EU AI Act Explained: Summary, Timeline & Who It Applies To

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's law for artificial intelligence. It entered into force on 1 August 2024 and applies in phases until 2028. It sorts AI systems by risk, bans a short list of practices outright, sets strict rules for high-risk systems and transparency duties for chatbots and generated content, and reaches any company whose AI is used in the EU.

Key takeaways

• The Act is already partly in force: the bans on prohibited practices and the AI literacy duty have applied since 2 February 2025, and the rules for general-purpose AI models since 2 August 2025.
• The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) moved the high-risk deadlines to 2 December 2027 (Annex III use cases) and 2 August 2028 (AI in regulated products). It did not delay the transparency rules in Article 50, which apply from 2 August 2026.
• Your obligations depend on two things: the risk tier of each AI system and your role (provider, deployer, importer or distributor).
• Location does not protect you. UK, US and Asian companies are in scope when their AI is placed on the EU market or its output is used in the EU.
• Fines reach €35 million or 7% of worldwide annual turnover for prohibited practices.

What is the EU AI Act?

The EU AI Act is a horizontal regulation: it applies across sectors, directly in all 27 member states, without national transposition. Rather than regulating "AI" as one thing, it takes a risk-based approach: the more an AI system can harm health, safety or fundamental rights, the more its provider and deployer must do. The European Commission's AI Office supervises general-purpose AI models, and national market surveillance authorities enforce the rest.

If you only need the practical answer to "what must we do, and by when?", start with a free EU AI Act readiness assessment: about forty minutes of questions on how your organisation uses AI, and four governance documents written from your answers the moment you submit.

The four risk tiers

Where a system sits determines what you must do. The tiers are explained in detail in EU AI Act risk classification explained.

Most business AI, from a Microsoft Copilot rollout to a marketing content tool, lands in the minimal or limited tier. The compliance weight concentrates in high-risk systems, and misclassifying one is among the most expensive mistakes you can make.

Who does it apply to?

The Act assigns duties by role. Providers develop an AI system, or have one developed, and place it on the market under their own name. Deployers use an AI system under their authority in a professional context, which is the position of most companies buying AI tools. Importers, distributors and product manufacturers have their own, lighter duties. A deployer can become a provider, for example by putting its own name on a system or changing its intended purpose. The differences are set out in provider vs deployer obligations.

The Act also has extraterritorial reach. It applies to providers placing AI on the EU market wherever they are established, and to providers and deployers outside the EU when the output of their AI is used in the EU. What that means for British, American and Indian companies is covered in does the EU AI Act apply to non-EU companies?

The timeline: what applies, and when

The full date-by-date view, including transition periods, is in our EU AI Act timeline. The milestones that matter most, as of October 2026:

The December 2027 and August 2028 dates come from the Digital Omnibus on AI, published in the Official Journal on 24 July 2026. It is adopted law, not a proposal, but it only moved some deadlines. Anything you already use that falls under Articles 4, 5 or 50 needs to be in order now.

Obligations by topic

Each of these guides answers one question in depth:

• High-risk AI systems: how Article 6 and Annex III classify a system, and what providers and deployers must do.
• Fundamental rights impact assessment (FRIA): who must carry one out under Article 27 and what it contains.
• General-purpose AI models: the obligations on model providers, the Code of Practice, and what changes for companies that only use ChatGPT, Claude or Gemini.
• Transparency under Article 50: chatbots, deepfakes and machine-readable marking.
• AI literacy under Article 4: the duty as amended in 2026, and how to evidence it.
• The EU AI Act and GDPR: where the two laws overlap and how to run one governance process for both.
• Penalties and fines: the three fine tiers, the SME rule and who enforces.

Penalties for non-compliance

Fines are set as the higher of a fixed amount or a share of worldwide annual turnover; for SMEs and start-ups the lower of the two applies.

How the EU AI Act relates to GDPR and ISO/IEC 42001

GDPR governs personal data; the AI Act governs AI systems. An AI system that processes personal data must satisfy both, and the cheapest route is usually to extend the governance you already have for GDPR, such as records of processing and DPIAs, rather than building a parallel process. ISO/IEC 42001, the international standard for AI management systems, is voluntary, but it gives that governance a recognisable structure. How the standard maps to the law is covered in ISO 42001 vs the EU AI Act.

A practical path to compliance

1. Build an AI inventory. You cannot classify what you have not found, including the AI built into tools you already pay for. See how to build an AI inventory.
2. Classify each system and your role. Prohibited, high-risk, transparency or minimal; provider or deployer.
3. Run a gap analysis against the obligations that apply, ordered by deadline. Our EU AI Act gap analysis guide walks through it step by step, and the EU AI Act compliance checklist lists every item to tick off.
4. Put the core documents in place: an AI acceptable use policy, an AI risk assessment per system, an AI vendor due diligence checklist and an overarching governance framework.
5. Train people and keep evidence. AI literacy, human oversight assignments and logs are what an authority will ask to see.

How Opsio helps

Opsio is a Swedish cloud and AI company that builds, runs and secures AI environments for organisations in Europe and Asia. The quickest way to see where you stand is our free AI governance and EU AI Act assessment. It scores ten governance areas on a five-level maturity scale and writes four editable Word documents from your answers: an AI Governance Framework, an AI Acceptable Use Policy, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template. If you then want help putting them into practice, our AI governance consulting team takes it from there.

Frequently asked questions

Has the EU AI Act been passed?

Yes. Regulation (EU) 2024/1689 was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. Its obligations apply in stages: prohibitions and AI literacy from February 2025, general-purpose AI rules from August 2025, transparency from August 2026, and high-risk rules from December 2027 and August 2028 after the 2026 Digital Omnibus amendments.

Was the EU AI Act delayed?

Partly. The Digital Omnibus on AI, in force since 27 July 2026, moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products. The bans, AI literacy, general-purpose AI rules and Article 50 transparency duties were not delayed.

Will the EU AI Act apply to the UK?

The Act is not UK law, but it applies to UK companies whose AI systems are placed on the EU market or whose AI output is used in the EU. A UK firm selling an AI-enabled product to EU customers, or screening EU job applicants with AI, is in scope in the same way as an EU company.

What is banned under the EU AI Act?

Article 5 bans AI that manipulates people or exploits their vulnerabilities, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition in workplaces and schools, biometric categorisation by sensitive traits, and most real-time remote biometric identification in public by police. Bans on AI for non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.

What is the maximum penalty under the AI Act?

Up to €35 million or 7% of total worldwide annual turnover, whichever is higher, for using prohibited practices. Most other breaches carry up to €15 million or 3%, and misleading information to authorities up to €7.5 million or 1%. For SMEs and start-ups, the lower amount applies.

Where do we start?

Find out which AI you use and who owns it, then check each system against the obligations that already apply. A structured assessment, such as Opsio's free one, does both in one sitting and leaves you with the policies the Act expects you to have.

Find your gaps in about forty minutes

Answer questions on how your organisation uses AI, and get four EU AI Act governance documents written from your answers, plus a maturity score across ten areas. It's free and the documents are yours. Start the free EU AI Act assessment.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Related reading: What Is the EU AI Act.