EU AI Act sets staged duties for AI providers and deployers

The EU AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and regulates AI systems by use case and risk level. It divides systems into four risk levels: prohibited practices, high-risk systems, transparency-risk systems and minimal-risk systems. Bans have applied since February 2025, while general-purpose AI model obligations have applied since 2 August 2025.

Company obligations depend on whether an organization is a provider, deployer, importer or distributor. Providers of high-risk systems must manage risk, govern data, maintain technical documentation, enable logging, support human oversight, complete conformity assessments and monitor systems after release. Deployers must follow instructions, assign competent oversight, monitor performance, keep logs for at least six months and inform affected people where required.

The 2026 AI Omnibus delayed high-risk deadlines because standards and guidance were not ready. Stand-alone Annex III systems, including uses such as recruitment, credit scoring and education, must meet high-risk duties from 2 December 2027. AI embedded in products covered by EU harmonisation legislation must comply from 2 August 2028. Transparency duties under Article 50 apply from 2 August 2026.

GPAI providers must keep technical documentation, support downstream providers, maintain a copyright compliance policy and publish a training-content summary. Models with systemic risk, presumed above 10^25 floating-point operations of training compute, face additional evaluation, incident-reporting and cybersecurity duties.