EU AI Act sets phased deadlines and compliance duties

The EU AI Act regulates AI according to risk, banning certain practices, imposing strict requirements on high-risk systems and requiring transparency for others. It covers providers, deployers, importers and distributors, including companies outside the EU when their systems enter the European market or their outputs are used in the Union.

Bans and AI literacy requirements apply from 2 February 2025, with general-purpose model obligations following on 2 August 2025. General application and transparency requirements began on 2 August 2026. Generative systems already marketed before that date have until 2 December 2026 to mark their output.

The Digital Omnibus postponed high-risk obligations to 2 December 2027 for uses including employment, education and credit, and to 2 August 2028 for systems embedded in regulated products. New bans taking effect on 2 December 2026 cover systems generating realistic intimate images without consent and systems generating child sexual abuse material. Companies should check the consolidated rules on EUR-Lex because requirements may change.

Businesses should inventory their systems, classify risks and roles, eliminate prohibited uses, train staff and establish oversight, documentation and supplier-selection rules. High-risk systems require conformity assessment before market placement. Maximum fines are EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for other breaches, and EUR 7.5 million or 1% for incorrect information supplied to authorities. SMEs and small mid-cap companies face the lower applicable amount.