What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive legal framework for regulating artificial intelligence. Adopted in 2024, it is the world's first binding regulation specifically governing AI systems. The Act classifies AI systems into four risk categories and imposes specific obligations on both AI providers (those who develop AI) and deployers (those who use AI in their operations).
The Four Risk Levels
The EU AI Act classifies AI systems into four risk categories. Unacceptable Risk: AI systems that are banned outright, including social scoring, real-time biometric surveillance in public spaces (with exceptions), and manipulative AI. High-Risk: AI used in critical areas like employment, education, credit scoring, law enforcement, and essential services — these require conformity assessments, human oversight, and extensive documentation. Limited Risk: AI with transparency obligations, such as chatbots that must disclose they are AI. Minimal Risk: Most AI systems, which can operate freely with voluntary codes of conduct.
Deployer Obligations (Article 26)
Most companies using AI are deployers, not providers. The EU AI Act requires deployers to: ensure human oversight for high-risk AI (Article 14), provide AI literacy training for staff (Article 4), conduct Fundamental Rights Impact Assessments for certain high-risk uses (Article 27), monitor AI systems during operation (Article 26(5)), report serious incidents (Article 73), retain logs (Article 26(6)), disclose AI use to affected individuals (Article 50), and ensure data inputs are relevant (Article 26(4)).
Penalties and Enforcement
The EU AI Act imposes significant penalties for non-compliance. Violations involving prohibited AI practices can result in fines up to EUR 35 million or 7% of global annual turnover, whichever is higher. Violations of other obligations carry fines up to EUR 15 million or 3% of turnover. Supplying incorrect information to authorities can result in fines up to EUR 7.5 million or 1.5% of turnover. Enforcement is handled by national market surveillance authorities in each EU Member State.
Compliance Timeline
The EU AI Act entered into force on 1 August 2024, with requirements phasing in over time. Prohibited AI practices: enforced from February 2025. AI literacy and general-purpose AI obligations: August 2025. Transparency obligations (Article 50): December 2026. High-risk AI system requirements under Annex III: December 2027 — postponed from the original August 2026 date by the EU Digital Omnibus deal of May 2026. Annex I product-embedded high-risk systems (medical devices, toys, machinery, lifts): August 2028. Companies should start preparing now, as compliance requires significant organisational changes.
Related Feature: EU AI Act Compliance
Fronterio provides built-in tooling for this.