EU AI Act obligations phase in through 2028
The EU AI Act entered into force in August 2024, establishing a phased enforcement timeline through 2028. It defines provider and deployer roles.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024. Its obligations phase in through 2028, defining legal roles and risk-based rules for artificial intelligence.
It categorizes AI systems into four risk tiers: prohibited practices, high-risk, limited risk, and minimal risk. The Act assigns obligations by role. A provider develops an AI system or places it on the market under its own name. A deployer uses an AI system under its authority in a professional context. Organizations also become providers if they white-label or substantially modify an AI system or repurpose it into a high-risk use case. Standard software practices like fine-tuning open-source models or embedding AI in a SaaS platform can legally make a company a provider.
Enforcement timeline for obligations across risk categories
The world's first horizontal AI law has a staggered enforcement schedule. Prohibitions on certain AI practices and AI literacy requirements have been enforceable since February 2025. Obligations for providers of general-purpose AI models applied from August 2025. The Article 50 transparency requirements became legally enforceable on August 2, 2026.
The July 2026 Digital Omnibus on AI deferred several key obligations for high-risk systems beyond their original deadlines. This Omnibus is in force since July 27, 2026. The underlying obligations of the EU AI Act have not changed despite these deferrals.
The heaviest obligations for high-risk AI systems will apply from December 2, 2027, for the use cases listed in Annex III. They will apply from August 2, 2028, for AI embedded in products regulated under Annex I.
Specific duties for providers and deployers by risk level
Prohibited practices include manipulative techniques, social scoring, and emotion recognition in workplaces and schools. The list also includes untargeted scraping of facial images and most real-time remote biometric identification in public spaces for law enforcement. The Omnibus added AI that generates non-consensual intimate imagery or child sexual abuse material to prohibited practices.
High-risk AI systems face the strictest compliance, design, and monitoring obligations. They are classified into two main groups: Annex I for product safety like medical devices, and Annex III for sensitive use cases like biometrics, employment, and law enforcement.
Limited risk systems are subject to mandatory transparency obligations. Chatbots must disclose they are AI. Synthetic audio, image, video, and text must be machine-readably marked. Deepfakes and certain AI-generated public-interest text must be labeled.
Minimal risk AI, like spam filters or inventory forecasting, has no specific obligations beyond AI literacy for staff.
General Purpose AI models are regulated through a separate two-tiered framework. All GPAI model providers must meet baseline obligations: technical documentation, information for downstream providers, a copyright policy, and a public summary of training content. Models with systemic risk face additional duties like model evaluations and serious-incident reporting. Systemic risk is presumed where training compute exceeds 10²⁵ floating-point operations.
Deployers have duties including ensuring AI literacy and transparency. For high-risk systems, they must also ensure human oversight, monitoring, log retention, and worker information. In some cases, a fundamental rights impact assessment is required. Art. 26(2) requires deployers to give high-risk oversight to people with necessary competence, training and authority.
Most corporate organizations are deployers for most systems. They become providers when they build their own AI systems, including for internal use. Providers bear most of the Act’s regulatory weight.
Penalties and extraterritorial reach
Non-compliance triggers severe financial penalties. The structure is as follows:
| Violation Category | Maximum Fine |
|---|---|
| Prohibited practices | €35 million or 7% of worldwide annual turnover |
| Most other breaches (high-risk, transparency) | €15 million or 3% of worldwide annual turnover |
| Supplying incorrect information to authorities | €7.5 million or 1% of worldwide annual turnover |
The EU AI Act applies extraterritorially wherever AI is placed on the EU market or its output is used in the EU. Ingo Bednarz noted, "The EU AI Act is the world’s first horizontal AI law, and it already applies in part."
The heaviest obligations for high-risk AI systems will apply from December 2, 2027, for use cases in Annex III and from August 2, 2028, for AI embedded in products under Annex I.
