A UK software team that is building a hiring tool got an email from a German customer's legal department asking whether the product falls under the EU AI Act. No team member could answer with confidence. Because the tool reviews CVs, it appears to carry a high risk level, yet it is merely a component of a broader platform, indicating that responsibility could be assigned elsewhere. Assessing compliance demands knowing the system's risk category, identifying who qualifies as a provider or deployer, and recognising the particular obligations attached to each role.
The EU AI Act is a regulation of the European Union that governs the development and use of artificial intelligence. It has been operative from August 2024.
The regulation classifies AI systems into risk levels, spanning from prohibited practices to tools that have minimal requirements. It creates obligations for providers and deployers, including organisations outside the EU when their systems are used by individuals inside the EU.
What the EU AI Act actually includes
The EU AI Act serves as the main regulation for artificial intelligence within the European Union. Adopted in 2024, it acts as a template for legislation in other jurisdictions. The Act does not focus on particular industries or model types. It covers every sector and sets rules according to a system's function and the possible harm it may cause. These rules rely on the technology's risks rather than its name or its developer.
Proportionality is the core principle. Both a spam filter and a mortgage-eligibility system are forms of artificial intelligence, yet they carry different risk levels. Therefore, the Act applies different rules to each. It classifies systems into distinct levels. These range from practices prohibited due to conflict with EU fundamental rights to high-risk systems that demand substantial compliance efforts. Other tools are only subject to basic transparency requirements or have no obligations whatsoever.
The Act operates alongside existing EU law rather than replacing it.
GDPR fully applies to any AI system that processes personal data, and sector-specific regulations for fields such as medical devices or vehicles stay in force alongside GDPR. Meeting one set of regulations does not ensure compliance with the other.
Definitions of providers and deployers
The Act concentrates on two main roles. A provider is an entity that either develops an AI system or commissions its development and then markets it under its own brand. A deployer is an entity that employs an AI system under its own authority, for example a company that buys and runs a tool made by another party. An organisation can occupy both roles at the same time when it creates a tool for its own operational purposes.
The Act's scope reaches beyond companies that are based in the EU. If a provider outside the EU puts a system onto the EU market, or if the system's output is used within the EU, the Act may apply regardless of where the company's headquarters are located. This mirrors the way GDPR applies to organisations that process data of EU residents from any location. A UK consultancy that creates a tool later used by a client with EU customers should take these requirements into account even without an EU office.
Importers and distributors bear fewer responsibilities. Their main duty is to confirm that a system possesses the proper documentation before it proceeds through the supply chain. The most significant obligations fall on providers. Deployers also face a substantial set of requirements, particularly when a system is classified as high-risk.
Unacceptable risk: the practices banned outright
The Act bans certain practices that it deems excessively harmful to fundamental rights, making them impermissible under any circumstances. These prohibited activities include public authorities employing social scoring and AI that manipulates individuals via subliminal or deceptive methods likely to cause harm. The regulations also bar systems that exploit the particular vulnerabilities of children or persons with disabilities.
The regulations also ban particular uses of biometric data. These include untargeted scraping of facial images from the internet or CCTV footage to build recognition databases. Real-time remote biometric identification in public spaces for law enforcement is also prohibited, except in limited circumstances. Emotion recognition in workplaces and schools is prohibited unless it serves limited safety or medical purposes. Furthermore, predictive policing is not permitted when it relies solely on profiling an individual rather than on objective facts.
This tier offers no compliance pathway.
Systems in this category may not be sold or used within the EU. This part of the Act obliges developers to decide whether a product may be allowed to exist in its present form.
Requirements for high-risk systems
High-risk covers AI used where a wrong decision has serious consequences for someone's rights, safety or access to services: recruitment and HR decisions, creditworthiness and insurance pricing, biometric identification, critical infrastructure, education access, essential public and private services, law enforcement, migration control, and the administration of justice.
Organisations supplying high-risk systems bear several requirements. They must manage risks over the system's lifespan and uphold controls over the quality of training data. They must produce technical documentation and guarantee that the system automatically logs its behaviour. These providers must provide clear information to deployers and incorporate human oversight into the system design. They must also test for accuracy and robustness, carry out a formal conformity assessment prior to market entry, and register the system in an EU database.
Entities deploying high-risk systems have active responsibilities. They must follow the supplied instructions for use, monitor the system during operation, and keep records. In some cases, they must also assess how the system affects fundamental rights before commencing use. Buying a compliant tool from a vendor does not relieve a deployer of its own legal obligations concerning the tool's use.
Limited-risk systems: transparency
The tier beneath high-risk systems centres on transparency. Systems that interact with people, or that generate content that could be confused with human work, must meet disclosure requirements. A chatbot must indicate that it is an AI system unless the context already makes this evident. Furthermore, deepfake images, audio, and video must be labelled as artificially generated or manipulated.
This principle applies to emotion recognition and biometric categorisation systems when they are used outside prohibited cases. Individuals must be informed when they interact with or are evaluated by these systems. These requirements do not involve conformity assessments or registration. The aim is to give sufficient disclosure so that individuals can make informed decisions about the systems they encounter or use.
Minimal-risk AI and the separate rules for general-purpose models
Most AI tools used for routine tasks, like recommendation engines, spam filters, and inventory forecasting, fall into the minimal-risk tier. These tools have no mandatory obligations under the Act. The EU encourages voluntary codes of conduct for this category, yet there are no enforcement mechanisms comparable to those in the higher-risk tiers.
General-purpose AI models, the large models employed for chatbots and copilots, are subject to a distinct set of rules that function alongside the standard risk tiers. All providers are required to meet basic transparency requirements. These requirements comprise technical documentation, a summary of the training data, and policies for adhering to copyright law. Models that pose systemic risks, as measured by the computing power employed in their training, must satisfy additional requirements. Such providers must assess those risks, report any serious incidents, and comply with stricter cybersecurity standards.
The schedule for implementing the rules
The Act became effective on 1 August 2024, although only a few of its requirements applied then. The legislation employs a staggered schedule so that organisations can determine their obligations and set up necessary procedures.
The rules prohibiting banned practices started in February 2025, six months after the law commenced. Requirements for providers of general-purpose AI models became effective in August 2025. Most requirements for high-risk systems will take effect in August 2026, two years after the law began. This timeline provides providers and deployers the greatest amount of time to prepare for the strictest regulatory category.
A narrower set of high-risk obligations, which apply to AI used in products already covered by EU safety laws-including machinery, toys, and medical devices-remain effective until August 2027. Most organisations ought to be categorising their systems now, even though the specific deadline for them lies further ahead.
Getting ready without slowing down what you are building
Start by compiling an accurate list of every AI system the business develops, purchases, or incorporates as a feature within another product. You also need to determine which regulatory tier applies to each system. Many teams incorrectly assume that using a vendor's AI tool rather than building an internal model exempts them from these rules. That assumption is generally wrong, because the obligations for those who deploy AI systems still apply.
The high-risk tier requirements-including data quality controls, documentation, logging, and traceability-are mainly data management issues classified as AI issues. Organisations find these requirements easier to manage if they already possess a governed, compliant data foundation. Organisations that have to compile evidence only after a regulator or customer requests it find these tasks harder to manage.
None of this is legal advice.
This article provides a summary of a complex regulation. The specific details relevant to a particular system, contract, or sector depend on facts that a summary cannot capture. Organisations assessing their status under the Act should consult a qualified lawyer while carrying out the technical and data work outlined in this text.
When the reading becomes a roadmap question, our AI strategy consultants will honestly explain what the work requires and what it depends on.
Frequently asked questions
What is the EU AI Act?
The EU AI Act is the European Union's regulation governing artificial intelligence systems and their development and use. It categorises AI by risk levels, bans certain practices, and demands the most thorough compliance from high-risk systems. These high-risk systems are employed in areas such as recruitment, credit scoring, and law enforcement. The Act has been rolled out in stages starting in August 2024.
Who does the EU AI Act apply to?
The rules apply to providers who develop or sell AI systems and to deployers who use them. This includes organisations outside the EU if they place their AI systems on the EU market or if the output of those systems is used within the EU. This scope mirrors how the GDPR applies to organisations outside EU borders.
What are the EU AI Act's risk categories?
The framework comprises four categories. Practices that present unacceptable risk are prohibited. High-risk systems must comply with requirements for risk management, documentation, and conformity assessment. Limited-risk systems must disclose to users that they are interacting with artificial intelligence. Minimal-risk systems have no mandatory legal obligations.
When do the EU AI Act's obligations take effect?
The Act became effective in August 2024. Prohibited practices were banned beginning in February 2025. Requirements for providers of general-purpose AI models took effect in August 2025. Most rules for high-risk systems will become applicable in August 2026. A smaller set of requirements for products already regulated will become effective in August 2027.
What happens if an organisation does not comply with the EU AI Act?
The Act sets fines based on a percentage of global annual turnover. The highest penalties target the use of prohibited practices and can reach 7% of worldwide turnover or a specific multi-million-euro amount, whichever is greater. Lower fine levels apply to other violations, including failure to meet obligations for high-risk systems.
Want a clear view of where AI can help your business first? Talk to us and begin with a clear picture.