The EU AI Act applies to any organisation that builds, sells or uses AI in the EU market, and most organisations still cannot say which of their AI systems it covers or which role they play for each one. Regulation (EU) 2024/1689 is a product-safety style law with obligations that depend on risk category and role, and the Digital Omnibus on AI (Regulation (EU) 2026/1744) has changed several of its dates and duties. This guide turns the regulation into a compliance programme: scope and roles, risk categories, high-risk, transparency and general-purpose AI obligations, AI literacy, penalties, harmonised standards, and a phased plan from AI inventory to conformity. It is written for compliance, security and AI governance leads. Dates are stated as of 17 October 2026.
Key takeaways
- Role and category decide everything. The same model can make you a provider for one use case and a deployer for another, and each system's risk category sets which articles apply.
- Some duties already apply. Prohibitions and AI literacy have applied since 2 February 2025, general-purpose AI model rules since 2 August 2025, and most remaining rules, including Article 50 transparency, since 2 August 2026.
- High-risk deadlines moved, not disappeared. The Digital Omnibus on AI, in force since 27 July 2026, set 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I product systems.
- Article 15 makes AI security a legal requirement. High-risk systems must resist data poisoning, model poisoning, adversarial examples and confidentiality attacks, and perform consistently throughout their lifecycle.
- Start with the inventory. Classification, gap assessment and evidence all depend on a complete register of AI systems, models, suppliers and uses, including AI embedded in purchased software.
Scope and roles
The Act applies to providers placing AI systems or general-purpose AI (GPAI) models on the EU market wherever they are established, to deployers in the EU, and to non-EU providers and deployers whose system output is used in the EU. Article 3 defines the operators:
| Role | Who it is (Art. 3) | Core high-risk duties |
|---|---|---|
| Provider | Develops an AI system or GPAI model (or has one developed) and places it on the market or into service under its own name | Art. 16: requirements of Arts 9 to 15, QMS (Art. 17), documentation, logs, conformity assessment (Art. 43), EU declaration, CE marking, registration, corrective action |
| Deployer | Uses an AI system under its authority, except for personal non-professional use | Art. 26: use per instructions, human oversight, input data quality, monitoring, logs for at least six months, informing workers and affected people; FRIA in some cases (Art. 27) |
| Importer | EU-established person placing on the market a system bearing a non-EU provider's name | Art. 23: verify conformity assessment, documentation, CE marking and authorised representative |
| Distributor | Other person in the supply chain making the system available | Art. 24: verify CE marking, declaration and instructions; do not supply non-conforming systems |
- Becoming a provider by accident: under Article 25 a deployer, importer or distributor becomes the provider of a high-risk system if it puts its name or trademark on it, makes a substantial modification, or changes its intended purpose so that it becomes high-risk, for example repurposing a chatbot for hiring decisions.
- Non-EU providers of high-risk systems and GPAI models must appoint an EU authorised representative.
Risk categories
The Commission describes four levels: unacceptable (banned), high (strict obligations), transparency (disclosure) and minimal or no risk, such as spam filters, with no new rules. GPAI models are a separate regime.
| Category | Articles | Examples | Applies from |
|---|---|---|---|
| Prohibited practices | Art. 5 | Social scoring, emotion recognition at work or in education, untargeted facial image scraping | 2 February 2025; new points (ba) and (bb) from 2 December 2026 |
| High-risk: Annex III use cases | Art. 6(2), Arts 8 to 27 | CV sorting, credit scoring, exam scoring, biometric identification, critical infrastructure safety components | 2 December 2027 |
| High-risk: product safety route | Art. 6(1), Annex I | AI safety components of machinery, medical devices, toys, lifts, where third-party conformity assessment applies | 2 August 2028 |
| Transparency | Art. 50 | Chatbots, generative content, deepfakes, emotion recognition notices | 2 August 2026 (with a transitional period for Art. 50(2)) |
| GPAI models | Arts 51 to 55 | Foundation models offered to others; systemic-risk models above 10^25 FLOPs training compute | 2 August 2025 |
Prohibited practices
Article 5 bans AI that uses harmful manipulation or deception; exploits vulnerabilities due to age, disability or social or economic situation; performs social scoring; predicts criminal offending based solely on profiling or personality traits; builds facial recognition databases by untargeted scraping of the internet or CCTV; infers emotions in workplaces and education (except for medical or safety reasons); categorises people biometrically to infer protected characteristics; and performs real-time remote biometric identification in public spaces for law enforcement, subject to narrow exceptions. The Omnibus added point (ba), systems generating non-consensual intimate imagery of identifiable people, and point (bb), child sexual abuse material, applying from 2 December 2026. Check vendor features too: emotion detection in interview or call-centre software is a common blind spot.
Classifying Annex III systems
Annex III covers eight areas: biometrics; critical infrastructure; education; employment and worker management; access to essential private and public services; law enforcement; migration, asylum and border control; and administration of justice and democratic processes. Under Article 6(3) a listed system is not high-risk if it poses no significant risk and only performs a narrow procedural task, improves the result of a completed human activity, detects decision-making patterns without replacing human assessment, or performs a preparatory task. It never applies where the system profiles natural persons, and the provider must document the assessment before placing on the market and register under Article 49(2).
Timeline as of 17 October 2026
Article 113, as amended by Regulation (EU) 2026/1744 (published 24 July 2026, in force 27 July 2026), sets these dates, which the Commission's AI Act Service Desk timeline confirms. The AI Governance Guide covers the Omnibus changes in detail.
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Chapters I and II: definitions, AI literacy (Art. 4), prohibitions (Art. 5) | In force |
| 2 August 2025 | GPAI model obligations, governance, notified bodies, penalties chapter (except GPAI fines) | In force |
| 2 August 2026 | General application: Art. 50 transparency, enforcement, AI Office powers over GPAI | In force |
| 2 December 2026 | New prohibitions (ba) and (bb); end of the transitional period for Art. 50(2) marking by generative systems on the market before 2 August 2026 | Upcoming |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply; at least one regulatory sandbox per Member State | Upcoming |
| 2 December 2027 | High-risk obligations for Annex III systems | Upcoming |
| 2 August 2028 | High-risk obligations for Annex I product systems | Upcoming |
High-risk obligations
Providers carry most of the burden; build evidence during development, not as an end-stage audit.
| Requirement | Article | Evidence to produce |
|---|---|---|
| Risk management system | Art. 9 | Lifecycle risk register, foreseeable misuse analysis, test results |
| Data and data governance | Art. 10 | Dataset documentation: provenance, preparation, bias examination, gaps |
| Technical documentation | Art. 11, Annex IV | Design, training, testing and monitoring records; simplified form for SMEs and small mid-caps |
| Record-keeping | Art. 12 | Automatic event logging for traceability over the system's lifetime |
| Transparency to deployers | Art. 13 | Instructions for use, including capabilities, limitations and declared accuracy |
| Human oversight | Art. 14 | Ability to interpret, override and stop the system; automation bias training |
| Accuracy, robustness, cybersecurity | Art. 15 | Declared accuracy metrics, resilience testing, AI-specific security testing |
| Quality management system | Art. 17 | Documented QMS proportionate to organisation size |
| Conformity assessment, declaration, CE marking | Arts 43, 47, 48 | Internal control (Annex VI) or notified body assessment (Annex VII); EU declaration of conformity |
| Registration | Art. 49 | Entry in the EU database before placing on the market |
| Post-market monitoring and incidents | Arts 72, 73 | Monitoring plan; serious incident reports within 15 days, 10 days for a death, 2 days for widespread infringement or critical infrastructure disruption |
- Conformity route: most Annex III systems use internal control under Annex VI. Biometric systems in Annex III point 1 may need a notified body where harmonised standards are not applied in full. Annex I products follow the conformity assessment of their sectoral legislation.
- Article 15 security: systems must resist "attempts by unauthorised third parties to alter their use, outputs or performance", with measures addressing "data poisoning", "model poisoning", "adversarial examples or model evasion" and "confidentiality attacks or model flaws". See the AI Guardrails and AI Firewalls Guide.
- Deployers: Article 26 requires oversight by people with "the necessary competence, training and authority", input data that "is relevant and sufficiently representative", monitoring with suspension where a risk appears, logs kept "at least six months", notice to workers' representatives before workplace use, and notice to people subject to Annex III decisions. Use the provider's Article 13 information in the GDPR Article 35 DPIA.
- Fundamental rights impact assessment: Article 27 requires a FRIA before first use by public bodies, private entities providing public services, and deployers of Annex III credit scoring and life or health insurance pricing systems. It complements the DPIA; see the AI and Privacy Guide.
Transparency obligations under Article 50
- Interaction (providers): people must be "informed that they are interacting with an AI system" unless it is obvious from context. This covers customer chatbots and voice agents.
- Synthetic content (providers): generated audio, image, video and text must be "marked in a machine-readable format and detectable as artificially generated or manipulated", as far as technically feasible. Assistive editing that does not substantially alter input is exempt.
- Emotion recognition and biometric categorisation (deployers): inform the people exposed and process personal data under the GDPR.
- Deepfakes and public-interest text (deployers): disclose that content is generated or manipulated; artistic or satirical works need only a light-touch disclosure, and text under human editorial responsibility is exempt.
General-purpose AI models
Every GPAI model provider must keep technical documentation, give downstream providers the information they need to comply, adopt a copyright compliance policy and publish a summary of training content (Art. 53). A model is presumed to have high-impact capabilities, and so systemic risk, when cumulative training compute is greater than 10^25 floating-point operations, or when the Commission designates it (Art. 51). Systemic-risk providers must also, under Article 55, evaluate models including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office "without undue delay", and ensure "an adequate level of cybersecurity protection" for the model and its physical infrastructure.
- Code of Practice: the General-Purpose AI Code of Practice, published 10 July 2025, has Transparency and Copyright chapters for all GPAI providers (including a Model Documentation Form) and a Safety and Security chapter for systemic-risk models. The Commission and AI Board confirmed it is an "adequate voluntary tool"; non-signatories must show alternative adequate means.
- If you only use a model: building on a third-party model usually makes you a provider or deployer of an AI system, not a GPAI model provider. Ask suppliers for their Article 53 documentation and Code of Practice status; see the AI Supply Chain and AI-BOM Guide.
AI literacy
Article 4 has applied since 2 February 2025. As replaced by the Omnibus, it requires providers and deployers to "take measures to support the development of AI literacy" of staff and others operating AI on their behalf, without having to "guarantee any specific level of AI literacy of any individual". In practice: role-based training for people who build, buy, oversee or rely on AI, with records, and deeper training for Article 26 overseers.
Penalties
| Infringement | Maximum fine (Art. 99) |
|---|---|
| Prohibited practices (Art. 5) | EUR 35 million or 7% of worldwide annual turnover, whichever is higher |
| Operator obligations: providers (Art. 16), representatives, importers, distributors, Art. 25, deployers (Art. 26), notified bodies, transparency (Art. 50) | EUR 15 million or 3%, whichever is higher |
| Incorrect, incomplete or misleading information to authorities or notified bodies | EUR 7.5 million or 1%, whichever is higher |
| GPAI model providers (Art. 101, imposed by the Commission) | EUR 15 million or 3%, whichever is higher |
For SMEs and start-ups each cap is the lower of the two figures; for small mid-caps the lower figure applies to the EUR 15 million and EUR 7.5 million tiers. Article 99(7) counts cooperation, technical and organisational measures and self-reporting when setting fines.
Harmonised standards
Harmonised standards give a presumption of conformity once referenced in the Official Journal. The Commission asked CEN and CENELEC for standards in ten areas: risk management, governance and quality of datasets, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. The work sits in joint technical committee CEN-CENELEC JTC 21. As of the Commission's August 2026 update, prEN 18286, a quality management system standard for AI Act purposes supporting Article 17, was the first to reach public enquiry (30 October 2025), and no publication dates were given. Until standards are cited, build to the article text; ISO/IEC 42001 is a useful management system scaffold but does not confer presumption of conformity.
Building the compliance programme
- Inventory: list every AI system and model, including AI features in SaaS and purchased products, with owner, purpose, supplier, data and affected people. Shadow AI is the usual gap; the Samsung ChatGPT leak shows how AI use can bypass any register. See the Shadow AI Discovery Guide.
- Classify: record the role, any Article 5 issue, Annex III or Annex I status, any Article 6(3) derogation with reasoning, Article 50 duties and GPAI status. Have legal review borderline cases.
- Stop prohibited uses now: decommission or redesign anything caught, and exclude prohibited features in supplier contracts.
- Gap assessment: compare each high-risk system against Articles 9 to 17 (providers) or Articles 26 and 27 (deployers), and each transparency case against Article 50; record gaps with owners and dates before 2 December 2027 or 2 August 2028.
- Governance: assign accountable owners, an AI risk committee and approval gates; reuse existing QMS, privacy and security processes. See the AI Governance Guide.
- Remediate and evidence: technical documentation, logging, oversight design, Article 15 testing, instructions for use and supplier contract clauses.
- Pilot conformity: run a full internal conformity assessment on one high-risk system, including a draft EU declaration and registration, then fix the template before scaling.
- Operate and roll back: post-market monitoring, incident playbooks with the 2, 10 and 15 day clocks, and re-classification on every substantial modification. If a system cannot be brought into line, withdraw it or remove the high-risk use rather than run it non-compliant.
Choosing the right depth
- Deployer-only organisations: focus on inventory, prohibited-practice checks, Article 50 notices, Article 26 oversight and logs, FRIA where required, and supplier evidence.
- Providers of high-risk systems: need a QMS, Annex IV documentation and conformity assessment; start now, as evidence is hard to recreate later.
- SMEs and small mid-caps: use the Omnibus simplifications (simplified technical documentation, proportionate QMS) and regulatory sandboxes.
- Agentic AI: agents acting for users raise oversight and logging questions; see the Agentic AI Compliance Guide.
Where identity fits
Article 12 logging is only useful if actions are attributable to a person, service account or agent identity. Oversight under Articles 14 and 26 needs named overseers with the access to override or stop the system, and nobody else. Article 15 poisoning and confidentiality attacks are often access failures: over-privileged pipelines, leaked model API keys or writable training data stores. Treat model, pipeline and agent credentials as non-human identities with owners, scopes and rotation.
Measuring the programme
| Metric | Target |
|---|---|
| AI systems in the inventory with role and category recorded | 100%, re-validated each quarter |
| High-risk systems with closed gaps against Articles 9 to 15 | Rising towards 100% before the applicable date |
| Suppliers that provided Article 13 or Article 53 documentation | All suppliers of in-scope systems |
| Staff in AI-related roles with recorded AI literacy training | Rising; 100% for named overseers |
| Generative and chatbot deployments with Article 50 disclosure and marking verified | 100% |
| Serious incident drills completed within the reporting clocks | At least annually per high-risk system |
Framework mapping
| AI Act area | ISO/IEC 42001:2023 | NIST AI RMF 1.0 | ISO/IEC 27001:2022 |
|---|---|---|---|
| Inventory and classification | Clause 4.3 scope of the AI management system | GOVERN 1.6 (inventory), MAP 1 | A.5.9 Inventory of information and other associated assets |
| Risk management (Art. 9), FRIA (Art. 27) | Clause 6.1; A.5 Assessing impacts of AI systems | MAP, MEASURE, MANAGE | Clause 6.1.2 risk assessment |
| Data governance (Art. 10) | A.7 Data for AI systems | MEASURE 2 | A.5.34 Privacy and protection of PII |
| Logging (Art. 12), cybersecurity (Art. 15) | A.6 AI system life cycle | MEASURE 2, MANAGE 4.1 | A.8.15 Logging; A.8.16 Monitoring activities |
| Supplier duties (Arts 23 to 25, 53) | A.10 Third-party and customer relationships | GOVERN 6.1 | A.5.19 to A.5.21 supplier relationships |
| AI literacy (Art. 4) | Clause 7.2 competence, 7.3 awareness | GOVERN 2.2 | A.6.3 Awareness, education and training |
See the Control Mapping Guide for building a single control set across frameworks.
Common failure patterns
- Inventory limited to in-house models. AI features in HR, CRM and contact-centre software are where Annex III and Article 5 issues hide.
- Assuming deployer status. Fine-tuning, rebranding or repurposing a system can make you the provider under Article 25.
- Waiting for 2027. Prohibitions, AI literacy, GPAI and Article 50 duties already apply.
- Undocumented derogations. Using Article 6(3) without a written assessment, or for a profiling system.
- Oversight on paper. Named reviewers without the authority, training or technical means to override or stop the system.
- Security left out. No Article 15 testing for poisoning or evasion, and model credentials without owners.
Practitioner checklist
- Build an AI inventory, including supplier products, with role, risk category and Article 50 duties.
- Confirm no system or vendor feature performs an Article 5 prohibited practice, including the points added from 2 December 2026.
- Document every Article 6(3) derogation and register it where required.
- Run gap assessments against Articles 9 to 17 or 26 and 27, with owners and dates before the 2027 and 2028 deadlines.
- Implement chatbot disclosure and machine-readable marking for generative outputs.
- Obtain Article 13 instructions and Article 53 documentation from suppliers, and add AI Act clauses to contracts.
- Deliver and record role-based AI literacy training, with deeper training for human overseers.
- Test high-risk systems for poisoning, evasion and confidentiality attacks under Article 15.
- Write serious incident playbooks with the 2, 10 and 15 day clocks.
- Track CEN-CENELEC JTC 21 standards and Commission AI Act updates.
Standards and references
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- European Commission: AI Act regulatory framework
- European Commission AI Act Service Desk: Timeline for the implementation of the EU AI Act
- European Commission: The General-Purpose AI Code of Practice
- European Commission: Standardisation of the AI Act
- artificialintelligenceact.eu: EU AI Act Article 113, Entry into force and application (consolidated)
- artificialintelligenceact.eu: EU AI Act Article 15, Accuracy, robustness and cybersecurity
Related NHI Mgmt Group resources: AI Governance Guide · AI and Privacy Guide · Agentic AI Compliance Guide · GDPR Compliance Guide for Security Teams. This guide summarises the EU AI Act as amended by the Digital Omnibus on AI as of 17 October 2026 and is not legal advice.