AI Act: scope and obligations

Regulation: EU 2024/1689 Applicability: Generally from 2 August 2026, with earlier and later dates. Chapter III, Sections 1–3, except Article 6(5), applies from 2 December 2027 for Annex III and 2 August 2028 for Annex I under Article 113. Article 111 governs transitional rules for existing systems and models. Scope: Artificial Intelligence

What is the AI Act?

The AI Act sets rules for AI systems and models. Obligations depend on the organisation’s role, the system’s purpose and risks, and the date when the relevant provision applies.

How to determine the requirements for a system

What to check	Basis for the decision
Prohibited use	The precise conditions and exceptions in Article 5. A feature name is insufficient; purpose, use and impact matter.
High-risk status	The product route in Article 6(1) / Annex I or a specified use in Article 6(2) / Annex III, including paragraph 3.
Transparency	Article 50 distinguishes AI interaction, synthetic content, deepfakes and other specified cases. Duties depend on role and exceptions and can overlap high-risk status.
Other uses	This does not automatically mean “no obligations”. Assess AI literacy, GDPR, contracts and other applicable requirements separately.

The conclusion concerns a particular system and purpose, not a product name or industry. The classification guide provides further questions.

Key Obligations

For HIGH-RISK AI Systems

Articles 9–15 primarily set requirements for providers of high-risk systems. Deployers have the different duties in Article 26; they do not automatically take over the provider’s full technical documentation. Annex I products also require the applicable sectoral conformity route.

Obligation	Description	Deadline
Risk management	Established, documented and maintained risk management system across the lifecycle (Art. 9)	Ongoing; testing at the latest before placing on the market or putting into service
Data Governance	Training data quality, bias testing	Ongoing
Technical documentation	Documentation under Article 11 and Annex IV; a model card alone is insufficient	Before placing on the market or putting into service, then keep updated
Record Keeping	Automatically generated logs under the actor’s control: appropriate period, at least 6 months unless other applicable law provides otherwise (Arts. 19, 26(6))	Ongoing
Transparency to deployers	Sufficient interpretability and instructions for use under Article 13	Before placing on the market or putting into service
Human oversight	Measures proportionate to the risks, autonomy and context under Article 14	System design and use
Accuracy & Robustness	Testing, monitoring, drift detection	Ongoing

Using systems based on GPAI models

The Chapter V duties concern providers of GPAI models, not every customer using a model API. First identify whether you use an existing AI system, develop and supply your own system, or provide a GPAI model.

Review the intended purpose, instructions, limitations and supplier terms.
Support AI literacy for staff and others operating AI on your behalf, appropriate to their roles (Art. 4); a particular course or certificate is not mandated.
Agree a GDPR Article 28 processing contract where the supplier processes personal data on your behalf. A DPA is not required merely because non-personal company data is involved.
Decide what evidence and logs are necessary for your use case; do not retain every prompt by default.
Before entering personal or confidential data, establish a lawful purpose, access rules, a suitable contract, transfer safeguards and proportionate security. Encryption alone does not make processing lawful.

Your Role

Role	Definition	Example
Provider	Develops or has a system/model developed and places it on the market or puts the system into service under its name or trademark	An integrator supplying its own AI application may be a provider without training the underlying model
Deployer	Uses an AI system under its authority in a professional context	A company using an existing assistant; its own supplied application must be assessed separately
Importer	A person located or established in the EU placing on the market a system bearing the name or trademark of a person established outside the EU	Assess the actual market role; using a foreign API alone is insufficient
Distributor	A supply-chain actor other than the provider or importer making a system available on the EU market	Reselling a system under Article 3’s conditions

Timeline

The original Article 113 distinguished 2 August 2026 for Annex III from 2 August 2027 for Article 6(1) and the corresponding obligations. Regulation (EU) 2026/1744 “Digital Omnibus on AI” (CELEX 32026R1744, adopted 8 July 2026, published 24 July 2026, in force 27 July 2026) deferred Chapter III, Sections 1–3, except Article 6(5) — Annex III to 2 December 2027, Annex I to 2 August 2028.

What was not deferred: Article 50 (transparency) still applies from Aug 2, 2026 — only its paragraph 7 was amended (codes of practice are now supported and assessed by the Commission). The transition period for complying with Art. 50(2) for generative systems placed on the market before Aug 2, 2026 sits in the new Article 111(4) — not in Article 50 — and ends 2 December 2026. The same date adds two new prohibited practices in Art. 5(1)(ba) and (bb), together with Art. 5(1a) and (1b), which delimit their scope. GPAI rules (Art. 53-55) have applied since Aug 2, 2025 and the Omnibus does not touch them; models placed on the market earlier have until 2 August 2027 under Art. 111(3).

Penalties

Violation	Penalty	Legal basis
Prohibited practices (Art. 5)	up to €35M or 7% of total worldwide annual turnover — whichever is higher	Art. 99(3)
Other obligations — including high-risk duties (Art. 16, 22-24, 26) and transparency (Art. 50)	up to €15M or 3% — whichever is higher	Art. 99(4)
Incorrect, incomplete or misleading information supplied in response to a request from notified bodies or national competent authorities	up to €7.5M or 1% — whichever is higher	Art. 99(5)

Mind the direction of the comparison: for undertakings the higher of the two values applies, not the lower. SMEs including start-ups are the exception — for them the lower value applies (Art. 99(6)). Regulation (EU) 2026/1744 added the same rule for small mid-cap enterprises, but only for paragraphs 4 and 5 — not for prohibited practices (new Art. 99(6a)).

Example (not an SME or small mid-cap enterprise): A company with €100M annual turnover breaches high-risk obligations. 3% of turnover = €3M, the fixed cap is €15M — the maximum fine is the higher value, i.e. €15M; the actual amount is set under Art. 99(7). For prohibited practices it would be 7% = €7M against a €35M cap, i.e. €35M.

Next Steps

Resources

Primary sources: AI Act — informative consolidated version 27 July 2026; Regulation (EU) 2026/1744 — published 24 July 2026; GDPR — published version 4 May 2016.