The EU AI Act: What It Means and Who Must Comply

Common mistakes to avoid

A common mistake is treating the EU AI Act as a single “high-risk AI” rule. Obligations depend on the system’s role and intended purpose. A provider placing an AI system on the EU market, a deployer using it in recruitment or credit decisions, and an importer distributing it may each have different duties.

• Assuming every AI system requires the same approval. The Act distinguishes prohibited practices, transparency duties, high-risk systems, and general-purpose AI models. Risk classification also depends on the intended use—not merely the underlying technology.
• Confusing a provider with a deployer. Developers, distributors, professional users, and value-chain partners may all have obligations. A deployer must also follow the provider’s instructions, assign competent human oversight, monitor system performance, and keep required logs.
• Overlooking prohibited practices. Organizations should not assume that a use case becomes lawful because an AI system is commercially available. Certain manipulative, exploitative, biometric-categorization, and other practices are prohibited, subject to the Act’s specific exceptions.
• Ignoring general-purpose AI duties. Providers of general-purpose AI models may need to maintain technical documentation, provide information to downstream providers, follow EU copyright rules, and meet additional evaluation, incident-reporting, and cybersecurity obligations where a model is classified as presenting systemic risks.
• Treating “human in the loop” as a checkbox. Human oversight must be meaningful: authorized people must understand system limitations, monitor operation, and intervene or stop use when necessary.
• Missing documentation and supply-chain requirements. Conformity assessments, EU database registration, CE marking where applicable, post-market monitoring, and serious-incident reporting may all apply. Contracts should clearly allocate responsibilities across the value chain.

Organizations should use the Act’s official risk categories and guidance, consult relevant sectoral law, and obtain legal advice where classification is uncertain.

How to choose the right option

Choose the compliance route by asking two questions: what does the AI system do, and what is your organisation’s role? A model provider’s assertions do not determine the legal status of your own application. Start with the system’s intended purpose, inputs, outputs, users and level of human oversight—not with its marketing label.

• Provider: If you develop, substantially modify, rebrand, import or distribute an AI system in the EU, you may assume provider duties, even when using components from Microsoft, Google, Amazon or another vendor.
• Deployer: If you use AI within your organisation, assess how you use it, whether your use makes it high-risk, and whether you must monitor outcomes or inform affected workers and customers.
• Product manufacturer: If AI is a safety component of a regulated product, the sectoral product laws can apply alongside the AI Act.

Document the classification and decision trail. ISO/IEC 42001 can support an AI management system, while ISO/IEC 42005 can guide AI system impact assessments, but neither replaces the Act’s formal obligations. Verify the final text in the Official Journal and use the European Commission AI Act Service Desk for compliance guidance. Check harmonised standards against the Commission’s official list before relying on them for conformity.

What to expect in 2026 and beyond

By August 2026, the EU AI Act’s framework should be largely operational. This is the key date for organizations using AI systems, not just companies that develop them. The European Commission’s official AI Act information page remains the best source for the current implementation timeline, guidance and supporting materials.

• August 2, 2026: Most remaining obligations are expected to apply, including risk-management, documentation, record-keeping, human-oversight, transparency and accuracy requirements for certain high-risk AI systems. Providers and deployers should identify their systems’ roles and assess whether they fall within high-risk categories.
• Continuing enforcement: The European AI Office and national market-surveillance authorities will oversee the rules. Organizations may need to address substantiated complaints, supply requested information and correct or withdraw non-compliant systems.
• August 2, 2027: Additional transition periods expire, including requirements for certain high-risk AI systems incorporated into regulated products and greater compliance expectations for AI models already placed on the market.

Organizations should also expect implementation guidance to evolve as the European Commission, the AI Office and Member State authorities publish templates, FAQs and technical materials. Harmonized standards developed through CEN-CENELEC can help demonstrate conformity, but organizations should verify the current status of each standard rather than assume that every draft is mandatory.

Beyond 2027, compliance will increasingly become an operational discipline covering supplier contracts, model documentation, incident processes, cybersecurity and post-market monitoring. The AI Act will continue to operate alongside the GDPR, the General Product Safety Regulation and sector-specific EU law, so companies may need to satisfy several overlapping obligations for the same system.

What drives the cost

The main cost driver under the EU AI Act is not simply using AI; it is determining the system’s legal role, risk category and applicable controls. A provider creating an AI system for the EU market may face substantially more obligations than a business deploying an existing system internally. Costs rise when a use case is classified as high-risk or falls within a regulated-product safety framework.

• System inventory and classification: organisations must document where AI is used, whether it is prohibited, high-risk, limited-risk or exempt, and whether it qualifies as a general-purpose AI model.
• Data and model governance: high-risk systems require documented data governance, training-data provenance, bias and data-quality controls, and processes for managing changes such as fine-tuning or model substitution.
• Conformity assessment: depending on the system, this may involve internal controls, notified-body involvement or harmonised standards. The applicable route must be confirmed against the Act and relevant product legislation.
• Technical documentation and records: risk management, instructions for use, human-oversight measures, logs, accuracy and robustness information, cybersecurity controls, and post-market monitoring can require engineering, legal and quality-assurance work.
• Transparency obligations: disclosures for AI-generated content, synthetic media, chatbots and certain general-purpose AI systems can create labelling, interface and contractual costs.

Deployment also matters. Deployers of high-risk systems may need monitoring, human oversight, input-data controls, worker impact assessments and incident reporting. Larger teams face additional costs for governance, supplier contracts and evidence collection, while smaller providers can benefit from regulatory sandboxes and SME support. ISO/IEC 42001 and ISO/IEC 23894 can help structure AI governance, but using them does not replace legal analysis or official conformity assessment.

Deadlines are phased rather than uniform: prohibited practices and AI-literacy duties applied from February 2025, general-purpose AI obligations from August 2025, and most remaining provisions are scheduled for August 2026, with later dates for certain high-risk systems embedded in regulated products. Organisations should check the current timetable in the European Commission’s AI Act documentation and the official EUR-Lex text.

Frequently asked questions

What is the EU AI Act?

The EU AI Act is an EU-wide regulation that governs the development, marketing and use of artificial intelligence according to risk. It regulates AI systems, general-purpose AI models and certain uses of AI through transparency, safety, governance and enforcement requirements. The Act supplements—not replaces—existing laws such as the GDPR, the Consumer Rights Directive and sector-specific product rules.

Who must comply with the EU AI Act?

Providers that develop or commission AI systems and place them on the EU market must comply with applicable provider obligations, while organizations that use AI in a professional context generally act as deployers and must follow relevant usage requirements. Companies based outside the EU can also be covered when their AI systems are placed on the EU market or when the systems’ output is used in the EU. A company may be both a provider and a deployer if it develops a tool and then uses it internally.

Does every use of AI require approval under the EU AI Act?

No. Most AI applications are not subject to a general approval process; instead, obligations depend on the system’s role, purpose, risk level and whether it falls within a prohibited or high-risk category. Providers and deployers must also ensure that staff and other people operating AI systems on their behalf have an appropriate level of AI literacy, as required since February 2, 2025.

What AI practices are prohibited by the EU AI Act?

The Act prohibits certain practices because of their potential to cause significant harm, including specific forms of manipulation, exploitation of vulnerable people, social scoring, untargeted scraping of facial images and certain uses of biometric identification or emotion recognition. Some practices may be allowed only under narrowly defined exceptions, such as certain medical or safety-related emotion-recognition uses and authorized law-enforcement uses of real-time remote biometric identification. National authorities in EU member states are responsible for enforcing the prohibitions.