What the EU AI Act regulates
The EU AI Act (Regulation (EU) 2024/1689) regulates the development, placing on the market and use of artificial intelligence systems in the European Union. Because it is a regulation, it applies directly in all member states and does not need to be transposed into national law. Member states must designate national supervisory authorities and set rules on penalties, so follow the national authority in each country where you operate.
The regulation is risk-based: the more a system can affect people’s health, safety and fundamental rights, the more obligations apply. It covers providers and deployers in the EU, and also providers outside the EU where the output of their systems is used in the EU. Military and defence use, scientific research and purely personal, non-professional use are among the exclusions. Check the category of your system with the tool on this page.
The four EU AI Act risk categories
| Category | Examples | Consequence |
|---|---|---|
| Prohibited practices (Article 5) | Social scoring, manipulative techniques, emotion recognition of employees, untargeted scraping of facial images | Use is not allowed |
| High-risk systems (Article 6, Annexes I and III) | Ranking job candidates, credit scoring, safety components of medical devices or machinery | Extensive requirements for providers and deployers |
| Limited risk: transparency (Article 50) | Chatbots, image and text generation, deepfakes | Informing users and labelling content |
| Minimal risk | Spam filters, inventory forecasting, product recommendations | No specific obligations apart from AI literacy |
High-risk systems under Annex III are those used in the areas of biometrics, critical infrastructure, education, employment and workers management, access to essential public and private services (for example credit scoring and risk assessment and pricing for life and health insurance), law enforcement, migration and border control, and the administration of justice and democratic processes.
A system in an Annex III area is not high-risk if it does not pose a significant risk, for example because it performs only a narrow procedural or preparatory task. This exception does not apply if the system profiles natural persons. The provider must document such an assessment.
Provider or deployer: who is responsible for what
Obligations depend on your role. A provider develops an AI system or places it on the market or into service under its own name or trademark. A deployer uses the system in the course of its professional activity. Most European companies will be deployers, for example when using a recruitment tool developed by another provider.
| High-risk system | Provider | Deployer |
|---|---|---|
| Risk management and data quality | yes | relevance of the input data it controls |
| Technical documentation and logs | prepares documentation, enables logging | keeps logs, generally for at least six months |
| Human oversight | design that enables it | performed by trained persons |
| Conformity assessment, CE marking, registration | yes | public bodies register their use |
| Information duties | instructions for use | informs employees and people the system helps decide about |
| Fundamental rights impact assessment | no | public bodies, providers of public services, credit scoring and insurance |
A deployer becomes a provider if it puts its own name or trademark on a high-risk system, makes a substantial modification to it, or changes its intended purpose so that it becomes high-risk. This matters when adapting off-the-shelf solutions to your own needs.
Practical examples
- A customer support chatbot built on a large language model: generally limited risk. You must tell users they are interacting with AI, unless that is obvious.
- A CV screening or candidate scoring tool: a high-risk system in the employment area. As deployer, the company must ensure human oversight, keep logs and inform candidates and workers’ representatives.
- Predicting machine failures from sensor data: generally minimal risk, unless the system is a safety component of a machine covered by Annex I legislation.
- Credit scoring of natural persons: a high-risk system. Detecting financial fraud is expressly excluded.
- Analysing employee emotions from video or voice calls: a prohibited practice in the workplace, except for medical or safety reasons.
General-purpose AI models
Large language models and other general-purpose AI (GPAI) models have specific rules that apply from 2 August 2025. Model providers must prepare technical documentation, provide information to providers who integrate the model into their systems, maintain a copyright compliance policy and publish a summary of the content used for training. Additional requirements apply to the most capable models with systemic risk.
A company that uses an existing model through an API or embeds it in its own application is generally not a provider of a general-purpose model. It can, however, be a provider or deployer of the AI system it built on top of that model, and the category of that system depends on its intended purpose.
Deadlines and fines
| Date | What starts to apply |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | Prohibited practices and the AI literacy obligation |
| 2 August 2025 | Rules for general-purpose AI models, governance and penalties |
| 2 August 2026 | Most provisions, including Annex III high-risk systems and transparency obligations |
| 2 August 2027 | High-risk systems that are safety components of Annex I products |
With a package known as the Digital Omnibus, the European Commission proposed postponing some deadlines for high-risk systems. Because the legislative process is ongoing or may already be complete, check the current status on the European Commission website before you plan.
Fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for breaches of other obligations and EUR 7.5 million or 1% for supplying incorrect information to authorities. For SMEs and start-ups the lower of the two amounts applies.
How to prepare
- Inventory of AI systems. Collect all AI systems and tools you develop or use, including those that departments adopted on their own.
- Classification. Classify each system with the tool above and document the result.
- Literacy. Prepare training for staff who use AI and an internal acceptable-use policy.
- High-risk systems. Ask suppliers for conformity documentation, assign people responsible for human oversight and arrange log retention.
- Governance. Link the regulation requirements with your existing data protection and information security processes.
Humanfrog helps companies plan and deliver AI solutions designed for compliance from the start, with proper security, access control and logging. To review a specific use case, talk to us.
