What Is the EU AI Act? A Beginner's Guide for Compliance Teams

If your organisation scores loan applications with software, ranks job candidates, or answers customers with a chatbot, European rules now attach to those tools. The EU AI Act is the first broad statutory framework for artificial intelligence, and it binds far more than technology vendors. Banks, hospitals, universities, recruiters and public bodies pick up duties the moment they put these systems into service. The regulation is built around risk, so the heaviest obligations land on a fairly narrow set of uses. Here is what compliance teams need to know first.

The four risk tiers, in plain terms

The Act sorts systems into categories and applies obligations accordingly.

• Prohibited practices. A short list banned outright from 2 February 2025: social scoring by public authorities, manipulative techniques that exploit a person's vulnerability, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and classrooms, and most real-time remote biometric identification in publicly accessible spaces by law enforcement.
• High-risk systems. Two routes in. Annex I covers systems that are safety components of products already regulated under EU law, such as machinery or medical devices. Annex III lists use areas: biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit scoring, law enforcement, migration and the administration of justice.
• Limited risk. Transparency duties rather than heavy paperwork. Chatbots must tell people they are dealing with a machine, synthetic or manipulated content including deepfakes must be labelled, and certain generated text published to inform the public must be disclosed.
• Minimal risk. Everything else, from spam filters to inventory forecasting. No specific obligations, though data protection and consumer law still apply.

Separately, providers of general-purpose models — the large foundation models sitting underneath many products — follow their own track, including technical documentation, a copyright policy and a summary of training content.

Who is who, and why the labels matter

A provider develops a system or has it developed and places it on the market under its own name. A deployer uses it under its own authority — often the bank, hospital or HR department. Importers, distributors and authorised representatives have narrower duties around verification and documentation.

Three practical points follow. You can be a deployer of someone else's system and still carry real obligations. A company that substantially modifies a system may be treated as its provider, so customisation is not automatically a safe harbour. And if you put your brand on a third-party tool, you may have just become the provider. Check contracts before assuming the vendor carries everything.

What high-risk obligations actually require

Providers of high-risk systems must run risk management across the lifecycle, apply data governance to training and testing sets, keep technical documentation, enable logging, produce clear instructions for use, design for human oversight, and meet standards on accuracy, robustness and cybersecurity. They must also operate a quality management system, complete conformity assessment, affix CE marking, sign an EU declaration of conformity and register the system in the EU database.

Deployers must use the system as instructed, assign competent human oversight, ensure input data is relevant and sufficiently representative within their control, keep logs for at least six months where those logs are under their control, inform workers and affected people, and cooperate with authorities. Certain public bodies and some private entities must also carry out a fundamental rights impact assessment before first use.

One duty crosses all tiers: AI literacy. Organisations must take measures so that staff dealing with these systems understand them well enough to use them properly. It applies from 2 February 2025 and is easy to overlook.

The dates that matter

1. 1 August 2024 — the regulation entered into force.
2. 2 February 2025 — prohibitions and the AI literacy duty apply.
3. 2 August 2025 — obligations for general-purpose model providers, plus governance and penalty rules.
4. 2 August 2026 — most remaining provisions, including high-risk duties for Annex III systems.
5. 2 August 2027 — high-risk systems that are safety components under Annex I, and certain legacy systems already on the market.

Technical standards and guidance have arrived more slowly than the calendar assumed, and the Act has been the subject of active political debate about simplification. Verify current dates against the official text and any amending legislation before you commit a project plan to them.

Penalties

Enforcement sits mainly with national market surveillance authorities, with the Commission's AI Office handling general-purpose models. The ceilings are set at EU level: up to €35 million or 7% of total worldwide annual turnover for the prohibited practices, whichever is higher; up to €15 million or 3% for breaching most other obligations; and up to €7.5 million or 1% for supplying incorrect information. Lower caps can apply to smaller companies. This is a summary, not legal advice — have a qualified adviser review your specific position.

A practical compliance sequence

1. Inventory. Ask every business unit to list tools that make or inform decisions about people, or that generate content customers see. Include shadow purchases.
2. Classify. Map each entry to prohibited, high-risk, limited or minimal, and write down the reasoning. That record is evidence.
3. Assign roles. Confirm whether you are provider, deployer or both for each system, and name an internal owner.
4. Gap analysis. Compare current practice against the obligations that apply. Most gaps sit in documentation, logging and oversight design.
5. Fix the contracts. Push information and cooperation duties onto vendors in writing: technical documentation, logs, incident notice, change notification.
6. Build the controls. Logging retention, human review points, accuracy testing, staff training and a route for people to raise concerns.
7. Track changes. Watch standards, guidance and amendments. Give one person ownership of the calendar.

Start with the inventory this week

Teams that wait for perfect guidance lose the one genuinely scarce resource: time. A defensible inventory and a documented classification decision for each system put you ahead of most organisations, and they cost relatively little. From there, prioritise anything touching employment, credit, education, essential services or biometrics — those are the areas regulators care about most. If you operate across several member states, check how each national authority is staffing up, because enforcement will look different from one country to the next. Where a system is genuinely high-risk, bring in specialist legal advice early: retrofitting documentation after deployment is far more expensive than designing it in.

Photo: Janson_G / Pixabay