 August 2026; check the route-specific transition)

If your system generates synthetic content, interacts with people, or performs emotion recognition, you have disclosure obligations. Users must know they're dealing with AI.

For deadline-specific planning, see our current application-date guide for SMEs.

EU AI Act application timeline through 2028

The EU AI Act does not apply all at once. Use the consolidated law and assess each provision-specific date:

Every EU member state must establish at least one AI regulatory sandbox by August 2, 2027. For the latest developments across all deadlines, follow our EU AI Act Weekly Intel.

EU AI Act penalties: fines up to €35 million or 7% of global turnover

The penalty structure is tiered under Article 99, and the numbers are not abstract:

For SMEs and startups, fines are proportionate: you pay the lower of the two amounts (absolute figure or percentage). Large enterprises pay the higher.

Enforcement sits with national market surveillance authorities in each member state, while the EU AI Office has a role for general-purpose AI model oversight. National designations, guidance, and market-surveillance signals change over time. Treat enforcement status as a live monitoring item and track it in the national enforcement tracker.

AI governance frameworks: ISO 42001, NIST AI RMF, and the EU AI Act

The EU AI Act tells you what to do. It doesn't tell you how to build the management system to do it. That's where governance frameworks come in.

ISO/IEC 42001:2023 is the first international standard for AI management systems. It gives you a structured Plan-Do-Check-Act framework for AI governance that maps well to the EU AI Act's requirements around risk management (Article 9), data governance (Article 10), and quality management (Article 17). According to Sprinto's 2025 survey, 76% of organizations plan to use ISO 42001 as their AI governance backbone.

NIST AI RMF 1.0 is the US voluntary framework with four functions: Govern, Map, Measure, Manage. Not legally binding, but widely adopted internationally. It maps to EU AI Act risk management requirements and is particularly useful for transatlantic companies that need to satisfy both US and EU expectations.

Neither framework equals EU AI Act compliance by itself. They're supportive structures — they help you operationalize the obligations, but they don't substitute for meeting specific legal requirements under the regulation. For the detailed control-by-control mapping, see our EU AI Act vs ISO 42001 vs NIST AI RMF crosswalk.

And if you haven't addressed shadow AI yet, you should. Unauthorized use of AI tools by employees creates unmanaged compliance exposure that no governance framework can fix after the fact.

Article 50 transparency obligations: labeling AI-generated content

Article 50 generally applies from 2 August 2026. Providers of in-scope synthetic-content systems must assess Article 50(2) machine-readable marking and detectability; deployers must assess Article 50(4) disclosure for deepfakes and qualifying public-interest text. The Commission published the voluntary Code on 10 June 2026 and final Article 50 guidelines on 20 July 2026. These materials support implementation but do not replace Article 50 or legal review.

Chatbots and virtual assistants must disclose they're AI. Deepfakes must be disclosed. Emotion recognition systems must inform the people being analyzed. These aren't optional best practices. They're legal requirements with penalty backing.

Use our Article 50 Transparency Validator to check your disclosure status, and the AI Content Marking Compliance Checker for synthetic content labeling. For the regulatory context, read our analysis of the Article 50 Code of Practice and the distinction between soft law codes and hard law obligations.

How to start: a practical EU AI Act compliance roadmap for your team

Enough about what the law says. Here's what to do Monday morning. Treat the eight steps below as your EU AI Act compliance checklist — work through them in order, and you'll have a defensible baseline under the current provision-specific timeline.

1. 1. Inventory your AI systems. Catalog every AI system in use, under development, or procured from vendors. Include embedded AI in SaaS tools — that marketing platform's "AI-powered lead scoring" counts. Most organizations I work with discover they have 5-10x more AI systems than they thought. Start with our Shadow AI Discovery Protocol.

2. 2. Classify each system by role. For each system, determine whether you're a provider, deployer, importer, or distributor. The Accidental Provider Classifier catches the edge cases.

3. 3. Classify each system by risk level. Use Annex III to determine if any systems are high-risk. Our sector-specific validators cover recruitment, credit scoring, insurance, education, biometrics, and industrial IoT.

4. 4. Map your obligations. Deployer obligations differ from provider obligations. Run the Deployer Obligation Self-Assessment for a structured walkthrough.

5. 5. Run a governance gap analysis. Compare your current AI governance against ISO 42001 and NIST AI RMF requirements. The ISO/NIST Gap Analyzer does this in your browser.

6. 6. Build your evidence pack. Document your AI system inventory, risk classification decisions, human oversight arrangements, monitoring procedures, incident response plan, and vendor due diligence records. This is a recordkeeping problem before it becomes a tooling problem.

7. 7. Train your team. AI literacy applied from February 2, 2025 and Article 4 was amended from July 27, 2026. Use our AI Literacy Training Planner to build a training program that produces evidence, not just attendance.

8. 8. Monitor and iterate. EU AI Act compliance isn't one-and-done. Post-market monitoring, incident reporting, and regular re-assessment are ongoing obligations. If you're treating this as a project with an end date, you've misunderstood the regulation.

25+ free EU AI Act compliance tools — no login required

Every tool below runs entirely in your browser. No data leaves your device. No account needed. They're built for compliance officers, CTOs, CISOs, and DPOs who need fast, practical answers — not another SaaS demo.

Start here

Deep dive — specific obligations

Governance & risk program

Sector-specific Annex III validators

Learning & training