The EU AI Act deadline
didn't move for you.

The EU AI Act (Regulation EU 2024/1689) is the world's first comprehensive legal framework governing artificial intelligence. It entered into force on 1 August 2024 and applies to any organisation that develops, deploys, or imports AI systems in the EU, or whose AI output affects EU-based individuals, regardless of where the organisation is headquartered.

Enforcement is phased. Article 5 prohibitions and Article 4 AI literacy obligations became applicable on 2 February 2025; GPAI obligations (Arts. 51–56) on 2 August 2025. Under the Digital Omnibus (adopted by Parliament 16 June 2026, Council adoption 29 June 2026), Annex III high-risk obligations move from 2 August 2026 to 2 December 2027; Article 50(2) watermarking shifts to 2 December 2026; a new Article 5 prohibition on AI generating CSAM/NCII applies from 2 December 2026. However, Article 50 transparency obligations (most), Article 49 EU database registration, and national market surveillance authority enforcement powers still apply from 2 August 2026 as enacted.

Penalties are tiered based on the nature of the violation. The maximum fine for prohibited practices under Article 5 is €35 million or 7% of global annual worldwide turnover, whichever is higher. For high-risk AI non-compliance: up to €15 million or 3%. For incorrect, incomplete or misleading information supplied to authorities under Article 99(5): up to €7.5 million or 1%. Article 50 transparency obligations fall under Article 99(4) at €15 million or 3%.

The "whichever is higher" mechanism means large global enterprises face substantially greater exposure than the fixed euro amounts suggest.

Yes. The Act has explicit extra-territorial scope, applying to providers established outside the EU if their AI systems are placed on the EU market or their output affects EU-based individuals. This mirrors the GDPR model and means US, UK, Asian, and other non-EU companies must comply if they serve EU users or operate AI systems that affect EU persons.

Annex III lists 8 domains where AI systems are automatically classified as high-risk: biometric identification and categorisation; AI for critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services; law enforcement; migration and border management; and administration of justice.

High-risk classification triggers a full compliance burden including a risk management system (Art. 9), technical documentation (Annex IV), data governance, human oversight, and registration in the EU AI database.

General-Purpose AI (GPAI) refers to AI models with broad applicability, typically large language models and foundation models. Articles 51–56 impose obligations on GPAI providers including technical documentation, transparency information for downstream providers, copyright compliance policies, and summaries of training data. These obligations became active on 2 August 2025.

Models trained on compute exceeding 10²⁵ FLOPs are classified as GPAI with systemic risk and face additional obligations including adversarial testing, cybersecurity measures, and incident reporting to the European AI Office.

The EU AI Act and GDPR operate in parallel and frequently intersect. Many high-risk AI systems process personal data, requiring simultaneous compliance with both regimes. The FRIA (Fundamental Rights Impact Assessment) required under Article 27 of the AI Act complements the DPIA (Data Protection Impact Assessment) under GDPR Article 35. Supervisory authorities from both frameworks may have overlapping jurisdiction. Read our detailed comparison guide for a full analysis.