AI Governance EU AI ACT Guide
The EU AI Act reaches full enforcement in
The world's first binding AI law. Prohibited practices under Article 5 have been enforceable since February 2, 2025. GPAI obligations began August 2, 2025. On August 2, 2026, Annex III high-risk duties and Article 50 transparency rules go live for every provider and deployer whose output reaches the EU. Non-EU organizations are in scope too.
Does the Act apply to you?
Scope isn't geographical. It's functional. Article 2 reaches any organization whose AI system is placed on the EU market, put into service in the EU, or whose output is used in the EU, regardless of where the provider is established. Start by identifying your legal role. Obligations flow from role, not job title.
Or have one developed with a view to placing it on the EU market or putting it into service under your name or trademark. Paid or free, the duty set is the same.
Heaviest duty set · Arts. 16, 9–15, 17, 43Under your authority, other than for personal non-professional use. Most enterprises are deployers for most tools they adopt.
Operational duties · Arts. 26, 27You verify the provider completed conformity assessment, CE-marked the system, and appointed an EU representative before you place it on the market.
Gatekeeper duties · Art. 23In the supply chain, other than as provider or importer. Before distributing, verify CE mark, documentation, and provider/importer identity.
Chain-of-custody duties · Art. 24Four tiers. One framework.
Every AI system in EU scope is sorted by the harm it could cause, not by the technology it uses. The tier decides whether the system is banned outright, must pass a formal conformity assessment, must disclose itself to users, or carries no new duties at all. Select a tier to see the concrete rules, examples, and enforcement exposure.
Annex I: safety components of regulated products. AI that acts as a safety component of, or is itself, a product covered by EU harmonisation legislation already requiring third-party conformity assessment (medical devices, machinery, toys, vehicles, aviation, rail). Becomes enforceable Aug 2, 2027.
Annex III: eight standalone use-case categories. Systems placed on the EU market for the following purposes are high-risk regardless of the product they sit in: (1) biometrics, (2) critical infrastructure, (3) education and vocational training, (4) employment, worker management and access to self-employment, (5) access to essential private and public services and benefits, (6) law enforcement, (7) migration, asylum and border control, (8) administration of justice and democratic processes. Annex III high-risk duties apply from Aug 2, 2026.
The eight prohibited practices.
Article 5(1) lists eight AI uses that are banned outright across the EU since February 2, 2025. Breaching any of them carries the highest penalty band: €35M or 7% of worldwide annual turnover, whichever is higher. Each is paraphrased below alongside its paragraph reference.
AI deployed with the objective, or effect, of materially distorting a person's behaviour by using techniques beyond their consciousness, in a way that causes or is likely to cause significant harm.
Example: dark-pattern nudging that coerces a vulnerable user into a loan.AI that exploits vulnerabilities due to age, disability, or a specific social or economic situation, with the objective or effect of materially distorting behaviour and causing significant harm.
Example: gamified apps targeting children with addictive reward loops.Classifying natural persons over time based on their social behaviour or personality traits, where the score leads to detrimental treatment in contexts unrelated to the data's origin, or that is unjustified or disproportionate.
Example: denying welfare eligibility based on unrelated social-media scoring.AI that assesses or predicts a natural person's risk of committing a criminal offence based solely on profiling or personality traits. Allowed only if supporting a human assessment already grounded in objective, verifiable facts.
Example: algorithmic pre-crime scores with no human-led investigative basis.Creating or expanding facial-recognition databases through untargeted scraping of images from the internet or CCTV footage.
Example: Clearview-style bulk ingestion of public photos into an identity database.Inferring emotions of a natural person in the areas of workplace and education, except for medical or safety reasons.
Example: camera system scoring call-centre agent "engagement" in real time.Categorising persons individually based on biometric data to deduce race, political opinions, trade-union membership, religious beliefs, sex life or sexual orientation.
Example: face-analysis tool that infers political leaning for ad targeting.Prohibited by default. Narrow exceptions exist for targeted search of missing persons, prevention of a genuine and imminent threat, or localisation of suspects of a closed list of serious crimes. Each requires prior judicial or independent authorisation (Art. 5(3)) plus a fundamental-rights impact assessment (Art. 27).
Even when permitted, two-person verification is required under Art. 14(5).Who owns what.
The Act defines four legal actors (provider, deployer, importer, distributor per Art. 3). Inside most organisations those obligations fan out across ten operational roles: engineering, product, ML, legal, risk/GRC, procurement, MLOps, data protection, the business owner who deploys the system, and internal audit. Pick your role to see which articles land on your desk.
FRIA. The deployer-side duty most teams underestimate.
Article 27 is unusual. It applies to the deployer of a high-risk system, not the provider. Before first use, specific deployer categories must assess the impact on fundamental rights. When GDPR is also engaged, the FRIA supplements (not replaces) a Data Protection Impact Assessment.
The FRIA duty is not for every deployer of every high-risk system. It applies to three categories:
- Bodies governed by public law: national, regional or local authorities.
- Private operators providing public services: schools, hospitals, housing, social security, welfare and similar services.
- Deployers of two Annex III categories regardless of status: creditworthiness and credit scoring (Annex III 5(b)) and risk assessment / pricing in life and health insurance (Annex III 5(c)).
- (a) a description of the deployer's processes where the system will be used;
- (b) the period of time and frequency of intended use;
- (c) the categories of natural persons and groups likely to be affected;
- (d) the specific risks of harm likely to impact those categories, taking into account provider information;
- (e) the measures for human oversight under the instructions for use;
- (f) measures to be taken if those risks materialise, including arrangements for internal governance and complaint-handling.
What people can demand from you.
Compliance isn't just paperwork between you and a regulator. The Act creates individual rights. Natural persons affected by a high-risk system can lodge complaints and obtain explanations, and workers who raise compliance concerns are protected.
Any natural or legal person with grounds to consider the Act has been infringed may file a complaint with the relevant national authority, which has a duty to investigate as part of its monitoring role.
Practical impact: treat inbound complaints like a GDPR DSR. Triage, investigate, respond.Any affected person subject to a decision taken by the deployer on the basis of a high-risk Annex III system's output that produces legal effects, or similarly significantly affects them, has the right to obtain clear and meaningful explanations of the role of the AI system in the decision procedure and the main elements of the decision.
Practical impact: your deployer UX needs a plain-language "why this decision?" surface.Workers who report suspected AI Act infringements benefit from the protections of the Whistleblower Directive (retaliation-free reporting channels and remedies), as extended by Art. 87 of the AI Act.
Practical impact: your internal AI-ethics hotline must meet the Directive's standard.Fit the Act into the frameworks you already run.
🔍 Explore EU AI Act Requirements Interactively
Navigate all 125 EU AI Act articles with cross-framework alignments to ISO 42001, NIST AI RMF, ISO 27001, OWASP, and MITRE ATLAS — with risk profiles and implementation guidance.
Launch Framework Explorer →- GOVERN: organisational policy, accountability, culture. Anchors Arts. 17 (quality management), 26 (deployer policies) and 4 (AI literacy).
- MAP: context, purpose, impacts. Anchors Arts. 9(2) (risk identification), 6 & Annex III (use-case classification) and 27 (FRIA).
- MEASURE: testing, evaluation, metrics. Anchors Arts. 9(5–7), 15 (accuracy, robustness, cybersecurity) and 55 (GPAI evaluations).
- MANAGE: prioritisation, response, continuous improvement. Anchors Arts. 9(3) (risk treatment), 72 (post-market monitoring), 73 (serious-incident reporting) and 20 (corrective actions).
- AIMS scope & Clause 5 leadership: directly operationalises Art. 17 (QMS) and Art. 26 deployer governance duties.
- Clause 6.1 risk and opportunity: the structural home for the Art. 9 risk management system across the lifecycle.
- Annex B objectives / Annex C controls: data quality, documentation, transparency and human-oversight controls that satisfy Arts. 10, 11, 13 and 14.
- Clauses 9 & 10 performance and improvement: the continuous-monitoring engine that feeds Art. 72 post-market monitoring and Art. 73 incident reporting.
- Art. 5 prohibited-practice screening in your intake process;
- Art. 6 + Annex III use-case classification gate;
- Art. 22 authorised representative (for non-EU providers);
- Art. 27 FRIA with the six required elements and authority notification;
- Art. 43 conformity-assessment route selection (Annex VI internal-control vs. Annex VII notified-body);
- Art. 47 EU declaration of conformity kept for ten years;
- Art. 49 EU-database registration of high-risk systems;
- Art. 86 right-to-explanation surface in the deployer UX.
What non-compliance costs.
Penalties scale by the class of breach, not by your size or sector. Fines are decided per incident by national authorities (by the AI Office for GPAI), using a published list of mitigating and aggravating factors. For SMEs the rule flips: the lower of the two amounts applies, not the higher.
Whichever amount is higher applies. SMEs: the lower applies (Art. 99(6)).
- (a) nature, gravity and duration of the infringement and of its consequences;
- (b) whether other authorities have already imposed penalties for the same infringement;
- (c) size, annual turnover and market share of the operator;
- (d) any financial benefit gained, or loss avoided, through the infringement;
- (e) degree of cooperation with the competent authority to remedy the infringement and mitigate effects;
- (f) degree of responsibility taking into account technical and organisational measures;
- (g) manner in which the authority became aware, in particular whether the operator self-notified.
General-purpose AI has its own chapter.
Chapter V (Arts. 51–56) governs GPAI models. These are systems trained on large amounts of data using self-supervision at scale and displaying significant generality. Every GPAI model carries a baseline of documentation and copyright duties. Models that cross the systemic-risk threshold pick up an evaluation, mitigation and incident-reporting overlay. They're also supervised centrally by the AI Office rather than by Member-State authorities.
Applies to every GPAI model placed on the EU market, regardless of compute.
- Technical documentation for the AI Office and downstream providers
- Instructions for integration into downstream systems
- Copyright policy compliant with Directive (EU) 2019/790
- Public summary of training data content
Triggered when cumulative training compute exceeds the threshold or the AI Office designates the model.
- Model evaluations including adversarial testing
- Systemic risk assessment and mitigation
- Incident reporting to the AI Office
- Adequate cybersecurity protection
Annex XI: model technical documentation. Kept by the provider and made available to the AI Office on request. Covers the model's intended tasks and acceptable-use policy, architecture, number of parameters, input/output modalities, licence, training methodology and data, compute used, energy consumption, and known limitations.
Annex XII: downstream-provider documentation. Shared with providers who integrate the GPAI into their own AI systems. A tighter packet focused on capabilities, limitations, integration instructions, and the technical means for downstream conformity. Required even for models whose Annex XI is shielded from publication.
What's live. What's coming.
Article 113 staggers application over three years so different parts of the Act take effect at different times. "In force" (Aug 1, 2024) means the text is law. "In application" means the articles are enforceable. Two duties (the Art. 5 prohibitions and the Art. 4 AI-literacy obligation) have been enforceable since February 2, 2025.
The Act is published in the Official Journal. Staggered application begins under Article 113.
The eight banned practices, from subliminal manipulation to workplace emotion recognition, become enforceable across the EU. National authorities can impose up to €35M or 7% of worldwide annual turnover under Art. 99(3).
Providers and deployers must ensure their staff and anyone operating AI on their behalf have a sufficient level of AI literacy. Training is calibrated to technical knowledge, context of use and the persons affected. Applies to every risk tier.
Article 56 set this as the target for codes of practice to be ready. Until harmonised standards exist, adherence to an approved code is the operational route to demonstrating compliance with Arts. 53 and 55 for GPAI providers.
Articles 53–55 take effect for GPAI models placed on the market after this date. The AI Office, AI Board, Advisory Forum and Scientific Panel become operational under Arts. 64–68, along with penalty provisions.
European Parliament committees vote on the simplification package. Outcome informs trilogue scope.
March 2026 digest →Interinstitutional negotiations on omnibus simplification amendments begin.
Full provider obligations (Arts. 9–15, 17, 43) and deployer obligations (Arts. 26, 27) for Annex III systems take effect. Article 50 transparency duties for chatbots, deepfakes and AI-generated media go live. Each Member State must have at least one operational regulatory sandbox (Art. 57).
High-risk obligations extend to AI that is a safety component of, or is itself, a regulated product under existing EU harmonisation legislation (medical devices, machinery, toys, vehicles, rail, aviation). These producers already run third-party conformity assessment. The Act overlays on top.
GPAI models placed on the market before Aug 2, 2025 must reach full conformity by this date. The "grandfather" window for pre-existing frontier models closes.
Regulatory intelligence, live.
Monthly enforcement updates, commission guidance, and compliance news drawn from verified sources across the EU AI Office, European Parliament, and Council. Updated automatically as new developments publish.
Council agrees AI Act amendments. Parliament approves CoE Framework Convention. New prohibited practices proposed in the omnibus package. Read the March digest →
Signatories commit to evaluation protocols, training-data summaries, and copyright policy. Baseline expectations now public.
European CommissionIMCO/LIBE voted March 18. Council negotiating mandate adopted. First interinstitutional meeting set for May.
European ParliamentSector-specific examples for employment, biometrics, and essential services clarify scope ahead of the August deadline.
AI OfficeFrom scope check to compliance plan.
The hub is a briefing, not a substitute for legal advice. Its job is to get you from "never read the Act" to "know which five articles we need help with" in an hour. Your scope and tier selections above already filtered the obligations, fines and timeline. These resources carry that context into execution.
Article-by-article kit mapped to provider and deployer duties. Downloadable DOCX + PDF.
→ Download73+ article-referenced templates covering risk classification, technical documentation, and conformity assessment.
→ Get templatesBuild and maintain your AI risk register with ISO 42001 and NIST AI RMF mappings. 5x5 scoring matrix included.
→ Get templateChief AI Officer, AI Risk Manager, AI Auditor. Job families that own the obligations above.
→ View rolesDaily briefs across regulation, industry, and research pillars. The upstream source for this hub's news feed.
→ Read briefsMonthly roundups with downloadable Beginner, Practitioner, and Advanced compliance guides.
→ Browse archiveHow this hub is built and kept honest.
Every factual claim on this page is written against the four primary-source documents below and cross-checked to three internal reference guides. The hub is updated from those sources on a rolling basis. News cards and deadline rails refresh automatically as new developments are verified.
Primary text is Regulation (EU) 2024/1689 as published in the Official Journal of the European Union. Article numbering, penalty bands, and application dates all resolve to the consolidated EUR-Lex text. Interpretive points rely on official Commission / AI Office guidance, the artificialintelligenceact.eu tracker, and the TJS in-house Beginner, Practitioner and Advanced guides. No claims on this page were generated from model training data alone. Each section cites the article(s) and guide section(s) it's built from.
News cards and deadline tickers are published into marker regions by automated pipelines (sync-euai-news.py, sync-euai-timeline.py, gen-digest.py). Those regions are the only non-editorial surfaces on the page.
Consolidated, authoritative text of the AI Act in 24 EU languages.
eur-lex.europa.euCentral enforcer for GPAI; publishes codes of practice, templates, and FAQs.
digital-strategy.ec.europa.eu/en/policies/ai-officeArticle-by-article explorer with recital cross-references and comparison tools.
artificialintelligenceact.euCommission-run implementation support for providers, deployers and SMEs.
digital-strategy.ec.europa.eu/en/policies/ai-act-service-deskVoluntary framework used in this hub's §04 crosswalk (GOVERN / MAP / MEASURE / MANAGE).
nist.gov/itl/ai-risk-management-frameworkCertifiable AIMS used as the ISO crosswalk basis. Buy through ISO or a national body.
iso.org/standard/81230.htmlBuy Us a Coffee
We publish hundreds of free guides, templates, and intelligence briefs. If this resource saved you time or helped your career, consider buying us a coffee.
Support Tech Jacks on Ko-fi
Every coffee helps us create more free resources for the community.