What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s law on artificial intelligence. It bans some practices outright, sets strict duties for high-risk systems, and requires transparency for chatbots and synthetic content. As amended in 2026, high-risk duties apply from 2 December 2027, or 2 August 2028 for AI in regulated products.
TL;DR
- Four risk tiers: prohibited, high-risk, limited-risk and minimal-risk.
- Transparency duties have applied since 2 August 2026.
- High-risk duties apply from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does the EU AI Act work in practice?
The EU AI Act introduces a risk-based approach to regulating AI. It distinguishes between prohibited practices, high-risk systems, limited-risk systems with transparency duties, and minimal-risk systems. The obligations on a provider or deployer scale with the risk category.
High-risk systems carry the most extensive requirements, including risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy and robustness measures. Providers must also establish a quality management system and, in many cases, complete a conformity assessment before placing a system on the market.
Because the Act layers AI-specific duties on top of existing data-protection and security obligations, organizations often manage EU AI Act readiness alongside GDPR and security frameworks, mapping shared controls across all of them.
Amendments adopted in 2026 (Regulation (EU) 2026/1744) moved most high-risk obligations to 2 December 2027 and 2 August 2028. See the EU AI Act timeline after the Digital Omnibus for every date.
What else do people ask about the EU AI Act?
What is a high-risk AI system?
An AI system used in an area listed in Annex III, such as hiring, education or credit scoring, or one that is a safety component of a product covered by the EU laws in Annex I.
What is the Digital Omnibus on AI?
Regulation (EU) 2026/1744, in force since 27 July 2026. It moved the high-risk dates, added two prohibited practices from 2 December 2026 and simplified several duties.
Go deeper: EU AI Act compliance guide
Which terms are related to the EU AI Act?
- AI ComplianceAI compliance is the practice of making sure AI systems meet the laws, standards and ethical policies that apply to them across their lifecycle. It covers an inventory of AI systems, risk classification, data governance, documentation, bias testing, human oversight and monitoring, under rules such as the EU AI Act, NIST AI RMF and ISO/IEC 42001.
- NIST AI RMFThe NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework, published in January 2023, for managing the risks of AI systems. It organizes the work into four functions, Govern, Map, Measure and Manage, and defines seven characteristics of trustworthy AI. NIST is revising it as part of the White House AI Action Plan.
- GDPRThe General Data Protection Regulation (GDPR) is the EU law, applying since 25 May 2018, that governs how organizations process the personal data of people in the EU. It requires a lawful basis, transparency and security, gives individuals rights such as access and erasure, and allows fines of up to €20 million or 4% of worldwide turnover.
- Control MappingControl mapping links each internal control to every framework requirement it satisfies, so one piece of evidence can support several frameworks at once. For example, an access-review control can satisfy SOC 2 CC6, ISO 27001 Annex A 5.15 to 5.18, and HIPAA’s access-control safeguard. Adding a framework then means covering only the gaps.