EU AI Act
Everything you need to know about EU AI Act compliance: obligations, the four-gates risk model, conformity assessments, penalties, and how Modulos accelerates the process. Updated for the adopted Omnibus: high-risk deadlines move to December 2027, enforcement starts August 2026.
01 · The law
The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive law on artificial intelligence. It is a product safety regulation: it treats AI the way EU law has long treated machinery and medical devices, with obligations scaled to risk. A short list of practices is banned outright. High-risk systems must pass a conformity assessment before reaching the market and keep evidence that they stay safe. Most other systems carry transparency duties or none at all.
It applies to any organization whose AI reaches people in the EU, wherever that organization is based, and its penalties scale with global turnover. The goal is not to slow AI down. It is to make AI products trustworthy enough to ship, the way CE marking did for physical products.
02 · Deadlines
Four dates decide your plan. Everything already in force is history you inherit, not a deadline you manage.
Today
Spacing proportional to time from today
2 Aug 2026
in 25 days
General application and GPAI fines
2 Dec 2026
in 4 months
New Article 5 prohibitions apply and watermarking grace ends
2 Dec 2027
in 16 months
Annex III standalone high-risk obligations
2 Aug 2028
in 24 months
Annex I product-embedded high-risk obligations
Today
2 Aug 2026
in 25 days
General application and GPAI fines
2 Dec 2026
in 4 months
New Article 5 prohibitions apply and watermarking grace ends
2 Dec 2027
in 16 months
Annex III standalone high-risk obligations
2 Aug 2028
in 24 months
Annex I product-embedded high-risk obligations
Behind us: in force since 1 August 2024, prohibitions and AI literacy since February 2025, GPAI model rules since August 2025.
The Omnibus moved the high-risk deadlines. It did not move the reasons to start.
Model-provider fines under Article 101 become enforceable in weeks, not years.
The NCII and CSAM prohibitions and the watermarking deadline touch anyone shipping generative features.
Inventory, classification, control design, and evidence collection take 12 to 18 months at enterprise scale.
The Omnibus hands the AI Office investigation powers, on-site inspections, and fines of its own.
The Omnibus is not just a delay: it moves the high-risk deadlines, adds new prohibitions, and keeps the August 2026 enforcement date firmly in place.
The EU AI Act has been delayed. On 7 May 2026, the Council and Parliament reached provisional agreement on the Digital Omnibus. High-risk obligations now apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Why this is the last delay you'll get, and what to do about it.
The 28 April Omnibus trilogue collapsed and the August 2026 EU AI Act deadline still stands legally. Four scenarios, what changes, and what to do this week.
Annex III stand-alone high-risk to 2 December 2027; Annex I product-integrated high-risk to 2 August 2028.
AI systems intended to generate non-consensual sexual or intimate imagery, and CSAM. Systems lacking effective technical safeguards are also caught. Compliance by 2 December 2026.
Article 50 transparency: transitional grace for systems already on the market before 2 August 2026; deadline 2 December 2026.
Adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026. Enters into force on publication in the Official Journal, expected imminently.
Under Article 113 of the enacted AI Act, the main high-risk obligations apply from 2 August 2026.
The adopted Omnibus shifts Annex III stand-alone high-risk obligations to 2 December 2027. Awaiting OJ publication.
Keep inventory, classification, control design and evidence planning moving against the December 2027 date.
Under Article 6(1) and Article 113, Annex I product-integrated high-risk obligations apply from 2 August 2027.
The adopted Omnibus shifts Annex I obligations to 2 August 2028. Awaiting OJ publication.
Align product, legal, engineering and quality teams against the August 2028 date if AI is embedded in medical devices, machinery, radio, transport or other regulated products.
Article 50(2) transparency for AI-generated synthetic content applies from 2 August 2026 under Article 113.
The adopted Omnibus sets a transitional grace until 2 December 2026 for systems already on the market before 2 August 2026. Broader Article 50 transparency disclosures stay on the original schedule. Awaiting OJ publication.
Build provenance and labelling into pipelines now if you generate synthetic images, audio, video or text aimed at the EU market.
Article 57(1) sets 2 August 2026 as the deadline for Member States to establish at least one AI regulatory sandbox.
The adopted Omnibus postpones the Article 57(1) deadline to 2 August 2027 and expands real-world testing to Annex I systems outside sandboxes. Awaiting OJ publication.
For sandbox-eligible programs, build the operational case (innovation goal, supervisor relationship, exit criteria) early; the slot is the bottleneck, not the deadline.
Article 10(5) allows providers to process Article 9 special-category data for bias detection and correction only when strictly necessary, with safeguards.
The adopted Omnibus extends the legal basis to all AI systems and general-purpose AI models, but keeps the strictly-necessary standard. The Commission proposed lowering it to "necessary"; the co-legislators rejected that change. Awaiting OJ publication.
Plan bias testing under the existing strictly-necessary standard, with documented safeguards and a clear data-protection impact assessment.
Article 6(3) lets providers self-assess that an Annex III system does not pose a significant risk; Article 6(4) requires the assessment file; Article 49(2) requires registration of such systems in the EU database.
The adopted Omnibus preserves registration. The Commission proposed dropping the obligation for self-exempted systems; the co-legislators rejected that change. Awaiting OJ publication.
Treat Article 6(3) self-exemption as a documentation exercise, not a hide-from-the-database exercise. Build the assessment file and the database registration as one workflow.
The Article 5 prohibitions have applied since 2 February 2025.
The adopted Omnibus adds a new Article 5 prohibition on AI systems intended to generate non-consensual sexual or intimate imagery of identifiable real persons, and on AI systems intended to generate child sexual abuse material. Foreseeable misuse where effective technical safeguards are absent is also caught. Compliance by 2 December 2026. Awaiting OJ publication.
For generative-image, video, voice and avatar pipelines aimed at any EU touchpoint, design and document effective technical safeguards (consent verification, refusal training, content filters, audit logging) before deployment. Lack of safeguards is itself a trigger.
Supervision of AI systems built on a GPAI model where the model and the system come from the same provider was not cleanly separated from national-authority competence.
The adopted Omnibus clarifies, only in same-provider GPAI model + system cases, that the AI Office takes the lead, with new enforcement powers: investigations, on-site inspections, binding commitments, and fines. National authorities remain competent in law enforcement, border management, judicial authorities, and financial institutions. Awaiting OJ publication.
Map your supervisory contact point per use case rather than per company. A single GPAI provider deploying into multiple sectors faces different lead authorities depending on the sector.
AI Act Annex I lists Union harmonisation legislation (medical devices, toys, machinery, radio, watercraft, etc.) where AI Act high-risk obligations stack with sectoral product law.
The adopted Omnibus lets the Commission limit AI Act application via implementing acts where sectoral law has similar AI-specific requirements. Machinery is exempt from direct AI Act applicability; AI-specific health/safety routes through delegated acts under the Machinery Regulation. The "safety component" definition is narrowed to exclude systems used solely for user assistance or optimization. Do not assume relief until the implementing and delegated acts exist.
For Annex I products, watch for the Commission implementing and delegated acts before duplicating effort. Until they are adopted, the AI Act compliance path remains the operative one.
Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy of their staff, applicable since 2 February 2025.
The adopted Omnibus softens the obligation: providers and deployers must support the development of AI literacy rather than ensure specific literacy levels. The obligation remains but is substantively weakened. Awaiting OJ publication.
Keep role-based AI training running. Documented literacy efforts remain a cheap audit-defensibility win and feed Article 26 deployer duties either way.
03 · Scope
Article 2 gives the Act extraterritorial reach: it binds non-EU providers and deployers the moment an AI system is placed on the EU market or its outputs are used in the Union. Follow SYS-04, the credit-scoring system on the map. Neither company is European; both are in scope.
A non-EU provider builds an AI credit-scoring model. A US fintech licenses it. EU customers receive credit decisions from it. Article 2 brings both the non-EU provider and the non-EU deployer into scope here, because the system is placed on the EU market and its outputs are used in the Union.
Provider, deployer, importer, distributor: four of the commercial roles defined in the EU AI Act. The trap is not understanding what they mean. It is recognising which one you actually are. Most companies guess wrong, and the difference can be six figures of compliance work.
Fine-tune or integrate a foundation model into an Annex III use case. If the result qualifies as high-risk under Article 6, Article 25(1)(c) reclassifies you from deployer to provider. Substantially modify an already-high-risk system and Article 25(1)(b) does the same. Provider obligations are heavy: technical documentation, conformity assessment, the Articles 9 to 15 stack.
White-label a third-party high-risk AI system and put your name or trademark on it, and Article 25(1)(a) says you are now the provider. The original developer’s documentation does not transfer to you. You inherit all provider obligations, even if the system was built by someone else.
Internal HR screening tool that touches EU candidates? You are a deployer of a high-risk system under Annex III. Customer service chatbot interacting with EU customers? Deployer with Article 50 transparency obligations on top. Credit-scoring model used inside a fintech’s product? Deployer of high-risk AI under Annex III. “We just bought it from a vendor” is not a defence.
Reselling a non-EU high-risk AI system into the EU market? Importer obligations under Article 23, including verifying the provider has done the conformity assessment. Acting as a SaaS reseller or marketplace in a value chain for high-risk AI? Probably distributor obligations under Article 24. The high-risk qualifier matters: these duties attach specifically to high-risk systems, not to AI in general.
Misclassification is the most expensive mistake on this page. The default assumption that “we just use AI” rarely survives contact with the Act’s definitions. Get the role right before you scope the program: every other obligation flows from it.
The risk calculator classifies your likely EU AI Act role and puts a number on your exposure in about three minutes.
04 · Obligations
The Act does not sort systems into tidy risk tiers. It runs four independent checks, and the obligations stack. Here is how that plays out for SYS-04, then the full stack article by article.
Follow the system · SYS-04 · credit-scoring model · non-EU provider, US fintech deployer, EU customers
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-04 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-04 · YESfires
Result: Creditworthiness assessment is Annex III point 5(b). Full high-risk stack by 2 December 2027.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-04 · NOpasses
If yes: Disclosure and marking duties; the watermarking grace ends 2 December 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-04 · NOpasses
If yes: Model-level duties, in force since August 2025.
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-04 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-04 · YESfires
Result: Creditworthiness assessment is Annex III point 5(b). Full high-risk stack by 2 December 2027.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-04 · NOpasses
If yes: Disclosure and marking duties; the watermarking grace ends 2 December 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-04 · NOpasses
If yes: Model-level duties, in force since August 2025.
Obligations tray
Everything SYS-04 accumulated, all of it from Gate 2
Follow the system · SYS-19 · risk-assessment model · EU insurer, life and health underwriting
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-19 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-19 · YESfires
Result: Risk assessment and pricing for life and health insurance is Annex III point 5(c). Full high-risk stack by 2 December 2027.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-19 · NOpasses
If yes: Disclosure and marking duties; the watermarking grace ends 2 December 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-19 · NOpasses
If yes: Model-level duties, in force since August 2025.
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-19 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-19 · YESfires
Result: Risk assessment and pricing for life and health insurance is Annex III point 5(c). Full high-risk stack by 2 December 2027.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-19 · NOpasses
If yes: Disclosure and marking duties; the watermarking grace ends 2 December 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-19 · NOpasses
If yes: Model-level duties, in force since August 2025.
Obligations tray
Everything SYS-19 accumulated, all of it from Gate 2
Follow the system · SYS-12 · customer-support chatbot · EU deployer, built on a licensed vendor model
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-12 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-12 · NOpasses
If yes: The full high-risk stack: Articles 9 to 17, conformity assessment, registration.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-12 · YESfires
Result: It talks to customers: Article 50 requires disclosing that they are interacting with AI, from 2 August 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-12 · NOpasses
If yes: Model-level duties, in force since August 2025.
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-12 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-12 · NOpasses
If yes: The full high-risk stack: Articles 9 to 17, conformity assessment, registration.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-12 · YESfires
Result: It talks to customers: Article 50 requires disclosing that they are interacting with AI, from 2 August 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-12 · NOpasses
If yes: Model-level duties, in force since August 2025.
Obligations tray
Everything SYS-12 accumulated, a light stack, all from Gate 3
Follow the system · SYS-27 · marketing image generator · EU provider, fine-tuned image model in a creative suite
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-27 · AT RISKneeds safeguards
Result: Not built for abuse, but NCII generation is a foreseeable outcome: without effective technical safeguards the new ban catches it. Safeguards by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-27 · NOpasses
If yes: The full high-risk stack: Articles 9 to 17, conformity assessment, registration.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-27 · YESfires
Result: It generates synthetic images: Article 50 machine-readable marking; the grace for systems already on the market ends 2 December 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-27 · NOpasses
If yes: Model-level duties, in force since August 2025.
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-27 · AT RISKneeds safeguards
Result: Not built for abuse, but NCII generation is a foreseeable outcome: without effective technical safeguards the new ban catches it. Safeguards by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-27 · NOpasses
If yes: The full high-risk stack: Articles 9 to 17, conformity assessment, registration.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-27 · YESfires
Result: It generates synthetic images: Article 50 machine-readable marking; the grace for systems already on the market ends 2 December 2026.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-27 · NOpasses
If yes: Model-level duties, in force since August 2025.
Obligations tray
Everything SYS-27 accumulated, Gates 1 and 3 stack
Follow the system · SYS-31 · in-house foundation model · EU provider of a GPAI model powering its own assistant
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-31 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-31 · NOpasses
If yes: The full high-risk stack: Articles 9 to 17, conformity assessment, registration.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-31 · YESfires
Result: The assistant generates content: Article 50 disclosure and marking apply.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-31 · YESfires
Result: A GPAI model you provide: Chapter V duties, in force since August 2025. In same-provider cases the AI Office leads supervision under the adopted Omnibus.
Gate 1 · Article 5
Does it manipulate, socially score, or fall under the new NCII and CSAM bans?
SYS-31 · NOpasses
If yes: Banned. The new NCII and CSAM bans apply by 2 December 2026.
Gate 2 · Article 6, Annex I and III
Is it a safety component of a regulated product, or standalone in an Annex III domain?
SYS-31 · NOpasses
If yes: The full high-risk stack: Articles 9 to 17, conformity assessment, registration.
Gate 3 · Article 50
Does it interact with people directly or generate synthetic content?
SYS-31 · YESfires
Result: The assistant generates content: Article 50 disclosure and marking apply.
Gate 4 · Chapter V
Is it a general-purpose model, or built on one you also provide?
SYS-31 · YESfires
Result: A GPAI model you provide: Chapter V duties, in force since August 2025. In same-provider cases the AI Office leads supervision under the adopted Omnibus.
Obligations tray
Everything SYS-31 accumulated, Gates 3 and 4 stack
Four checks, different stacks. Pick a system above, or run your own through all four gates.
The Act lays out a range of requirements for high-risk AI systems. Tap any card for a plain-language summary and a link to the article.
* Required for public-law deployers and private entities providing public services, plus deployers of certain Annex III high-risk systems (creditworthiness assessment under 5(b) and life/health insurance risk assessment under 5(c)). Annex III point 2 (critical infrastructure) is excluded from the FRIA trigger.
High-risk systems must pass a conformity assessment before market entry. Most Annex III providers self-assess under Annex VI; the narrow third-party routes run through a notified body, and Annex I products follow their sectoral regimes. There is no scheduled audit afterwards: scrutiny arrives when a market surveillance authority requests your technical file, so the record has to be ready either way.
Step 1 - A high-risk AI system is developed
Establish, implement, document, and maintain a risk management system to address the risks posed by a high-risk AI system.
Step 2 - The system undergoes the conformity assessment and complies with AI requirements
- Implement effective data governance, including bias mitigation, training, validation, and testing of data sets.
- Maintain up-to-date technical documentation in a clear and comprehensive manner.
Step 3 - Registration of certain high-risk systems in the EU database under Article 49 (primarily Annex III).
- Ensure that high-risk AI systems allow for the automatic recording of events (logs) over their lifetime.
- Design systems to ensure sufficient transparency for deployers to interpret outputs and use appropriately.
Step 4 - A declaration of conformity is signed, and the AI system must bear the required CE marking under Article 48
- Develop systems to maintain an appropriate level of accuracy, robustness, and cybersecurity throughout their lifecycle.
- Ensure proper human oversight during the period the system is in use.
The system can be placed on the market.
Once substantial changes happen in the AI system's lifecycle, repeat from Step 2.
Disclaimer: The steps outlined above are intended to provide a general overview of the conformity assessment process. They should not be considered exhaustive and are not intended as legal or technical advice.
05 · Exposure
Penalties
Article 99 sets three tiers. For most undertakings the higher of a fixed cap or a share of global turnover applies. Pick a revenue and see your number.
At €2B in global revenue the turnover share exceeds every fixed cap, so the percentage applies.
SMEs and start-ups take the lower of the two under Article 99(6). The adopted Omnibus extends certain SME regulatory exemptions to small mid-caps, up to 750 employees or €150M turnover; the exact scope will be confirmed by the Official Journal text.
GPAI model providers face separate fines under Article 101, enforceable from 2 August 2026.
See your exposure mapped to controls and evidence, system by system.
Request a Demo06 · The work
Reading the law is the easy part. The work is an inventory that stays current, classifications you can defend, controls mapped to articles, and evidence that accumulates as a side effect of normal work. That is what the platform is for: Modulos holds CertX product conformity certificate 213-001/24 against ISO/IEC 42001:2023, and took Xayn to the first ISO/IEC 42001 certification in Germany.
Three credentials specific to the EU AI Act, ordered by weight. The links point to the public bodies the work was done with.
CEN-CENELEC JTC 21
Highest weight
High-risk compliance will run through CEN-CENELEC harmonised standards: once cited in the Official Journal under Article 40, they grant a legal presumption of conformity for the requirements they cover (Articles 9 to 15). Modulos contributed to these standards through the JTC 21 working groups.
JTC 21 (CEN-CENELEC)AESIA, Spanish AI regulatory sandbox
First EU AI Act sandbox
Spain ran the first EU AI Act regulatory sandbox, operated by AESIA, Europe’s first dedicated AI supervisory agency. It produced 16 official guidelines, the first interpretative criteria from a European public authority. Modulos supported the work of the sandbox.
AESIAEU AI Pact
Voluntary early commitment
Modulos is a signatory of the EU AI Pact, the European Commission’s voluntary pledge to apply AI Act principles ahead of full applicability: an AI governance strategy, high-risk system mapping, and AI literacy across staff.
Public AI Pact signatory listAnd the certifiable management system the proof flows into
Modulos holds CertX product conformity certification against ISO/IEC 42001 (certificate 213-001/24). ISO/IEC 42001 is not a substitute for AI Act conformity assessment, but it is the management-system spine most mature AI Act programs build on. See the ISO 42001 page.
07 · Context
Most organisations operate the AI Act alongside other regulations and standards rather than instead of them. Here is where the Act sits relative to the frameworks teams most often ask about.
| Standard / Regulation | Domain | Relation to the EU AI Act |
|---|---|---|
| ISO/IEC 42001 | International AI management system | Complementary |
| NIST AI RMF | Voluntary U.S. risk-management framework | Complementary |
| GDPR | Binding EU data-protection regulation | Different layer |
| EU Machinery Regulation | Safety-critical machinery in the EU | Operational glue |
ISO/IEC 42001 is the certifiable international management system standard for AI. Article 17 of the AI Act requires high-risk providers to operate a quality management system. Holding ISO 42001 certification is one of the strongest practical signals of meeting Article 17, although not formally a substitute. Most mature AI Act compliance programs land inside an ISO 42001 management system.
NIST AI RMF is voluntary U.S. guidance organised around four core functions (Govern, Map, Measure, Manage). The AI Act is binding EU regulation. Implementing AI RMF builds the risk-management practices Article 9 expects of high-risk providers, but it does not substitute for the Act's conformity-assessment and CE-marking requirements. See the NIST AI RMF page.
Both the AI Act and the GDPR are binding EU regulations, but they govern different layers. GDPR governs personal data; the AI Act governs AI systems. They overlap sharply on biometric processing, bias-testing with sensitive data, and the rights of individuals affected by automated decisions. Compliance with the GDPR does not satisfy the AI Act, and vice versa; both apply.
Under the AI Omnibus adopted in June 2026, machinery is exempt from direct AI Act applicability. AI-specific health and safety requirements for AI systems classified as high-risk under the AI Act are routed through delegated acts under the Machinery Regulation itself, with a Commission obligation to issue guidance to economic operators. Awaiting Official Journal publication. The Canton of Zurich Innovation Sandbox for AI report still illustrates the value of running a single integrated AI management system across regimes. See the Sandbox report (PDF).
Comparing platforms? See how 20 AI governance platforms address the EU AI Act in our 2026 enterprise buyer’s guide.
By industry
See how this plays out in the sectors where it drives the most AI governance work:
08 · Questions
The EU AI Act (Regulation 2024/1689) is the European Union’s comprehensive law on artificial intelligence, in force since 1 August 2024. It is a product safety regulation: it bans some AI practices outright, requires conformity assessments and CE marking for high-risk AI systems, imposes transparency obligations, and sets model-level obligations for general-purpose AI providers.
The EU AI Act came into force on 1 August 2024. Obligations apply on staggered dates: Article 5 prohibitions and Article 4 AI literacy from 2 February 2025; Chapter V general-purpose AI model-provider obligations from 2 August 2025; general application on 2 August 2026. The AI Omnibus, adopted by Parliament and Council in June 2026, shifts Annex III high-risk obligations to 2 December 2027 and Annex I product-integrated high-risk obligations to 2 August 2028; it enters into force on Official Journal publication.
Yes. The AI Act has been legally in force since 1 August 2024. Already applicable: Article 5 prohibitions and Article 4 AI literacy from February 2025; Chapter V general-purpose AI model-provider obligations from August 2025. Under the AI Omnibus, adopted in June 2026 and awaiting Official Journal publication, Annex III high-risk obligations apply from 2 December 2027 and Annex I product-integrated high-risk obligations from 2 August 2028.
A regulation. It applies directly and uniformly across all 27 EU member states from the moment it enters into force, without requiring national implementing legislation. This is the same legal instrument as the GDPR. Member states cannot soften or vary its core obligations through domestic law.
It bans a small set of AI practices outright; requires high-risk AI systems to undergo conformity assessment and CE marking before being placed on the market; imposes transparency obligations on AI systems that interact with people or generate synthetic content; and sets model-level obligations for general-purpose AI providers, including documentation and copyright-related disclosures.
Article 5 prohibits social scoring of natural persons that meets the conditions in Article 5(1)(c); manipulative or exploitative AI that causes harm; real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions); biometric categorisation based on sensitive characteristics; emotion recognition in workplaces and education; predictive policing based solely on profiling; and untargeted facial-image scraping for facial recognition databases.
Two routes under Article 6. Annex I: AI systems that are safety components of products covered by listed Union harmonisation legislation (medical devices, machinery, vehicles, radio equipment, toys, and others), where Article 6(1)(b) requires the product to undergo a third-party conformity assessment. Annex III: stand-alone AI systems in eight domains, namely biometrics, critical infrastructure, education, employment, essential public and private services, law enforcement, migration and border control, and the administration of justice and democratic processes.
Article 2 sets the scope: providers placing AI systems on the EU market (regardless of where the provider is established); deployers established or located in the Union; importers and distributors of AI systems in the EU; product manufacturers placing AI systems on the EU market; authorised representatives of non-EU providers; and providers and deployers in third countries when the AI system outputs are used in the Union.
Yes, if the UK company places an AI system on the EU market or its AI system outputs are used in the EU. The Act applies based on who is affected, not where the provider is headquartered. The UK’s post-Brexit status does not exempt UK companies from EU AI Act obligations when EU users or markets are involved.
Yes. A US company selling an AI system into the EU market, or whose AI system outputs are used by EU customers, is in scope. A US provider placing a high-risk AI system on the EU market must appoint an authorised representative established in the EU under Article 22. Non-EU providers of general-purpose AI models have a separate authorised-representative rule under Article 54.
Inventory your AI systems; classify each against the four independent gates (prohibited, high-risk, transparency, GPAI); confirm your role under Articles 3 and 25 (provider, deployer, importer, distributor). If you are a provider of a high-risk AI system, the Article 16 stack applies: run a conformity assessment under Article 43, build the Article 11 technical file, draw up the EU Declaration of Conformity, affix the CE mark under Article 48, and operate a quality management system under Article 17 (typically through ISO/IEC 42001); register the system under Article 49 where required (mainly Annex III, including systems self-exempted from high-risk classification under Article 6(3); the adopted AI Omnibus preserves registration for those). Deployers operate under Article 26 instead, with a narrower set of duties unless Article 25 reclassifies them as providers.
Up to €35 million or 7% of global annual turnover for prohibited-practice violations, whichever is higher. Up to €15 million or 3% for most other obligations. Up to €7.5 million or 1% for supplying incorrect, incomplete, or misleading information to authorities. Small and medium enterprises and start-ups face proportionally lower caps under Article 99(6). National market surveillance authorities enforce most penalties; Article 101 fines on GPAI model providers are imposed by the European Commission directly.
ISO/IEC 42001 is the international management system standard for AI. AI Act Article 17 requires high-risk AI providers to implement a quality management system. Holding ISO 42001 certification is one of the strongest practical signals of meeting Article 17, though not formally a substitute. Most mature AI Act compliance programs operate inside an ISO 42001 management system.
NIST AI RMF is voluntary US guidance for AI risk management. The EU AI Act is binding EU regulation with legal obligations and penalties. Implementing NIST AI RMF builds the risk-management practices the Act expects, particularly Article 9 risk management for high-risk providers, but it does not substitute for the Act’s specific compliance and conformity-assessment requirements.
Yes, for high-risk systems. The AI Omnibus, adopted by the European Parliament on 16 June 2026 and the Council on 29 June 2026, shifts Annex III stand-alone high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I product-integrated high-risk obligations from 2 August 2027 to 2 August 2028. It also adds a new Article 5 prohibition on non-consensual intimate content and CSAM (compliance by 2 December 2026), sets the Article 50 watermarking grace deadline at 2 December 2026, and postpones national regulatory sandboxes to 2 August 2027. It enters into force on Official Journal publication; treat the adopted dates as the operative planning baseline.
Modulos automates the compliance workflow for high-risk AI systems: AI system inventory, classification across the four gates, Article 9 risk management, Article 10 data governance, Article 11 technical documentation, Article 13 transparency, Article 17 quality management, and ongoing monitoring. The platform holds CertX product conformity certificate 213-001/24 against ISO/IEC 42001:2023, the standard most relevant to demonstrating Article 17 QMS requirements.
Whether you are already using or considering AI in your business, keeping these regulatory changes in mind is essential. Modulos can support your compliance journey.
