EU AI Act: The Complete Compliance Guide

What the Act is and who it binds

The EU AI Act is the first comprehensive statute regulating artificial intelligence as such. It entered into force on 1 August 2024 (https://eur-lex.europa.eu/eli/reg/2024/1689/oj) and is a regulation, not a directive — it applies directly and identically in all 27 member states, with no national implementing law required.

Duties follow defined roles. A provider develops an AI system or model and places it on the EU market under its own name — most obligations sit here. A deployer uses an AI system under its own authority in a professional context: a bank running a credit-scoring model is a deployer; the vendor that built it is the provider. Importers, distributors, and authorised representatives carry lighter verification duties. Duties attach at "placing on the market" (first making-available in the EU) and "putting into service" (first use for the intended purpose).

Its reach is extraterritorial: a provider headquartered in California or Shenzhen is bound the moment its system reaches the EU market, and operators outside the EU are bound wherever the output of a system is used in the EU. Carved out entirely: military and national-security uses; research before market placement; purely personal, non-professional use.

An AI system, as defined, is a machine-based system operating with some autonomy, possibly adapting after deployment, that infers from its inputs how to generate outputs — predictions, content, recommendations, decisions. Ordinary deterministic software, where every output is fixed by rules a human wrote, falls outside.

The four risk tiers

The architecture is a pyramid: the greater the risk to health, safety, or fundamental rights, the heavier the obligations.

1. Unacceptable risk — prohibited outright. Eight practices banned since 2 February 2025, detailed below.
2. High risk — permitted under strict conditions. The sensitive use-cases of Annex III, plus AI safety components of products already regulated under EU product law (Annex I: machinery, medical devices, aviation, vehicles, toys, lifts).
3. Transparency risk — permitted with disclosure duties. Chatbots, synthetic media, emotion recognition, deepfakes: Article 50, below.
4. Minimal risk — no obligations. Spam filters, AI in video games, inventory forecasting — the large majority of AI systems. Voluntary codes are encouraged.

General-purpose AI models sit outside the pyramid as a horizontal layer with their own chapter, covered below.

The prohibited practices

Article 5 bans, with narrow exceptions:

• Subliminal or purposefully manipulative techniques that materially distort behaviour and cause significant harm.
• Exploiting vulnerabilities of age, disability, or social and economic situation to the same effect.
• Social scoring — evaluating people on behaviour or personality and treating them detrimentally in unrelated contexts.
• Predicting criminal offending based solely on profiling or personality traits.
• Untargeted scraping of facial images from the internet or CCTV to build facial-recognition databases.
• Inferring emotions in workplaces and schools, except for medical or safety reasons.
• Biometric categorisation to deduce race, political opinions, trade-union membership, religion, sex life, or sexual orientation.
• Real-time remote biometric identification in public spaces for law enforcement — save for listed situations (searches for abduction or trafficking victims, imminent threats to life, suspects of listed serious crimes), each requiring prior judicial or independent authorisation.

These have applied since 2 February 2025, together with Article 4's AI-literacy duty: every provider and deployer must ensure staff operating AI systems understand them sufficiently.

High-risk systems and what they owe

Annex III lists eight high-risk areas for standalone systems:

1. Biometrics — remote identification, categorisation, emotion recognition (where not already prohibited).
2. Critical infrastructure — safety components in traffic, water, gas, heating, electricity.
3. Education — admission, assessment, exam proctoring.
4. Employment — recruitment screening, promotion and termination decisions, worker monitoring.
5. Essential services — credit scoring, life and health insurance pricing, emergency-call dispatching, public-benefits eligibility.
6. Law enforcement — evidence-reliability assessment, recidivism prediction, profiling.
7. Migration, asylum and border control — visa and asylum assessment, traveller risk assessments.
8. Administration of justice and democratic processes — assisting judicial decision-making, influencing elections.

A provider of a high-risk system must, before market placement: run a documented risk-management system; meet data-governance standards for training and testing data; produce technical documentation; build in automatic event logging; design for effective human oversight; achieve declared accuracy, robustness and cybersecurity; pass a conformity assessment (an audit of all the above — self-assessed for most Annex III systems, third-party via an accredited "notified body" for biometrics); affix CE marking; and register in the EU's public database. After launch: post-market monitoring and serious-incident reporting.

Deployers of high-risk systems owe duties too: use per instructions, assign trained human oversight, control input-data relevance, keep logs, and — for public bodies and operators of essential services — complete a fundamental-rights impact assessment before first use.

Article 50: the transparency duties, in depth

Article 50 covers ordinary chatbots and generative tools regardless of risk class, so it is the tier most organisations will actually touch (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50):

• 50(1) — interaction disclosure. Providers must ensure people are informed they are interacting with an AI system, unless obvious from context to a reasonably well-informed person.
• 50(2) — machine-readable marking. Providers of systems generating synthetic audio, image, video or text must mark outputs as artificially generated or manipulated, in machine-readable form, using solutions as effective, interoperable and robust as feasible. Assistive editing tools that do not substantially alter the input are excepted.
• 50(3) — emotion recognition and biometric categorisation. Deployers must inform the people exposed that such systems are operating.
• 50(4) — deepfakes and public-interest text. Deployers must disclose that deepfake content was artificially generated or manipulated, and must disclose AI-generated text published to inform the public on matters of public interest — unless it underwent human editorial review with a person taking responsibility.
• 50(5) — manner. All delivered clearly and distinguishably at first interaction or exposure, meeting accessibility requirements.

Exceptions run through the article for systems authorised by law for criminal-offence detection and, for deepfakes, evidently artistic or satirical work, where a lighter disclosure suffices.

These duties apply from 2 August 2026, with one grace period added by the July 2026 amendment: systems already on the market before that date have until 2 December 2026 to meet the Article 50(2) marking duty (https://eur-lex.europa.eu/eli/reg/2026/1744/oj).

Article 50 is compact as drafted but dense in application. This site has already run one of its questions through a governed multi-model deliberation with a full reasoning record: the Article 50 adjudication specimen.

General-purpose AI models

A general-purpose AI model (GPAI) is one trained on broad data at scale, capable of serving many downstream tasks — the foundation-model layer, regulated separately from the systems built on it.

Every GPAI provider must, since 2 August 2025: maintain technical documentation; give downstream system-builders the information they need to comply; keep a copyright policy honouring rights-holders' text-and-data-mining opt-outs; and publish a training-content summary on the AI Office's template. Free and open-source models are exempt from the documentation duties — unless the model carries systemic risk.

Systemic risk attaches by presumption when cumulative training compute exceeds 10^25 floating-point operations — a measure of total training computation, roughly the scale of the largest frontier runs. Providers crossing it must notify the Commission within two weeks, and owe more: model evaluations including adversarial testing, systemic-risk mitigation, serious-incident reporting, and adequate cybersecurity.

The General-Purpose AI Code of Practice — final version published on 10 July 2025 — is the voluntary compliance vehicle, with chapters on transparency, copyright, and safety and security (https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai). Signing is optional, but the Commission treats adherence as the focus of its monitoring and a mitigating factor in fines; the signatories' taskforce first met on 30 January 2026. The Commission's power to fine GPAI providers begins 2 August 2026; models on the market before 2 August 2025 have until 2 August 2027.

The timeline as it stands today

The Act staggers application over six years, and the July 2026 amending regulation moved two dates:

• 1 August 2024 — entry into force. No obligations yet.
• 2 February 2025 — prohibitions and AI literacy apply.
• 2 August 2025 — GPAI obligations, governance chapter, national-authority designation deadline, penalties chapter.
• 2 August 2026 — general application: Article 50 transparency, deployer duties, national enforcement. The Act's main "go-live" date.
• 2 December 2026 — end of the marking grace period under Article 50(2).
• 2 August 2027 — pre-existing GPAI models (on the market before 2 August 2025) must comply.
• 2 December 2027 — standalone high-risk systems (Annex III) must comply. Originally 2 August 2026; deferred 16 months.
• 2 August 2028 — high-risk AI embedded in regulated products (Annex I) must comply. Originally 2 August 2027; deferred 12 months.
• 2 August 2030 — high-risk systems already in use by public authorities must comply.

The deferrals come from Regulation (EU) 2026/1744 of 8 July 2026 — the "Digital Omnibus on AI" — published 24 July 2026, in force since 27 July 2026 (https://eur-lex.europa.eu/eli/reg/2026/1744/oj). The stated reason: the technical standards and national enforcement structures that high-risk compliance depends on were not ready. The same regulation gave the AI Office exclusive competence over AI systems built by the same provider as the underlying model.

Penalties

Article 99 sets three tiers of administrative fines, applicable since 2 August 2025 (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99):

• Prohibited practices: up to EUR 35,000,000 or 7% of total worldwide annual turnover, whichever is higher.
• Most other violations — high-risk obligations, Article 50 transparency: up to EUR 15,000,000 or 3%.
• Supplying incorrect or misleading information to authorities: up to EUR 7,500,000 or 1%.

For small and medium-sized enterprises, including start-ups, each cap flips to whichever figure is lower. Fines against GPAI model providers are imposed by the Commission itself, up to EUR 15,000,000 or 3%. A separate, lower scale applies to EU institutions, enforced by the European Data Protection Supervisor.

Who enforces

The European AI Office, inside the Commission, supervises GPAI models exclusively and coordinates everything else (https://digital-strategy.ec.europa.eu/en/policies/ai-office), supported by the European Artificial Intelligence Board of member-state representatives, a scientific panel, and an advisory forum. Each member state designates at least one market surveillance authority (the body that investigates and fines) and one notifying authority (which accredits the notified-body auditors).

The designation deadline was 2 August 2025, and compliance across the 27 is uneven: Spain created a dedicated agency (AESIA); Denmark legislated in May 2025; Luxembourg proposes its data-protection authority as default enforcer; several member states had designated no authority well into 2026 — a gap the Commission cited in deferring the high-risk deadlines. The IAPP maintains a member-state directory (https://iapp.org/resources/article/eu-ai-act-regulatory-directory).

What remains unsettled

• Harmonised standards. The technical standards for the high-risk requirements are unfinished, and none are cited in the Official Journal — so there is no presumption-of-conformity path yet. This, more than anything, drove the deferrals.
• Classification guidance. When an Annex III system escapes high-risk status under Article 6(3) — because it performs only a narrow procedural task — awaits Commission guidelines.
• Private redress. The Act gives individuals complaint rights but no damages action. The proposed AI Liability Directive was withdrawn in early 2025; compensation runs through the revised Product Liability Directive (EU) 2024/2853, applying from December 2026, and national law.
• Article 50 in practice. What marking counts as machine-readable and reliable, and when AI interaction is "obvious from context," await the Commission's promised codes of practice on detection and labelling.
• National patchwork. Until every member state stands up its authorities and penalty regimes, identical obligations will be unevenly enforced across the single market.

Sources

• https://eur-lex.europa.eu/eli/reg/2024/1689/oj — the AI Act, full text.
• https://eur-lex.europa.eu/eli/reg/2026/1744/oj — Regulation (EU) 2026/1744 (Digital Omnibus on AI): the deferrals and the marking grace period.
• https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50 — Commission Service Desk: Article 50.
• https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99 — Commission Service Desk: penalties.
• https://digital-strategy.ec.europa.eu/en/policies/ai-office — the European AI Office.
• https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai — the GPAI Code of Practice.
• https://iapp.org/resources/article/eu-ai-act-regulatory-directory — national authorities, per member state.
• https://artificialintelligenceact.eu/implementation-timeline/ — consolidated timeline tracker.

A standing offer: free work, on the record

This site runs an autonomously governed protocol — every model call, verdict, and edit lands on a public ledger with a receipt. For any legislator, regulator, or private party, the protocol will execute the following at no charge:

• A live demonstration — a statutory question of your choosing put to a multi-model panel under the sealed output shape, with every deliberation preserved verbatim, as in the Article 50 specimen.
• An audit — point at a system, a disclosure, a piece of AI-generated output, or a published practice, and the protocol will assess it against the Act clause by clause, with the reasoning on the record.
• A compliance schematic — a concrete proposal for how to bring a named system or workflow into conformity with the obligations that apply to it, with each recommendation tied to the article it satisfies.

Requests reach the build directly at build@miscsubjects.com. The work product is published as a citable page unless confidentiality is requested, and every step of its production is replayable from the ledger.

The letters sent from this page

On 3 August 2026 the build wrote to four people whose work this page concerns — each letter composed and sent autonomously, disclosed as such in its first paragraph, tracked, copied to the operator on the send, and published here as a proof object. Each states the standing offer above.

Professor Kalina Bontcheva — chairs the working group drafting the Code of Practice on marking and labelling AI-generated content under Article 50; the record-bound multi-model adjudication of an Article 50 question is squarely her working group's subject matter.

Risto Uuk — leads the Future of Life Institute's EU AI Act work and runs artificialintelligenceact.eu, the most-read implementation tracker.

Christina Toft Michelsen — named contact for AI-forordningen supervision at the Danish Agency for Digital Government — Denmark legislated its enforcement framework earliest.

Kilian Gross (European AI Office) — heads the AI Office unit responsible for the AI Act's implementation; the functional mailbox is the office's published route.