EU AI Act Compliance
Obligations apply in stages, and the first stage has already passed. Classification determines everything: what you must document, what you must test, and what you owe if it goes wrong.
The Act applies in stages — and the stage that already applies is the one with the highest penalties
The EU AI Act entered into force on 1 August 2024. Prohibited practices became applicable on 2 February 2025. Obligations for general-purpose AI models followed on 2 August 2025, and the high-risk regime applies from 2 August 2026, with product-embedded high-risk systems following in 2027.
The structure matters because penalties are tiered against the obligation breached: up to EUR 35 million or 7% of worldwide turnover for engaging in a prohibited practice, up to EUR 15 million or 3% for breach of other obligations including the high-risk requirements, and up to EUR 7.5 million or 1% for supplying incorrect information. A company that treats the Act as a future problem is exposed to the most expensive tier today.
What we do
- Applicability analysis: whether the system is placed on the EU market or its output is used in the EU, regardless of where the provider is established
- Risk classification: prohibited, high-risk (Annex III or product-embedded), limited-risk with transparency duties, or minimal-risk
- High-risk compliance build: risk management system, quality management system, technical documentation, logging, human oversight, accuracy and robustness
- GPAI obligations: model documentation, training-data summary, copyright policy, and systemic-risk duties where the compute threshold is met
- Transparency: disclosure of AI interaction, marking of synthetic content, and deployer-facing information
- Alignment with China: reconciling Act obligations with algorithm registration and labelling duties so one control set serves both regimes
What is different for an AI company
- Fix the role before reading the obligations. A Chinese vendor supplying a system into the EU is generally a provider; internal-only use may make it a deployer. The role determines the list.
- General-purpose model duties apply first. GPAI providers must meet transparency, copyright-policy and training-data-summary obligations — a separate track from high-risk conformity assessment.
- The high-risk list decides whether conformity assessment is needed. Biometrics, critical infrastructure, education and employment fall within the annex list, requiring risk management and technical documentation.
- Extraterritorial reach turns on placing on the market. A system offered in the EU, or whose output is used in the EU, can be caught regardless of whether an EU entity exists.
- Sequence the timetable against the roadmap. Provisions apply in stages; align product iterations with compliance milestones rather than waiting for full application.
Typical situations
Situation 1: “We do not sell to Europe” is not a jurisdiction test
A product is offered in English only, has no EU entity, and no EU marketing. Users in the EU access it anyway. The Act’s scope turns on placing on the market or putting into service in the Union and on use of the output in the Union — not on where the provider sits, and not on whether the product was aimed at European users.
Our approach: test the actual distribution and use pattern rather than the marketing posture, document the conclusion, and where the analysis is genuinely ambiguous, adopt the compliance posture that is defensible if the question is later asked by a regulator.
Situation 2: Classification treated as a single label
A product is classified once, as limited-risk, at a point when it was used for one purpose. It is later deployed for recruitment screening and credit assessment, both Annex III uses. Classification is use-specific, and a system can carry different obligations across different deployments.
Our approach: classify per intended purpose and per deployment context, keep a classification register that is updated when the use changes, and treat a new high-risk use as a compliance project rather than a product update.
Situation 3: GPAI duties missed because the company is a “downstream” provider
A company fine-tunes or substantially modifies a general-purpose model and assumes the upstream provider carries the obligations. Fine-tuning can bring a provider into the GPAI regime, and a downstream provider that puts its name on the model takes on provider duties for the modified version.
Our approach: map the value chain and identify which party holds which role after modification, then allocate documentation duties contractually so that the upstream provider supplies what the downstream provider needs to comply.
Process and deliverables
| Stage | Work | Deliverables |
|---|---|---|
| 1 | Applicability and role mapping | Scope opinion + role map across the value chain |
| 2 | Risk classification per use | Classification register + obligation matrix |
| 3 | Compliance build for the applicable tier | Risk and quality systems, technical file, oversight design |
| 4 | Transparency and deployer documentation | User disclosures, instructions for use, content marking |
| Ongoing | Regulatory tracking and re-classification | Update log + annual review |
AI-specific deliverables
- Role and risk-classification memo: provider, deployer or importer, and the risk tier with the obligations that follow.
- GPAI compliance file: technical documentation, training-content summary and policy set for general-purpose models.
Frequently asked
When do the high-risk obligations start applying? 2 August 2026 for systems listed in Annex III. High-risk systems that are safety components of products already regulated under EU product law follow from 2 August 2027. The prohibitions have applied since 2 February 2025 and carry the highest penalty tier.
Is a chatbot high-risk? Ordinarily no — it falls into the transparency tier, provided it discloses that the user is interacting with an AI system and that generated content is marked. It becomes high-risk if its intended purpose falls within an Annex III area, for example use in recruitment or in creditworthiness assessment.
What is the systemic-risk threshold for GPAI models? The presumption attaches at training compute above 10^25 floating-point operations, and can also be triggered by a Commission designation. Systemic-risk models carry additional duties: model evaluation, adversarial testing, incident reporting and cybersecurity protection.
Can EU AI Act compliance and China’s algorithm filing share work? Partly. Both require documentation of the model, its data and its risk controls, and both impose content-labelling duties. The frameworks differ in classification logic and in what must be filed, but the underlying technical description can be written once and adapted, which is materially cheaper than two parallel projects.
Legal basis
- Regulation (EU) 2024/1689 (Artificial Intelligence Act): scope (Art. 2), prohibited practices (Art. 5), high-risk classification (Art. 6 and Annex III), high-risk requirements (Arts. 8-15), transparency (Art. 50), GPAI obligations (Arts. 53-55), penalties (Art. 99)
- Application dates: 2 February 2025 (prohibitions), 2 August 2025 (GPAI), 2 August 2026 (general application), 2 August 2027 (Annex I products)
- GDPR: where personal data is processed in training or inference, the data protection regime applies alongside the Act
- China: Interim Measures for the Management of Generative AI Services and the labelling rules, for alignment of cross-border product compliance