EU AI Act brings compliance duties for builders and buyers

The EU AI Act imposes risk-based obligations on companies providing or deploying AI systems in the EU, including businesses headquartered elsewhere whose systems’ outputs are used there. Prohibited practices include social scoring and certain manipulative uses. High-risk applications, such as hiring and credit decisions, face requirements covering risk management, data governance, logging and human oversight. Chatbots and AI-generated content carry transparency duties, while most everyday productivity features face no new obligations.

Enforcement and fines for general-purpose AI models became applicable on 2 August 2026, alongside Article 50 transparency duties. The Digital Omnibus amendment delayed the heaviest high-risk requirements until 2 December 2027 for Annex III systems and 2 August 2028 for product-embedded systems, without changing existing bans or transparency obligations. Breaches of prohibited-practice rules or other core obligations can attract penalties up to €35 million or 7% of global annual turnover, whichever is higher.

Businesses should inventory all AI systems, including unapproved employee tools, classify their risks and assign accountable human owners. Consequential applications need review and override mechanisms, documentation and ongoing monitoring. Developers should record data provenance, limitations and evaluations. Buyers should examine model training, data retention, residency, deletion and vendor liability during procurement and renewals. The NIST AI Risk Management Framework and ISO/IEC 42001 offer structures for organizing these controls.