The EU AI Act already applies to most organisations that build, sell or use AI in the EU, and the board is usually the last to learn which of the company's AI systems it covers and what role the company plays for each one. Regulation (EU) 2024/1689 entered into force on 1 August 2024, its prohibitions have applied since 2 February 2025, and most of its rules, including transparency duties, have applied since 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high-risk deadlines but did not remove them. This briefing is for directors, chief executives, general counsel, chief data and AI officers and CISOs who need the Act in business terms: role classification, prohibited uses, dates, fines, and how to oversee management's programme. It stays at board level; the obligations in detail are in the EU AI Act Compliance Guide. Dates are stated as checked on the Commission's AI Act Service Desk on 8 November 2026.
The risk in one paragraph
AI now sits inside products, hiring tools, credit decisions, customer service and internal copilots, often bought from suppliers and switched on by business teams without legal review. The AI Act regulates these systems by risk and by role: a small set of practices is banned outright, high-risk systems carry heavy obligations for providers and real duties for deployers, systems that interact with people or generate content carry transparency duties, and providers of general-purpose AI models have their own regime. The board's exposure comes from three directions. A banned practice, even inside a vendor feature, attracts the highest fines in the Act. A misread role, where the company believes it is only a user but has rebranded or substantially modified a system, can make it the provider with the full set of obligations. And because the duties apply per system, a company without an AI inventory cannot know its exposure at all.
Why this is a board-level issue now
- Enforcement has started. The Commission's timeline states that from 2 August 2026 the majority of the Act's rules apply and national and EU-level enforcement begins for general-purpose AI models, prohibitions, transparency rules and AI literacy.
- Fines are set as a share of worldwide turnover. Article 99 allows fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher, for prohibited practices; up to EUR 15 million or 3% for most other obligations; and up to EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information to authorities. For SMEs the lower of the two figures applies, and since the Omnibus the same lower cap applies to small mid-cap companies for the EUR 15 million and EUR 7.5 million tiers.
- New bans arrive on 2 December 2026. The Digital Omnibus added prohibitions on AI systems that generate non-consensual intimate imagery of identifiable people and child sexual abuse material. Companies offering image or video generation need to confirm their controls before that date.
- High-risk deadlines are fixed again. Rules for high-risk systems listed in Annex III apply from 2 December 2027, and for high-risk AI in products covered by Annex I from 2 August 2028. Building a quality management system, technical documentation and conformity assessment takes longer than the time remaining for many firms.
- Customers and investors are asking. Enterprise procurement questionnaires increasingly ask which AI systems a supplier uses, in which role and under which risk category. A board that cannot answer is exposed commercially before any regulator arrives.
- Agents raise the stakes. AI agents that call tools, move data and act through service accounts and API keys turn an AI governance gap into a security gap. The Act's expectations of logging, human oversight and cybersecurity for high-risk systems only work if the company knows which identities its AI systems use and what they can reach.
Role classification: provider, deployer and the rest
Obligations in the Act attach to roles, per AI system. The same company can be a provider for one system and a deployer for another.
| Role | Who it is, in plain terms | Headline exposure |
|---|---|---|
| Provider | Develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark | Most obligations: for high-risk systems, risk management, data governance, technical documentation, logging, human oversight design, accuracy and cybersecurity, quality management and conformity assessment |
| Deployer | Uses an AI system under its authority in a professional capacity | For high-risk systems: use according to instructions, assign competent human oversight, monitor operation, keep logs, inform affected workers; some deployers must carry out a fundamental rights impact assessment |
| Importer and distributor | Bring a third-country system onto the EU market, or make it available in the supply chain | Verification duties before making a system available |
| Provider of a general-purpose AI model | Develops a model with broad capabilities, such as a large language model, and makes it available | Documentation, copyright policy and training data summary; more duties for models with systemic risk |
- The role trap: a deployer that puts its own name or trademark on a high-risk system, makes a substantial modification, or changes the intended purpose so that a system becomes high-risk is treated as a provider under Article 25. Boards should ask whether any product team has done this.
- Reach beyond the EU: the Act applies to providers placing systems on the EU market regardless of where they are established, and to providers and deployers outside the EU where the system's output is used in the EU.
See the EU AI Act Provider vs Deployer Obligations Guide for the full split.
Prohibited uses: the zero-tolerance list
Article 5 bans the following practices. These carry the highest fines and have applied since 2 February 2025, except the two Omnibus additions.
| Article 5(1) | Banned practice | Where companies meet it |
|---|---|---|
| (a) | Manipulative or deceptive techniques that materially distort decisions and cause significant harm | Dark patterns in AI-driven sales or retention flows |
| (b) | Exploiting vulnerabilities due to age, disability or social or economic situation | Targeting of vulnerable customers in lending or gaming |
| (ba), (bb) | Generating non-consensual intimate imagery of identifiable people, or child sexual abuse material (from 2 December 2026) | Image and video generation features |
| (c) | Social scoring leading to unrelated or disproportionate unfavourable treatment | Composite behaviour scores used across contexts |
| (d) | Predicting criminal offending based solely on profiling or personality traits | Some fraud and security analytics, if purely profile-based |
| (e) | Building facial recognition databases by untargeted scraping of the internet or CCTV | Third-party identity and surveillance data sources |
| (f) | Inferring emotions in workplaces and education, except for medical or safety reasons | Interview analysis and call-centre sentiment tools aimed at staff |
| (g) | Biometric categorisation to infer race, political opinions, union membership, religious beliefs, sex life or sexual orientation | Image analytics and marketing segmentation |
| (h) | Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions | Mainly public authorities and their suppliers |
The board's question is simple: has management screened every AI system, including vendor features switched on in existing software, against this list, and who signed it off? See the EU AI Act Prohibited Practices Guide.
Dates the board should hold management to
| Date | What applies | Board check |
|---|---|---|
| 2 February 2025 | Definitions, AI literacy and prohibitions | Prohibited practice screening complete; AI literacy measures in place |
| 2 August 2025 | General-purpose AI model obligations; governance bodies; national penalty regimes | If the company provides models, documentation and copyright policy in place |
| 2 August 2026 | Majority of rules, including Article 50 transparency; enforcement begins | Chatbot disclosure, deepfake labelling and machine-readable marking of generated content |
| 2 December 2026 | New prohibitions (ba) and (bb); end of transition for Article 50(2) for some systems already on the market | Generative features checked and marked |
| 2 December 2027 | High-risk systems in Annex III (for example employment, credit scoring, education, essential services, biometrics, critical infrastructure) | Provider conformity and deployer oversight ready |
| 2 August 2028 | High-risk AI in products covered by Annex I (for example machinery, medical devices, toys) | Product conformity assessment route agreed with notified bodies |
Dates have already moved once through the Omnibus. Ask management to track them against the Commission's official timeline rather than secondary summaries. See the EU AI Act Implementation Timeline Tracker.
Five questions for the board to ask
- How many AI systems do we build, buy or use, and which role do we play for each? A credible answer comes from an AI register that includes vendor features and internal tools, not a list of headline projects. See the AI Register and AI Inventory Template.
- Have we screened every system against Article 5, and who signed off? Expect a dated screening record, with emotion recognition and biometric features called out.
- Which of our systems are high-risk, and are we the provider or the deployer? The answer should name the Annex III area, the role and the work needed before 2 December 2027.
- Where could we have become a provider without meaning to? Look for rebranded vendor systems, fine-tuned models put into service under the company's name, and changed purposes.
- Who owns AI compliance, and how does it connect to security, privacy and procurement? A single accountable executive, with AI clauses in supplier contracts and AI systems in the security and privacy risk processes.
Red flags in management answers
- "We only use AI, we do not build it": deployers have real duties for high-risk systems and under Article 50, and may become providers under Article 25.
- "The high-risk rules were delayed": they were moved to fixed dates in 2027 and 2028, not removed. Conformity work takes many months.
- "Our vendor is compliant": the deployer's own obligations, such as human oversight and monitoring, cannot be outsourced to the vendor.
- "We have an AI policy": a policy without an inventory, role classification and risk categorisation per system is not a compliance programme.
- "Legal is handling it": evidence for the Act, such as logs, technical documentation, accuracy and cybersecurity testing, comes from engineering and security teams.
- No view of shadow AI: staff use of unapproved AI tools makes the inventory incomplete. See the Shadow AI Policy Template.
What good looks like
| Area | Good practice |
|---|---|
| Governance | Named accountable executive, AI risk in the enterprise risk register, board review at least annually, AI governance aligned to a management system such as ISO/IEC 42001 or the NIST AI RMF |
| Inventory | A maintained register of AI systems and models, including vendor features, with role and risk category per system |
| Prohibitions | Documented Article 5 screening for every system and every new purchase |
| High-risk readiness | Gap analysis against provider or deployer obligations, with a funded plan to the 2027 or 2028 date |
| Transparency | Disclosure for chatbots, labelling of deepfakes and marking of generated content in place |
| Security | AI systems covered by access control, logging and testing; agent and model credentials governed as non-human identities |
| Suppliers | AI clauses in contracts covering documentation, incident notice and cooperation with authorities |
Where to invest first
- The AI register: every other obligation depends on knowing which systems exist, who owns them, and what role and risk category apply.
- Prohibited practice screening: the highest fines and already in force; quick to do once the register exists.
- Transparency controls: in force since 2 August 2026 for most systems, and visible to customers and regulators.
- High-risk programme: for each high-risk system, a gap analysis and plan, starting with Annex III systems due on 2 December 2027. See the EU AI Act High-Risk AI Systems Guide.
- AI security and identity: logging, access control and testing for AI systems, and governance of the credentials that AI agents and integrations use. See the Board Briefing: AI Security.
Metrics to track
- Number of AI systems in the register, and the percentage with role and risk category assigned.
- Percentage of AI systems and new purchases screened against Article 5.
- Number of high-risk systems by role, and percentage of the gap plan complete against the 2027 and 2028 dates.
- Percentage of customer-facing AI systems with Article 50 disclosure or marking in place.
- Percentage of AI suppliers with AI contract clauses.
- Staff AI literacy coverage for roles that operate or oversee AI systems.
A 90-day plan
- Days 1 to 30: confirm the accountable executive; commission or refresh the AI register, including vendor features; confirm Article 5 screening status, and screen any image or video generation features against the 2 December 2026 prohibitions.
- Days 31 to 60: assign role and risk category to each system; confirm Article 50 transparency controls; identify any case where the company may have become a provider under Article 25.
- Days 61 to 90: approve a funded plan for high-risk systems to the 2027 and 2028 dates; add AI clauses to supplier contract templates; agree the quarterly metrics above and schedule annual board review.
Common failure patterns
- Inventories that miss vendor AI: AI features switched on inside HR, CRM and productivity suites are the most common blind spot, and some, such as emotion analysis aimed at staff, may be prohibited.
- Treating the Omnibus as a reprieve: pausing work on high-risk systems and then running out of time for documentation and conformity assessment.
- Role decided once, never revisited: a product team fine-tunes or rebrands a model and the company quietly becomes a provider.
- Compliance separated from security: the Act expects accuracy, robustness and cybersecurity for high-risk systems, yet AI systems are often outside security testing and logging.
- Literacy as a slide deck: one generic training session for everyone, rather than measures matched to the people who operate and oversee AI systems. See the EU AI Act AI Literacy Obligations (Article 4) Guide.
Practitioner checklist
- Maintain an AI register covering built, bought and embedded AI, with owner, role and risk category per system.
- Record Article 5 screening for every system and every new AI purchase, with a named approver.
- Track the official dates on the Commission's AI Act Service Desk and report changes to the board.
- Check Article 25 role changes whenever a system is rebranded, substantially modified or repurposed.
- Put Article 50 disclosure and marking controls in place for chatbots and generated content.
- Run a gap analysis and funded plan for each high-risk system against its 2027 or 2028 date.
- Add AI clauses to supplier contracts and bring AI systems into security testing and logging.
- Report the six metrics above to the risk or audit committee each quarter.
Standards and references
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- European Commission AI Act Service Desk: Timeline for the implementation of the EU AI Act
- European Commission AI Act Service Desk: Article 5 Prohibited AI practices
- European Commission AI Act Service Desk: Article 99 Penalties
- European Commission: AI Act regulatory framework
How NHI Mgmt Group can help
We provide independent AI and non-human identity risk assessments and board briefings, with a focus on the agents, service accounts, API keys and model credentials that AI systems use to act. Our NHI Foundation Level Training Course includes an agentic AI section for security and IAM teams. Contact us to arrange a briefing.
Related NHI Mgmt Group resources: EU AI Act Compliance Guide · AI Governance Guide · EU AI Act Fundamental Rights Impact Assessment · Board and Director Cyber Liability Guide. This guide summarises Regulation (EU) 2024/1689 as amended for board members and is not legal advice.