EU AI Act: Frequently Asked Questions
The most common questions from compliance teams, legal counsel, and technology leaders navigating the Act.
The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. It entered into force on August 1, 2024, and regulates AI systems according to the risk they pose, banning some practices outright and imposing strict requirements on high-risk systems.
Yes. The Act applies to any provider placing AI systems on the EU market and to any provider or deployer whose AI system's output is used in the EU, regardless of where the company is based. Non-EU providers of high-risk AI must appoint an authorized representative in the EU.
It is phased. Prohibitions applied from February 2, 2025; general-purpose AI obligations from August 2, 2025; most high-risk and transparency obligations from August 2, 2026; and high-risk AI embedded in regulated products from August 2, 2027.
AI that is a safety component of a product covered by EU harmonization law (such as medical devices or machinery), or AI used in Annex III areas: biometrics, critical infrastructure, education, employment, access to essential services like credit and insurance, law enforcement, migration, and the administration of justice.
Social scoring, manipulative or exploitative AI causing significant harm, predictive policing based solely on profiling, untargeted facial image scraping, emotion recognition in workplaces and schools, biometric categorization inferring sensitive traits, and most real-time remote biometric identification in public spaces by law enforcement.
Up to €35 million or 7% of global annual turnover for prohibited practices; up to €15 million or 3% for most other violations; and up to €7.5 million or 1% for supplying misleading information to authorities. The higher amount applies, except for SMEs, where the lower applies.
A provider develops an AI system (or has it developed) and places it on the market under its own name. A deployer uses an AI system under its authority in a professional context. Providers bear most design and conformity obligations; deployers are responsible for proper use, human oversight, monitoring, and in some cases impact assessments.
Providers of general-purpose AI models must maintain technical documentation, share information with downstream providers, comply with EU copyright law, and publish a summary of training content. Models with systemic risk must also perform evaluations, mitigate risks, report serious incidents, and ensure cybersecurity.
If you are a public body, a private entity providing public services, or a deployer of high-risk AI for creditworthiness evaluation or life and health insurance pricing, you must complete a Fundamental Rights Impact Assessment before first deploying the system.
Start with a complete AI inventory, classify each system by risk tier, determine your role for each, and prioritize gap remediation for high-risk systems ahead of August 2, 2026. Build evidence generation, logs, audit trails, incident records, into operations rather than assembling it after the fact.
Go deeper with the risk tiers breakdown or the step-by-step compliance guide.
Track every regulatory milestone in one place with the EU AI Act Deadline Tracker.
Know where your AI systems stand before August 2026.
The 2-minute readiness assessment maps your AI deployments to the EU AI Act's risk tiers and shows where your compliance gaps are.