Why this matters.
Regulation (EU) 2024/1689 — the EU AI Act — entered into force on 1 August 2024 and applies progressively. Prohibited AI practices were banned from 2 February 2025. Obligations for high-risk AI systems and General-Purpose AI (GPAI) models began applying from August 2025 and August 2026 respectively. The Act applies to providers placing AI systems on the EU market, deployers using AI systems within the EU, and entities whose AI output is used in the EU — regardless of where the provider is based. Penalties for the most serious violations (prohibited practices) reach €35 million or 7% of global annual turnover.
Even organisations that don’t build AI must comply if they deploy AI systems provided by others — for example, using an AI tool for CV screening, credit scoring, medical diagnosis, or biometric identification triggers deployer obligations. The Act’s risk-based framework means most AI tools fall into ‘minimal risk’ with only transparency obligations, but high-risk systems in regulated domains (employment, credit, education, law enforcement, critical infrastructure) face extensive conformity assessment, logging, and human oversight requirements before deployment.