The EU AI Act is the European Union's risk-based law for artificial intelligence. It applies to developers and deployers of AI systems, with the strictest rules for high-risk uses and outright bans on some practices. It entered into force on 1 August 2024, and its obligations phase in over several years. This is an explainer, not legal advice.
What does the Act cover?
The European Commission describes it as the first comprehensive legal framework on AI worldwide. Rules depend on the use of the AI, in four tiers.
- Unacceptable risk. Banned. The Commission says the Act prohibits nine practices, including social scoring, untargeted scraping of facial images and emotion recognition in workplaces and schools.
- High risk. Uses that could seriously affect health, safety or fundamental rights, such as recruitment tools, credit scoring and critical infrastructure.
- Transparency risk. Disclosure duties, such as telling people they are talking to a chatbot and labelling deepfakes.
- Minimal risk. No specific rules. This covers most AI in use today, such as spam filters.
Providers of general-purpose AI models face separate duties on transparency and copyright, and models with systemic risk must also assess and mitigate it. The Commission published scope guidelines, a voluntary Code of Practice and a training data summary template in July 2025.
Who needs to comply?
Developers (providers) and deployers. If you build an AI system and put it on the EU market, you are a provider. If you use one in your business, you are a deployer, and some duties fall on you, such as human oversight and giving clear information. A company outside the EU can be in scope if its system is used in the EU, so check how your product reaches customers.
What are the dates?
The Commission's page lists these dates. It also describes an "AI Omnibus" simplification package that it says entered into force on 27 July 2026, so confirm the current text before you plan.
| What | Date on the Commission page |
|---|---|
| Entry into force | 1 August 2024 |
| Prohibitions 1 to 8 and AI literacy | 2 February 2025 |
| Governance rules and general-purpose model duties | 2 August 2025 |
| General application, with exceptions | 2 August 2026 |
| Ninth prohibition (non-consensual intimate content and child abuse material) | December 2026 |
| High-risk systems in Annex III areas | 2 December 2027 |
| High-risk systems embedded in regulated products (Annex I) | 2 August 2028 |
What do high-risk obligations include?
The Commission lists risk assessment and mitigation, high-quality datasets, activity logging for traceability, detailed documentation for authorities, clear information for deployers, human oversight, and technical resilience, cybersecurity and accuracy. Article 12 requires high-risk systems to allow automatic recording of events over their lifetime, so logging is a design requirement, not an afterthought.
The page does not list fine amounts, so we do not either. Look up the penalty provisions in the Act itself.
How does this touch security teams?
Logging, cybersecurity and documentation duties land on engineering. A software inventory of AI components, with models, datasets and dependencies, helps answer regulator and customer questions. Safeguard's compliance automation maps controls to frameworks, but it does not certify anyone against the Act. Use the mapping view below to see how it works.
Open the full version at /demos/framework-mapping.
What to do
- List every AI system you build, buy or embed, with its purpose.
- Place each in a risk tier, with a note on why.
- Check for banned practices first, since those dates have passed.
- For high-risk systems, plan logging, documentation and human oversight now.
- Record who is provider and who is deployer in each contract.
- Re-read the Commission's page every quarter for date changes.
Quick check
Does the AI Act apply to a company outside the EU?
It can, if the AI system is placed on the EU market or its output is used in the EU. Check your own case with counsel.
Is there a certification that proves compliance?
The sources we read describe obligations, not a single certificate. Ask counsel what proof applies to your tier.
Sources
Last reviewed: 18 October 2026.
