EU AI Act explained: risk levels, deadlines and fines

The EU AI Act is a European Union regulation that sorts AI systems by the risk they pose and sets rules to match. It entered into force on 1 August 2024 and phases in over several years. The bans, the AI literacy duty and the rules for general-purpose AI (GPAI) models already apply. Rules for high-risk systems were pushed back to December 2027 and August 2028 by an amendment known as the Digital Omnibus, adopted in 2026.

This guide reflects the position as of October 2026. A few details of the revised timeline are still being clarified. Before making compliance decisions, check the text published in the Official Journal and the European Commission's own AI Act pages.

What is the EU AI Act?

The AI Act is a regulation rather than a directive. That means it applies directly in every member state, and national governments do not need to write it into their own law. Its official reference is Regulation (EU) 2024/1689, and it was published in July 2024. The European Parliament's research service noted that it was designed to take at least three years to apply in full.

It is widely described as the first comprehensive, horizontal legal framework for AI, meaning it cuts across sectors instead of targeting one industry. AI systems are regulated by risk, while general-purpose models are regulated by their capabilities. Guidelines, harmonised standards and voluntary codes of practice supply the technical detail.

What are the AI Act risk categories?

The Act's text sets out four risk levels for AI systems, plus a separate track for general-purpose models. The summary below follows the Act's structure. The exact boundaries are defined in Article 5, Article 6, Annexes I and III, and Article 50.

Unacceptable risk (banned): This covers social scoring and AI that manipulates people or exploits their vulnerabilities. Untargeted scraping of facial images is banned, and so is emotion recognition at work and in schools, with exceptions. Certain biometric categorisation, predictive policing based solely on profiling, and real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions) are also prohibited.

High risk: There are two types. Annex I covers AI that acts as a safety component in products already governed by EU product law, such as machinery, medical devices or toys. Annex III covers stand-alone systems used in sensitive areas. These include biometrics, critical infrastructure, education, employment, essential services and credit, law enforcement, migration and border control, and justice and democratic processes.

Providers of high-risk systems must put in place risk management, data governance and technical documentation. They also need logging, human oversight, and adequate accuracy and robustness. On top of that come a conformity assessment, CE marking and registration in an EU database.

Limited risk (transparency, Article 50): People must be told when they are interacting with a chatbot, and deepfakes must be labelled. AI-generated content must also carry a machine-readable mark. Minimal risk: Everyday tools such as spam filters or video games face no new obligations.

General-purpose AI models: Every GPAI provider must keep documentation and have a copyright policy. Models considered to carry "systemic risk" face extra duties. The Act presumes systemic risk above a training-compute threshold of 10^25 FLOPs.

When does the EU AI Act apply? The current timeline

Under the original schedule, prohibitions and AI literacy obligations took effect on 2 February 2025. GPAI rules, governance provisions and penalties followed on 2 August 2025. Most remaining provisions, including Annex III high-risk rules, were due on 2 August 2026. Annex I high-risk rules were set for 2 August 2027.

That plan changed. On 19 November 2025 the Commission proposed the "Digital Omnibus on AI", partly in response to concerns about regulatory complexity raised in the 2024 Draghi report. Parliament and Council reached a provisional deal on 7 May 2026. Parliament gave final approval on 16 June and the Council adopted the text on 29 June. It was signed on 8 July and entered into force on publication in the Official Journal on 27 July 2026.

Under the revised dates, Annex III stand-alone high-risk rules now apply from 2 December 2027. Annex I rules for AI embedded in regulated products now start in August 2028. According to Formalize's analysis, the general prohibitions and the GPAI rules were not postponed.

Some points remain open. These include the exact post-Omnibus date for the Article 50 transparency and watermarking duties, whether new prohibitions were added, and the precise scope of relief for smaller firms. Harmonised standards have also reportedly been running late. Check these against the official text.

Who does the AI Act apply to?

According to the Act's scope article, it covers providers that place AI systems on the EU market, wherever they are based. It also covers deployers (organisations using AI) located in the EU, as well as importers, distributors and product manufacturers. Providers and deployers outside the EU are caught as well when their system's output is used inside the EU.

That extraterritorial reach works much like GDPR. A company in Türkiye, the US or elsewhere that sells AI into the EU, or whose AI outputs are used there, can fall within scope. Non-EU providers of high-risk systems and GPAI models must appoint an authorised representative in the EU.

Some uses are excluded: military, defence and national security; AI used solely for scientific research; and purely personal, non-professional use. Most free and open-source software is also out of scope, with some exceptions.

What are the fines under the EU AI Act?

Article 99 sets three tiers of fines. Breaching the prohibitions can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most other operator obligations carry up to €15 million or 3%. Giving incorrect or misleading information to authorities can lead to fines of up to €7.5 million or 1%.

For SMEs and startups, the lower of the two figures applies (Article 99(6)). The Omnibus reportedly extends this treatment to "small mid-caps". Member states set the detailed national penalty rules, and Article 99 has applied since 2 August 2025. GPAI providers can be fined by the Commission, up to €15 million or 3%.

Penalty tiers linked to postponed obligations only bite once those obligations apply. Some older articles still say high-risk penalties start on 2 August 2026. That is no longer accurate.

What should organisations do now?

The delay is not a reason to stop preparing, because the bans, AI literacy and GPAI rules are already live. A practical first step is to inventory the AI systems you build, buy or sell, and map each one to a risk tier.

For high-risk providers, building documentation, data governance and human-oversight processes takes time, so December 2027 is closer than it looks. For authoritative detail, rely on EUR-Lex, the Commission's AI Act pages and the AI Office rather than secondary summaries.