EU AI Act Explained

A practical guide to scope, risk categories, organisational roles, compliance duties and implementation priorities under Regulation (EU) 2024/1689.

What is the EU AI Act?

The EU AI Act is the European Union's horizontal legal framework for artificial intelligence. It regulates AI according to risk, prohibits a narrow group of unacceptable practices, imposes detailed duties on high-risk systems, creates transparency rules for certain AI interactions and content, and introduces specific obligations for general-purpose AI models.

Executive takeaway. The Act is not a single checklist. Its requirements depend on what the technology does, where it is used, the organisation's role in the AI value chain and whether the system or model falls into a regulated category. The practical starting point is therefore a governed inventory, role mapping and risk classification exercise.

Why was the EU AI Act introduced?

The Act is designed to support the uptake of human-centric and trustworthy AI while protecting health, safety and fundamental rights. It also aims to create consistent rules across the EU internal market, reducing the fragmentation that would arise if Member States adopted materially different AI laws.

For organisations, this means AI governance must connect legal interpretation with technology management, product assurance, risk ownership, data governance, cybersecurity, human oversight and evidence. A policy alone will rarely be enough.

Who must comply with the EU AI Act?

The Act allocates responsibilities according to an organisation's role. A business may hold more than one role at the same time, and its role can change when it substantially modifies, rebrands or repurposes an AI system.

Does the Act apply outside the EU?

Yes, in defined circumstances. The Act can apply to providers placing AI systems or models on the EU market, deployers established in the EU, and providers or deployers outside the EU where the output produced by an AI system is used in the Union. This extraterritorial reach makes applicability a market-access and supply-chain issue, not merely a question of corporate domicile.

How does the EU AI Act classify risk?

The Act is commonly described as risk-based, but the categories are not simply a sliding scale. Each category triggers a different legal treatment.

What AI practices are prohibited?

The Act prohibits a limited set of AI practices judged to create unacceptable risks. The precise scope is legally detailed, so organisations should avoid relying on simplified labels alone. Relevant categories include:

• Manipulative or deceptive techniques that materially distort behaviour and cause, or are reasonably likely to cause, significant harm.
• Exploitation of vulnerabilities linked to age, disability or specific social or economic situations where significant harm results or is likely.
• Certain forms of social scoring.
• Certain individual criminal-risk predictions based solely on profiling or personality traits.
• Untargeted scraping of facial images to create or expand facial-recognition databases.
• Emotion inference in workplaces and educational institutions, subject to limited exceptions.
• Biometric categorisation that infers specified sensitive characteristics.
• Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, except under tightly defined conditions.

The prohibitions and AI literacy requirements began applying on 2 February 2025. Organisations should therefore have already identified and stopped prohibited uses, assigned ownership and established a defensible review process for new AI use cases.

What counts as a high-risk AI system?

High-risk status can arise in two principal ways. First, an AI system may be a safety component of a product, or itself a product, covered by specified EU product-safety legislation and subject to third-party conformity assessment. Second, it may fall within a sensitive use case listed in Annex III, subject to the Act's qualification rules and exclusions.

Examples of Annex III areas

• Biometrics, where the relevant use is permitted by law.
• Critical infrastructure safety management.
• Education and vocational training decisions.
• Employment, worker management and access to self-employment.
• Access to essential private services, essential public services and benefits.
• Certain law-enforcement uses.
• Migration, asylum and border-control management.
• Administration of justice and democratic processes.

Classification should be documented at use-case level. The same underlying model may support both low-risk and high-risk applications depending on intended purpose, context, affected people and the decisions it influences.

What must providers of high-risk AI systems do?

Providers carry the most extensive obligations. Core requirements include:

• Establish and maintain a risk-management system across the AI lifecycle.
• Apply appropriate data and data-governance practices to relevant training, validation and testing datasets.
• Prepare and maintain technical documentation.
• Enable automatic logging where appropriate.
• Provide clear instructions for deployers.
• Design effective human-oversight measures.
• Achieve appropriate accuracy, robustness and cybersecurity.
• Operate a quality-management system.
• Complete the applicable conformity-assessment route before market placement or use.
• Register relevant systems and meet post-market monitoring, corrective-action and serious-incident reporting duties.

What must deployers of high-risk AI systems do?

Deployers are not passive end users. Depending on the system and context, they must use the system according to instructions, assign competent human oversight, monitor operation, retain relevant logs under their control, act on risks or incidents, and complete other duties such as workplace notification or fundamental-rights impact assessment where applicable.

A deployer should be able to explain who approved the use case, why the system was classified as it was, how people are affected, what human intervention is available, which data and outputs are monitored, and when continued use must be suspended.

What is a fundamental rights impact assessment?

For certain deployments of high-risk AI, specified public-sector bodies and private entities providing public services, as well as certain uses in creditworthiness and life or health insurance, must assess the potential impact on fundamental rights before first use. The assessment is distinct from, but may be coordinated with, a data protection impact assessment.

What are the transparency requirements?

Article 50 creates transparency duties for specified systems and uses. These include informing people when they interact directly with certain AI systems, disclosures for emotion-recognition or biometric-categorisation systems, and machine-readable marking or labelling for certain synthetic content, deepfakes and AI-generated or manipulated text on matters of public interest. Most Article 50 duties apply from 2 August 2026.

How are general-purpose AI models regulated?

The Act distinguishes between AI systems and general-purpose AI models. Providers of GPAI models must maintain technical documentation, provide information to downstream providers, adopt a policy to comply with EU copyright law and publish a sufficiently detailed summary of training content. These obligations became applicable on 2 August 2025.

Providers of GPAI models with systemic risk face additional duties, including model evaluation, adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting and adequate cybersecurity protection.

What is AI literacy?

Providers and deployers must take measures to ensure a sufficient level of AI literacy among staff and other people dealing with AI systems on their behalf, taking account of their technical knowledge, experience, education, training, context of use and the people affected. This is broader than a one-off awareness module: organisations need role-based competence proportionate to the decisions people make.

When does the EU AI Act apply?

The Act entered into force in August 2024 and applies in stages. The Commission’s AI Act Service Desk timeline, consulted on 12 October 2026, reflects Digital Omnibus changes and distinguishes the following milestones. Organisations should confirm the controlling legal text and any transition applicable to their precise system, model and role before fixing a compliance deadline.

What are the penalties?

Article 99 sets different maximum penalty tiers: up to EUR 35 million or 7% of worldwide annual turnover for Article 5 prohibited-practice infringements; up to EUR 15 million or 3% for specified other infringements; and up to EUR 7.5 million or 1% for supplying specified incorrect, incomplete or misleading information. Which cap applies depends on the infringement and the organisation, including applicable SME and SMC provisions. GPAI provider fines are addressed separately in Article 101. Penalties require case-specific legal assessment.

How does the EU AI Act interact with GDPR and sector regulation?

The AI Act does not replace data protection, cybersecurity, product safety, medical-device, consumer, equality, employment or financial-services law. A compliant AI governance programme must therefore map overlapping obligations and avoid treating the Act as an isolated workstream.

• GDPR and EU data protection law govern personal-data processing, lawful basis, transparency, rights and DPIAs.
• Cybersecurity rules influence secure development, incident handling, resilience and supply-chain controls.
• Medical-device and product-safety regimes may determine conformity-assessment routes and lifecycle evidence.
• Sector regulation may impose stricter model governance, recordkeeping, fairness or explainability expectations.
• Contracts determine how evidence, audit rights, incident notification and downstream responsibilities are allocated.

What should organisations do now?

A defensible readiness programme should be built around evidence, ownership and operational control rather than document production alone.

1. Establish scope - Identify AI systems, embedded AI, third-party tools and general-purpose models used or supplied across the organisation.

1. Map legal roles - Determine whether the organisation is acting as provider, deployer, importer, distributor, product manufacturer or multiple roles.

1. Classify use cases - Record intended purpose, affected people, decision significance, prohibited-practice screening, high-risk status and transparency duties.

1. Prioritise by exposure - Address prohibited practices, live high-risk use cases, GPAI obligations and externally facing transparency risks first.

1. Build the control framework - Define approval gates, risk assessment, human oversight, data governance, testing, cybersecurity, incident response and post-market monitoring.

1. Fix supplier governance - Update due diligence, contracts, technical evidence, audit rights, change notification and incident reporting.

1. Create evidence - Maintain inventories, classification records, risk assessments, decisions, technical documentation, training records, logs and assurance reports.

1. Report to leadership - Provide concise Board and executive reporting on exposure, readiness, exceptions, incidents and decisions required.

What evidence demonstrates readiness?

• Approved AI governance framework and accountable executive owner.
• Current AI system and model inventory with documented role and risk classification.
• Prohibited-practice screening records and escalation decisions.
• High-risk technical, risk, quality and human-oversight documentation.
• GPAI provider or downstream assurance evidence where relevant.
• AI literacy matrix, training records and competence evidence.
• Supplier due-diligence files and contracts aligned to AI responsibilities.
• Monitoring, logging, incident and corrective-action records.
• Board dashboards showing material exposure, exceptions and readiness milestones.

Common implementation mistakes

• Treating the Act as a legal memo rather than an operating-model change.
• Maintaining an incomplete inventory that excludes embedded, procured or employee-adopted AI.
• Classifying a model rather than the specific system and intended use.
• Assuming the vendor carries every obligation.
• Failing to document why a system is not high-risk.
• Using generic awareness training instead of role-based AI literacy.
• Running EU AI Act, GDPR, cybersecurity and product-safety workstreams separately.
• Producing policies without testing whether controls work in practice.

Frequently asked questions

Does the EU AI Act apply to UK organisations?

It can. UK organisations may be in scope when they place AI systems or models on the EU market, operate through EU establishments, or where covered AI outputs are used in the Union. Applicability must be assessed against the actual role, product, service and use case.

Is every generative AI system high-risk?

No. Generative capability does not automatically make a system high-risk. The legal treatment depends on the model provider's GPAI obligations, the downstream system's intended purpose, its use context and any transparency or high-risk classification rules.

Does ISO/IEC 42001 guarantee compliance?

No. ISO/IEC 42001 can provide a strong AI management-system structure, but it does not replace legal analysis, system classification, product obligations or evidence required by the Act.

Is an AI inventory legally required?

The Act does not impose one universal inventory format on every organisation. In practice, an inventory is the foundation for identifying systems, roles, risk categories, applicable duties and evidence.

Who should own EU AI Act compliance?

No single function can operate it alone. Effective ownership normally combines executive accountability with legal, risk, technology, data, privacy, cybersecurity, procurement, product and operational responsibilities.

What should the Board see?

The Board should receive decision-useful information: material AI uses, prohibited or high-risk exposure, readiness against deadlines, unresolved exceptions, incidents, supplier dependencies and decisions requiring executive risk acceptance.

How IG-Smart supports EU AI Act readiness

IG-Smart helps regulated and high-consequence organisations translate the Act into a proportionate governance and assurance programme. Support can include applicability and role mapping, AI inventories, risk classification, governance operating models, readiness assessments, high-risk control design, supplier assurance, executive reporting, ISO/IEC 42001 alignment and retained AI Governance Officer services.

Authoritative sources

Regulation (EU) 2024/1689 - Artificial Intelligence Act: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689

European Commission - AI Act overview: digital-strategy.ec.europa.eu/en/factpages/ai-act

European Commission - Navigating the AI Act: digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act

European Commission - General-purpose AI obligations: digital-strategy.ec.europa.eu/en/factpages/general-purpose-ai-obligations-under-ai-act

European Commission - Guidelines on prohibited AI practices: digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act

European Commission - Article 50 transparency guidelines: digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems

Current regulatory references

• European Commission AI Act implementation timeline
• European Commission AI Act Service Desk Article 99