EU AI Act

It applies primarily to providers that develop or place AI systems on the EU market and to deployers that use them in a professional context, as well as importers and distributors. Its reach is extraterritorial: providers and deployers outside the EU are covered when the output of their AI system is used within the EU. This means many non-EU technology and enterprise organizations fall in scope even without an EU establishment.

The regulation uses a risk-based approach with four levels. Unacceptable-risk practices are prohibited, high-risk systems face the most detailed obligations, limited-risk systems carry transparency duties, and minimal-risk systems are largely unregulated. General-purpose AI (GPAI) models are addressed under a separate dedicated set of rules.

High-risk covers AI used as a safety component of regulated products, plus systems listed in Annex III for areas such as biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and the administration of justice. These systems must meet requirements for risk management, data governance, documentation, logging, human oversight, and accuracy and robustness. They also require conformity assessment and CE marking before market placement.

Users must be told when they are interacting with an AI system, such as a chatbot, unless it is obvious from context. AI-generated or manipulated audio, image, video, or text content, including deepfakes, must be clearly labelled as artificially generated. These duties aim to prevent deception while imposing lighter obligations than the high-risk regime.

Providers of GPAI models must maintain technical documentation, provide information to downstream developers, comply with EU copyright law, and publish a summary of the content used for training. Models presenting systemic risk face additional duties such as model evaluation, adversarial testing, incident tracking, and cybersecurity measures. GPAI obligations began to apply from August 2025.

Prohibited practices have applied since February 2025, and GPAI obligations from August 2025. Most high-risk obligations apply from August 2026, with a later date of August 2027 for certain high-risk systems tied to regulated products. Organizations should map each system to the phase-in date that governs it.

Fines are tiered by severity. Breaches of the prohibited-practices rules can reach up to €35 million or 7% of global annual turnover, whichever is higher. Other infringements and the supply of incorrect information carry lower ceilings, and national authorities enforce these penalties across the EU.

The two frameworks are complementary and apply in parallel rather than replacing one another. The EU AI Act governs how AI systems are designed, tested, and deployed, while the GDPR continues to govern the processing of personal data those systems rely on. Where AI processes personal data you must satisfy both, coordinating documentation, risk assessments, and data-governance controls.