The EU AI Act, explained: the deadlines that matter and an easier way to think about it
The EU AI Act is the first horizontal law for AI, and it applies by role and risk — not by sector. Here are the deadlines that matter, the penalties, and a simpler mental model for working out what applies to you.
The Obligara team ·
The EU AI Act — Regulation (EU) 2024/1689 — is the world's first horizontal law for artificial intelligence. It is long, it is phased over three years, and most of the coverage it gets is either breathless panic or a shrug. The reality is far more manageable, once you stop trying to read it front to back and start with two questions.
Why it matters, even if you're not an "AI company"
- It's horizontal. It applies to any organisation that makes or uses AI, in any sector — not just to tech firms.
- It's extraterritorial. It applies to providers and deployers outside the EU wherever a system is placed on the EU market or its output is used in the Union. A UK or US company is in scope if it sells into, or serves customers in, the EU.
- It's enforced. With GDPR-scale fines (more on those below), and the power to pull a non-compliant system from the market.
- "AI" is defined broadly — a machine-based system that infers, from inputs, how to generate outputs. Plenty of everyday tools qualify.
You are almost certainly a 'deployer'
Most organisations don't build AI models — they use them, inside HR tools, chatbots, analytics and code assistants. The Act calls you a deployer, and deployer obligations are much lighter than provider obligations. Working out which one you are is most of the battle.
The deadlines that actually matter
The Act entered into force on 1 August 2024, but its obligations switch on in phases. These are the dates worth putting in the calendar:
| Date | What applies |
|---|---|
| 1 Aug 2024 | The Act enters into force |
| 2 Feb 2025 | Prohibited AI practices are banned (Art 5); the AI-literacy duty begins (Art 4) |
| 2 Aug 2025 | Obligations for general-purpose AI (GPAI) models; governance bodies and the penalty regime apply |
| 2 Aug 2026 | The main body applies — including the high-risk obligations for Annex III systems |
| 2 Aug 2027 | Extended transition for high-risk AI that is a safety component of products already regulated under EU law (Annex I) |
2 August 2026 is the one most teams are working towards. It's when the substantial high-risk obligations — risk management, data governance, documentation, human oversight, conformity assessment — become enforceable. A conformity assessment takes longer to stand up than most people expect, so that date arrives faster than it looks.
The easier way to understand it: role × risk
Don't read the Act clause by clause. Ask two questions about each AI system you touch.
1. What is your role?
- Provider — you develop the system (or have it developed) and put it on the market under your own name.
- Deployer — you use the system under your own authority. This is most organisations, most of the time.
- Importer / distributor — you bring someone else's system into the EU market, or make it available.
- GPAI provider — you make a general-purpose ("foundation") model available.
The same system carries different duties depending on which hat you wear. Buy a CV-screening tool and you are its deployer. Build and sell one and you are its provider, with far more to do.
2. What is the system's risk tier?
The Act sorts systems into four tiers:
| Tier | What it means | What it triggers |
|---|---|---|
| Unacceptable | Banned uses — social scoring, manipulative or exploitative techniques, most real-time biometric ID in public spaces | Prohibited outright (since Feb 2025) |
| High-risk | Annex III uses — employment, credit, biometrics, education, essential services, critical infrastructure, law enforcement, migration, justice | The heavy obligations, from Aug 2026 |
| Limited | Systems people interact with — chatbots, and generators of synthetic content | Transparency: tell people it's AI and label AI-generated content (Art 50) |
| Minimal | Everything else — spam filters, most analytics | No specific obligations |
Your obligations are simply the cell where your role meets the system's risk tier. That's the whole model.
So what actually applies to most teams?
For the majority — deployers of limited- or minimal-risk systems — the list is short: build a bit of AI literacy into your teams (Art 4), and be transparent where it's required (tell users they're talking to a bot; label AI-generated content).
It gets serious when a system is high-risk. If you deploy a high-risk system you must use it in line with the provider's instructions, keep meaningful human oversight, retain the logs it produces, and — in many cases — complete a Fundamental Rights Impact Assessment (Art 27). If you provide one, you're into risk management, data governance, technical documentation, accuracy and robustness testing, a quality-management system, and a conformity assessment with CE marking and EU-database registration.
The real trap is not knowing you have a high-risk system
An HR team quietly rolls out AI CV-screening; a lender bolts on an AI credit model. Both are Annex III high-risk — and both often slip in without the compliance team hearing about it. A simple AI inventory, kept current, is the single most useful thing you can do first.
The penalties
The Act is enforced with fines on a GDPR scale (Art 99):
- Up to €35 million or 7% of global annual turnover — for using prohibited practices.
- Up to €15 million or 3% — for breaching most other obligations, including the high-risk ones.
- Up to €7.5 million or 1% — for supplying incorrect or misleading information to authorities.
For SMEs and start-ups, the lower of the fixed sum or the percentage applies. And beyond the fines, a system found non-compliant can be withdrawn from the EU market — which, for many products, is the bigger risk of the two.
Where to start
You don't need a full compliance programme on day one. You need clarity. In order:
- Inventory your AI systems — both what you build and what you buy and use.
- For each, note your role and its risk tier.
- Confirm none fall foul of the prohibited-practice list.
- For anything high-risk, start the real work early.
The quickest way to get that clarity is to answer a few questions and see where you stand.
Check your readiness in a few minutes
Take the free EU AI Act readiness check — 20 questions, an instant readiness score, and a downloadable report with example actions. No sign-up. When you're ready to turn it into tracked work, the EU AI Act module scopes your obligations by role and risk, runs the risk classification and the FRIA, and keeps it all on one evidence store.
Not legal advice
This article is general guidance to help you get oriented — not legal advice. The text of the Act (Regulation (EU) 2024/1689) and your own counsel are the authority on how it applies to your organisation.