EU AI Act sets risk-based duties and staggered deadlines

The EU AI Act regulates systems by their use and risk, banning certain practices while imposing stricter requirements on high-risk applications such as hiring, credit scoring and biometrics. Chatbots and content generators face transparency duties, while minimal-risk systems have no tier-specific obligations. AI literacy requirements apply to every provider and deployer. Prohibitions and literacy duties have applied since 2 Feb 2025, with general-purpose model obligations following on 2 Aug 2025.

The Digital Omnibus amendment moves high-risk compliance deadlines to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I product-embedded systems. New prohibitions covering non-consensual intimate synthetic content and certain child sexual abuse material apply from 2 Dec 2026. Generative systems already on the market must meet Article 50(2) requirements by that date. General-purpose model providers must maintain technical documentation, establish a copyright policy and publish a training-content summary; systemic-risk models face additional evaluation, reporting and cybersecurity duties.

Prohibited practices can trigger fines of €35M or 7% of total worldwide annual turnover. Operator obligations and general-purpose model breaches carry caps of €15M or 3%, generally using whichever amount is higher. SMEs, including start-ups, receive the lower applicable cap, while small mid-cap enterprises receive similar treatment for specified fines.