EU AI Act, know your risk tier and your duties
Work out whether your AI is covered, which tier it falls in, and what to do before the deadlines.
Official sources
Use these official places to read the text and find the latest version.
Official website
The official text is free in the EU Official Journal. The European Commission’s AI Office publishes guidance.
Visit eur-lex.europa.eu (Regulation 2024/1689) ↗Get the document
Read the full regulation free on EUR-Lex. The European Commission and the AI Office also publish guidance, and the Commission has adopted a simplification package (the AI Omnibus) that moved some dates.
Open the official page ↗What EU AI Act is
The EU AI Act is the first major law on AI. It sorts AI systems by risk: banned, high risk, limited risk and minimal risk, and sets duties for each.
It reaches providers and users outside the EU if their AI is placed on the EU market or its output is used there.
How EU AI Act got to where it is today
The milestones that changed what organisations have to do.
Proposal
The European Commission proposes the Act.
Adopted
The Act enters into force in August 2024.
First duties apply
Banned practices and AI literacy rules start to apply on 2 February 2025.
More duties apply
Most remaining rules apply from 2 August 2026. Rules for high-risk AI systems listed in Annex III now apply from 2 December 2027, and for AI built into regulated products from 2 August 2028. A new ban on non-consensual intimate imagery and child abuse material applies from 2 December 2026.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You build or sell AI into the EU.
You use AI in hiring, credit, education or other sensitive areas.
You use general-purpose AI models in your products.
Customers ask whether you are ready.
What it asks of you
The requirements fall into six areas.
Banned practices
Some uses of AI are prohibited outright.
High-risk systems
Strict duties for AI in sensitive areas.
Transparency
Tell people when they deal with AI or AI-made content.
General-purpose AI
Extra duties for providers of large models.
Governance and oversight
Human oversight, logging and quality systems.
Penalties and enforcement
Fines and national authorities.
The 8 chapters, 28 article groups and 103 obligations
The EU AI Act sorts AI by risk: a small set of banned uses, strict duties for high-risk systems, disclosure rules for chatbots and synthetic content, and separate rules for general-purpose models. Open any group to see the obligation and how an SME can meet it.
28 article groups · 103 obligations
General provisions and prohibited practicesWho is covered, the AI literacy duty and the banned uses.2 article groups · 9 obligations
- Art. 4
Providers and deployers take steps to give their staff and others operating AI on their behalf a sufficient level of AI literacy.
What you do
- Run short role-based AI training for staff who build or use AI
- Keep an attendance and refresher log
Evidence to keep
- AI literacy training records
- Role-based AI competence matrix
- AI use policy acknowledgements
- Art. 5(1)(a)
Do not place on the market or use AI that uses subliminal, manipulative or deceptive techniques to distort behaviour and cause significant harm.
What you do
- Screen marketing and persuasion features for hidden manipulation
- Require vendors to confirm they do not use such techniques
- Art. 5(1)(b)
Do not use AI that exploits vulnerabilities linked to age, disability or social or economic situation to distort behaviour and cause significant harm.
What you do
- Review products aimed at children, older people or people in financial difficulty
- Add vulnerability checks to the design review
- Art. 5(1)(c)
Do not use AI to score people on social behaviour or personal traits where this leads to unjustified or unrelated detrimental treatment.
What you do
- Check that customer or staff scoring only uses relevant, context-appropriate data
- Document the purpose of every scoring model
- Art. 5(1)(d)
Do not use AI to predict that a person will commit a crime based solely on profiling or personality traits.
What you do
- Confirm no risk-of-offending prediction is built on profiling alone
- Record the legal basis for any security-related analytics
- Art. 5(1)(e)
Do not build facial recognition databases through untargeted scraping of images from the internet or CCTV.
What you do
- Check that no tool scrapes faces in bulk
- Ask image and identity vendors how their datasets were collected
- Art. 5(1)(f)
Do not infer emotions of people in the workplace or in education, except for medical or safety reasons.
What you do
- Disable emotion detection in call-centre, meeting or proctoring tools
- Check vendor features before enabling analytics add-ons
- Art. 5(1)(g)
Do not use biometric categorisation to infer sensitive traits such as race, political opinions, religion or sexual orientation.
What you do
- Confirm biometric tools do not classify people into sensitive groups
- Include this in biometric vendor due diligence
- Art. 5(1)(h)
Do not use real-time remote biometric identification in public spaces for law enforcement, other than narrow permitted cases.
What you do
- Ensure premises or retail facial recognition is not used for real-time public identification
- Escalate any law enforcement request to legal counsel
Evidence to keep
- AI use-case register screened against Art. 5
- Legal sign-off on screening
- Procurement checklist covering prohibited uses
High-risk classificationHow to tell whether an AI system counts as high-risk.3 article groups · 13 obligations
- Art. 6(1)
Treat an AI system as high-risk when it is a safety component of, or is itself, a product under listed EU product legislation that needs third-party conformity assessment.
What you do
- List products with embedded AI and check them against Annex I legislation
- Ask the product manufacturer or notified body for classification
- Art. 6(2)
Treat AI systems in the Annex III use-case areas as high-risk.
What you do
- Screen every AI use case against the eight Annex III areas
- Keep the screening result in the AI register
- Art. 6(3)
If you consider an Annex III system not high-risk because it poses no significant risk to health, safety or rights, document that assessment before placing it on the market.
What you do
- Write a short reasoned assessment signed by a senior owner
- Note that profiling of people always stays high-risk
- Art. 6(4)
Register the system and keep the assessment available for authorities when relying on the Art. 6(3) exception.
What you do
- Keep the assessment ready for regulator request
- Record the registration entry
Evidence to keep
- High-risk classification assessment per AI system
- Product-law mapping for AI in regulated products
- Records of any Art. 6(3) exception reasoning
a3Annex III use-case areas (Art. 6(2), Annex III)Eight areas where AI is presumed to affect people significantly.8 obligations
- Annex III pt 1
Biometrics: remote biometric identification, biometric categorisation and emotion recognition systems (where permitted) are high-risk.
What you do
- Identify any biometric or emotion-related tools in use
- Check permitted use before deployment
- Annex III pt 2
Critical infrastructure: AI used as a safety component in managing digital infrastructure, road traffic, or water, gas, heating or electricity supply is high-risk.
What you do
- Flag AI in operational control of infrastructure
- Include it in your resilience plans
- Annex III pt 3
Education and vocational training: AI that decides admission, evaluates learning outcomes, sets education level or monitors cheating in tests is high-risk.
What you do
- List admissions, grading or proctoring tools
- Add human review to every outcome
- Annex III pt 4
Employment and worker management: AI for recruitment, selection, promotion, termination, task allocation or performance monitoring is high-risk.
What you do
- Inventory CV screening, ranking and monitoring tools
- Plan worker information and human oversight
- Annex III pt 5
Essential services: AI for public benefit eligibility, credit scoring, life and health insurance pricing and emergency call triage is high-risk.
What you do
- Identify credit, underwriting and eligibility models
- Document how decisions are explained to people
- Annex III pt 6
Law enforcement: AI used by or for law enforcement for certain risk, evidence and profiling tasks is high-risk.
What you do
- Confirm whether you supply tools to police or similar bodies
- Check contracts for intended use
- Annex III pt 7
Migration, asylum and border control: AI for risk assessment, application examination and identification in these areas is high-risk.
What you do
- Confirm whether your products are used in border or immigration settings
- Review customer use cases
- Annex III pt 8
Justice and democratic processes: AI that helps judicial authorities apply the law or influences elections is high-risk.
What you do
- Check whether tools support courts or dispute resolution
- Record the intended purpose in documentation
Evidence to keep
- AI register tagged by Annex III area
- Use-case descriptions for HR, credit and education tools
- Vendor statements on intended purpose
- Art. 7
Track Commission changes to the Annex III list and re-check your classification when it changes.
What you do
- Subscribe to AI Office updates
- Re-run the classification review at least yearly
Evidence to keep
- Regulatory watch log
- Re-assessment schedule for AI register
High-risk system requirements (Arts. 8-15)Technical and process requirements every high-risk system must meet.7 article groups · 18 obligations
- Art. 8
Make sure the high-risk system meets all the Chapter III Section 2 requirements, taking its intended purpose into account.
What you do
- Create a requirement-by-requirement compliance matrix
- Assign an accountable owner
- Art. 9(2)
Run a continuous, documented risk management process across the whole lifecycle.
What you do
- Identify and rate known and foreseeable risks to health, safety and rights
- Update the process after incidents or major changes
- Art. 9(5)
Adopt measures so residual risk is acceptable, and eliminate or reduce risk through design where possible.
What you do
- Record the controls chosen and the remaining risk
- Get a documented sign-off
- Art. 9(6)
Test the system to find the most suitable risk measures and to prove it performs consistently for its purpose.
What you do
- Define metrics and test thresholds before release
- Keep test reports
- Art. 9(9)
Consider whether the system could adversely affect children and other vulnerable groups.
What you do
- Add this to the risk workshop agenda
- Document the outcome
Evidence to keep
- Risk management plan and register for the AI system
- Testing and residual risk records
- Review log
- Art. 10(2)
Apply data governance practices covering design choices, collection, preparation, assumptions, gaps and bias.
What you do
- Keep a data sheet for each dataset
- Record how data was cleaned and labelled
- Art. 10(3)
Use datasets that are relevant, sufficiently representative and, as far as possible, free of errors and complete for the purpose.
What you do
- Check coverage against the population the system will serve
- Track data quality metrics
- Art. 10(2)(f)
Examine datasets for possible biases that could harm health, safety or rights and take steps to detect and reduce them.
What you do
- Run bias tests across relevant groups
- Document mitigation steps
Evidence to keep
- Data governance procedure
- Dataset documentation and lineage
- Bias examination reports
- Art. 11
Prepare and keep up to date technical documentation before market placement that shows compliance and gives authorities the information they need.
What you do
- Use the Annex IV headings as a template
- Update the file at every material release
- Art. 11(1)
SMEs and start-ups may give the required documentation in a simplified form set by the Commission.
What you do
- Check for the simplified form before drafting
- Keep it consistent with the full requirements
Evidence to keep
- Technical documentation file (Annex IV content)
- Version history
- Design and test records
- Art. 12
Design the high-risk system so it automatically records events across its lifetime to support traceability, monitoring and risk detection.
What you do
- Define which events are logged and for how long
- Protect logs against tampering
Evidence to keep
- Logging specification
- Sample logs with retention settings
- Access controls for logs
- Art. 13
Design the system so deployers can interpret its output and use it appropriately.
What you do
- Provide plain-language limitations and accuracy figures
- Include maintenance and human oversight information
- Art. 13(3)
Supply instructions for use covering provider identity, purpose, accuracy, known risks, oversight measures and expected lifetime.
What you do
- Draft instructions with product and legal teams
- Version them with each release
Evidence to keep
- Instructions for use
- Performance and limitation statements
- Deployer onboarding pack
- Art. 14
Design the system so natural persons can effectively oversee it while it is in use.
What you do
- Build in alerts, explanations and an override or stop function
- Test that overseers can intervene in practice
- Art. 14(4)
Enable overseers to understand capabilities and limits, spot automation bias, interpret output, decide not to use output, and halt the system.
What you do
- Train overseers on automation bias
- Define when to escalate or stop
Evidence to keep
- Human oversight design record
- Oversight role descriptions and training
- Override and stop-button test records
- Art. 15(1)
Achieve and declare an appropriate level of accuracy, robustness and cybersecurity throughout the lifecycle.
What you do
- Set measurable thresholds and monitor them
- Declare metrics in the instructions
- Art. 15(4)
Make the system resilient to errors, faults and feedback loops from learning after deployment.
What you do
- Test for failure modes and drift
- Add fall-back behaviour
- Art. 15(5)
Protect against attempts to alter use, outputs or performance, including data poisoning and adversarial examples.
What you do
- Include AI-specific threats in penetration tests
- Control access to models and training data
Evidence to keep
- Accuracy metrics in documentation
- Robustness and adversarial test results
- Security assessment report
Operator obligations (Arts. 16-27)What providers, importers, distributors and deployers each must do.5 article groups · 23 obligations
- Art. 16
Providers ensure the system meets the requirements, show provider details on it, run a quality management system and keep documentation.
What you do
- Create a provider compliance checklist
- Keep contact details on product and packaging
- Art. 17
Put a documented quality management system in place covering compliance strategy, design, testing, data, risk management, post-market monitoring, incident reporting and accountability.
What you do
- Adopt an AI QMS aligned with your existing ISO-style system
- Assign roles and review cycles
- Art. 18
Keep technical documentation, QMS records and declarations at authorities' disposal for ten years after market placement.
What you do
- Set a ten-year retention rule
- Store in a controlled archive
- Art. 19
Keep automatically generated logs under your control for at least six months.
What you do
- Set log retention in line with this minimum
- Record who may access logs
- Art. 20
Take corrective action, withdraw or recall a non-conforming system and inform distributors, deployers and authorities.
What you do
- Write a recall and fix procedure
- Keep a corrective action register
- Art. 21
Cooperate with competent authorities and provide information and logs on reasoned request.
What you do
- Name a regulatory contact
- Prepare an evidence pack template
- Art. 22
Non-EU providers appoint an authorised representative in the EU before placing high-risk systems on the market.
What you do
- Sign a written mandate with an EU representative
- Share required documentation with them
Evidence to keep
- Quality management system manual
- Conformity assessment and declaration records
- Corrective action log
- Authorised representative mandate
- Art. 43
Complete the right conformity assessment procedure before placing the system on the market.
What you do
- Decide between internal control and notified body routes
- Re-assess after substantial modification
- Art. 47
Draw up an EU declaration of conformity for each high-risk system and keep it for ten years.
What you do
- Use a standard declaration template
- Keep signed copies
- Art. 48
Affix the CE marking to the system, its packaging or documentation.
What you do
- Add the marking to product and digital interfaces
- Check traceability to the declaration
- Art. 49
Register the provider and the high-risk system in the EU database before placing it on the market or putting it into service.
What you do
- Prepare registration data early
- Update entries on change
Evidence to keep
- EU declaration of conformity
- CE marking records
- EU database registration confirmation
- Art. 23
Importers verify conformity assessment, documentation, CE marking and representative before placing a system on the EU market.
What you do
- Create an import checklist
- Hold the declaration of conformity copy
- Art. 24
Distributors verify marking, documents and instructions before making a system available and stop supply if non-compliance is suspected.
What you do
- Add compliance checks to goods-in
- Keep a quarantine process
- Art. 25
Anyone who puts their name on a high-risk system, changes its purpose or makes a substantial modification becomes the provider.
What you do
- Review resale and white-label contracts
- Agree written responsibilities with upstream providers
Evidence to keep
- Importer and distributor check records
- Value chain agreements
- Records of role changes
- Art. 26(1)
Use the system in line with the provider's instructions with suitable technical and organisational measures.
What you do
- Keep the instructions for use with the operational owner
- Audit use against instructions
- Art. 26(2)
Assign human oversight to people with the necessary competence, training and authority.
What you do
- Name oversight owners
- Train and support them
- Art. 26(4)
Where you control input data, make sure it is relevant and sufficiently representative for the intended purpose.
What you do
- Check input data quality routinely
- Record data checks
- Art. 26(5)
Monitor operation, inform the provider or authorities of risks and serious incidents, and suspend use where needed.
What you do
- Add AI incident triage to your incident process
- Keep contact routes to providers
- Art. 26(6)
Keep logs under your control for at least six months, unless other law requires otherwise.
What you do
- Set retention in your AI platform
- Test log retrieval
- Art. 26(7)
Before using high-risk AI in the workplace, tell workers' representatives and affected workers.
What you do
- Include AI in staff and representative communications
- Keep the notices
- Art. 26(11)
Tell people when a high-risk system is used to make or help make decisions about them.
What you do
- Add notices to forms and decision letters
- Provide a contact route for questions
Evidence to keep
- Deployer procedure for high-risk AI
- Human oversight assignments
- Log retention records
- Worker notification records
- Art. 27
Public bodies, private entities providing public services, and deployers of certain credit and insurance systems assess fundamental rights impact before first use.
What you do
- Check whether you fall into the listed deployer types
- Use a structured template and update it on change
- Art. 27(3)
Notify the market surveillance authority of the assessment result.
What you do
- Prepare the submission pack
- Align with any data protection impact assessment
Evidence to keep
- FRIA report
- Consultation notes
- Notification to the market surveillance authority
Transparency obligations (Art. 50)Tell people when they meet AI or AI-made content.1 article group · 5 obligations
t50Transparency rules (Art. 50)Chatbots, synthetic media and emotion tools need clear disclosure.5 obligations
- Art. 50(1)
Providers design AI systems that interact with people so users are told they are dealing with AI, unless it is obvious.
What you do
- Add a clear AI notice at the start of chat or voice interactions
- Test it with real users
- Art. 50(2)
Providers of systems generating synthetic audio, image, video or text mark outputs in a machine-readable way so they can be detected as AI-generated.
What you do
- Enable watermarking or metadata marking
- Check marking survives export
- Art. 50(3)
Deployers of emotion recognition or biometric categorisation systems inform the people exposed to them.
What you do
- Display notices where such systems run
- Process data in line with data protection law
- Art. 50(4)
Deployers disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless humans have reviewed and take editorial responsibility.
What you do
- Add labelling to your content workflow
- Record editorial review for AI-assisted text
- Art. 50(5)
Give the required information clearly and at the latest at first interaction or exposure.
What you do
- Design notices to be visible and accessible
- Review them for accessibility
Evidence to keep
- Disclosure wording and UX screenshots
- Content marking configuration
- Deepfake disclosure policy
General-purpose AI models (Arts. 51-56)Extra rules for providers of foundation models.4 article groups · 13 obligations
gp1Classification as systemic risk (Arts. 51-52)Very capable models face stricter duties.2 obligations
- Art. 51
A GPAI model is treated as having systemic risk if it has high-impact capabilities, presumed above a training compute threshold set in the Act.
What you do
- Track training compute and evaluations
- Check designation notices
- Art. 52
Providers meeting the threshold notify the Commission without delay and may contest designation with reasons.
What you do
- Prepare a notification file
- Appoint a regulatory lead
Evidence to keep
- Model capability and compute assessment
- Notification to the Commission
gp2Provider duties for all GPAI models (Art. 53)Documentation, copyright and training data transparency.5 obligations
- Art. 53(1)(a)
Keep technical documentation of the model, including training and testing, and give it to the AI Office on request.
What you do
- Maintain a model documentation file
- Version it with each release
- Art. 53(1)(b)
Give downstream providers the information they need to integrate the model and meet their own duties.
What you do
- Publish integration documentation
- Include capabilities and limits
- Art. 53(1)(c)
Put in place a policy to respect EU copyright law, including rights reservations for text and data mining.
What you do
- Record how opt-outs are honoured
- Review crawler and dataset practices
- Art. 53(1)(d)
Publish a sufficiently detailed summary of the content used to train the model.
What you do
- Use the Commission template
- Update on material change
- Art. 53(2)
Open-source model providers have partial exemptions but not for systemic risk models or copyright and training summary duties.
What you do
- Check exemption conditions
- Document your reasoning
Evidence to keep
- Model documentation for AI Office and downstream providers
- Copyright compliance policy
- Public training content summary
gp3Extra duties for systemic risk models (Art. 55)Evaluation, incident reporting and cybersecurity.4 obligations
- Art. 55(1)(a)
Evaluate the model with state-of-the-art protocols, including adversarial testing, to identify and reduce systemic risk.
What you do
- Run recurring red-team exercises
- Track findings to closure
- Art. 55(1)(b)
Assess and mitigate possible systemic risks at Union level.
What you do
- Maintain a systemic risk register
- Report to senior management
- Art. 55(1)(c)
Track, document and report serious incidents and corrective measures to the AI Office and national authorities.
What you do
- Create a serious incident reporting playbook
- Rehearse it
- Art. 55(1)(d)
Ensure adequate cybersecurity protection for the model and its physical infrastructure.
What you do
- Protect model weights and training pipelines
- Test controls independently
Evidence to keep
- Model evaluation and red-team reports
- Serious incident reports
- Cybersecurity measures record
gp4Representatives and codes of practice (Arts. 54, 56)Non-EU providers need an EU representative; codes help demonstrate compliance.2 obligations
- Art. 54
Providers outside the EU appoint an EU authorised representative for GPAI models before placing them on the market.
What you do
- Sign a written mandate
- Share documentation with the representative
- Art. 56
Providers can rely on codes of practice to show compliance until a harmonised standard exists.
What you do
- Assess the published GPAI code
- Record any adherence commitment
Evidence to keep
- Authorised representative mandate
- Record of adherence to a code of practice
Governance, enforcement and penaltiesWho oversees the Act and what happens when it is breached.5 article groups · 14 obligations
- Art. 64
Follow guidance from the AI Office, which oversees GPAI models and supports consistent application.
What you do
- Monitor AI Office publications
- Map guidance to your controls
- Art. 65
Watch the work of the European AI Board, which coordinates national authorities.
What you do
- Track Board opinions
- Feed them into your compliance roadmap
- Art. 68
Expect scientific panel input on systemic risks and GPAI models.
What you do
- Follow qualified alerts
- Prepare for expert review requests
Evidence to keep
- Regulatory watch notes on AI Office and Board guidance
- Art. 70
Identify your national market surveillance and notifying authorities and their contact points.
What you do
- Map each AI use to its authority
- Hold contact details in your compliance file
Evidence to keep
- Record of which national authority supervises each of your AI systems
- Art. 72
Providers set up and document a post-market monitoring system proportionate to the risk.
What you do
- Collect performance and complaint data in production
- Review it on a schedule
- Art. 73
Providers report serious incidents to market surveillance authorities within the deadlines set out in the Act.
What you do
- Define what counts as serious and who reports
- Keep a draft report template ready
- Art. 79
Cooperate when an authority finds a system presents a risk and take required corrective measures.
What you do
- Keep an authority response procedure
- Log all corrective steps
Evidence to keep
- Post-market monitoring plan
- Serious incident reports
- Corrective action records
- Art. 85
Be ready for complaints by anyone who thinks the Act has been infringed to the market surveillance authority.
What you do
- Offer an easy contact route
- Respond promptly
- Art. 86
Give clear and meaningful explanations of the role of a high-risk AI system in decisions that significantly affect a person.
What you do
- Prepare plain explanation templates
- Train staff to deliver them
Evidence to keep
- Complaint handling procedure
- Explanation request log
- Art. 99(3)
Breaches of the prohibited practices can be fined up to 35 million euro or 7 percent of worldwide annual turnover, whichever is higher.
What you do
- Prioritise the Art. 5 screening
- Report exposure to the board
- Art. 99(4)
Breaches of most operator obligations can be fined up to 15 million euro or 3 percent of turnover.
What you do
- Track obligations by owner
- Review compliance status quarterly
- Art. 99(5)
Supplying incorrect, incomplete or misleading information to authorities can be fined up to 7.5 million euro or 1 percent of turnover.
What you do
- Quality-check regulatory responses
- Name an approver
- Art. 99(6)
For SMEs and start-ups each fine is capped at the lower of the two amounts.
What you do
- Document your SME status
- Keep evidence of headcount and turnover
- Art. 101
The Commission can fine GPAI model providers up to 3 percent of turnover or 15 million euro, whichever is higher.
What you do
- Align model governance with Art. 53 and 55
- Prepare for AI Office requests
Evidence to keep
- Board paper on AI Act exposure
- Compliance programme plan
Application datesWhen each part of the Act applies, including Digital Omnibus changes.1 article group · 8 obligations
- 1 Aug 2024
The Act entered into force.
What you do
- Record this as the start of your compliance roadmap
- Brief senior management
- 2 Feb 2025
General provisions, AI literacy and prohibited practices apply.
What you do
- Confirm prohibited-practice screening and AI literacy training are in place
- Keep evidence
- 2 Aug 2025
GPAI model rules apply, governance structures and national authority and penalty rules must be in place.
What you do
- GPAI providers complete documentation and copyright policy
- Check national authority designations
- 2 Aug 2026
Most remaining rules apply, including Art. 50 transparency and start of enforcement of GPAI, prohibitions, transparency and literacy rules.
What you do
- Finish transparency notices and content marking
- Prepare for authority enquiries
- 2 Dec 2026
New prohibitions on non-consensual sexual deepfakes and child abuse material apply, and a transition ends for certain Art. 50(2) marking duties for systems already on the market.
What you do
- Add these uses to your prohibited-practice screening
- Complete marking upgrades for legacy systems
- 2 Dec 2027
Annex III high-risk system rules apply, following the Digital Omnibus on AI amendments.
What you do
- Plan Annex III compliance work back from this date
- Do not assume further delay
- 2 Aug 2028
High-risk rules for AI embedded in Annex I regulated products apply, following the Digital Omnibus on AI amendments.
What you do
- Align with product-law conformity planning
- Track notified body availability
- 2 Aug 2027
Each Member State should have at least one operational AI regulatory sandbox.
What you do
- SMEs consider applying to a sandbox
- Monitor national sandbox calls
Evidence to keep
- Compliance roadmap with dates
- Regulatory watch log
Nothing matches. Clear the search or pick another chapter.
Outcomes and implementation examples are from Regulation (EU) 2024/1689, Artificial Intelligence Act (EUR-Lex), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
List your AI systems
Provided, deployed or both.
- 2
Classify each one
Which tier does it fall in.
- 3
Find the gaps
Compare with the duties for that tier.
- 4
Build the documentation
Risk, data, testing and oversight.
- 5
Track the dates
Obligations phase in over time.
How Optimus AI helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus AI |
|---|---|
| Banned practices | Prohibited-use screening |
| High-risk systems | Risk classification and requirements tracker |
| Transparency | Disclosure checklist |
| General-purpose AI | Model documentation records |
| Governance and oversight | Policies, logs and oversight records |
| Penalties and enforcement | Obligation calendar and owners |
Free EU AI Act readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- AI inventory template
- Risk classification worksheet
- Human oversight procedure
- Technical documentation outline
Share or cite this page
Writing about EU AI Act? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/eu-ai-act/">EU AI Act explained in plain English - Optimus CyberX</a>Common questions
Does it apply outside the EU?
Yes, where AI is placed on the EU market or its output is used in the EU.
What counts as high risk?
AI used in areas such as hiring, education, credit, essential services, law enforcement, migration and justice, as listed in Annex III of the Act, and AI that is a safety component of regulated products.
When do the rules apply?
In stages. Banned practices and AI literacy since February 2025, general-purpose AI rules since August 2025, most other rules from August 2026, Annex III high-risk rules from December 2027 and product-embedded high-risk AI from August 2028.
Is ISO 42001 enough?
No. It supports compliance but does not replace the Act.
Related frameworks
See how ready you are for EU AI Act
Answer questions across every area. We email you a report showing where you comply and where you do not.