Regulation (EU) 2024/1689 — the EU AI Act — is a product-safety style law for AI. It does not regulate “AI” as a technology; it regulates AI systems by the harm they can do, and it does that through a risk tier. A system is either prohibited (Art. 5), high-risk (Art. 6 with Annex I and Annex III), subject to transparency duties (Art. 50), or minimal-risk with no tier-specific duties at all. General-purpose AI models — the foundation models — have their own chapter (Art. 51–56).
It entered into force on 01.08.2024 and applies in stages, so “is it in force?” has a different answer for each chapter. The Digital Omnibus — Regulation (EU) 2026/1744, in force since 27.07.2026 — moved the high-risk dates and added two prohibitions; it did not move Article 50.
Four operator roles, defined in Article 3. Your role — not your industry — decides which articles you owe. Like the GDPR, the Act reaches organisations outside the EU whenever a system's output is used in the Union.
Develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark — paid or free.
Owes: The most: the Article 8–15 requirements for high-risk systems, conformity assessment, CE marking, registration, post-market monitoring, and Article 50(1)–(2) transparency.
Uses an AI system under its own authority in a professional context — the HR team running a screening tool, the bank running a credit model, the clinic running triage software.
Owes: Article 26: use the system as instructed, assign human oversight, keep logs, inform workers and affected people, run a FRIA where Article 27 applies, and disclose deepfakes under Article 50(4).
Established in the EU and places on the market a system bearing the name of a provider established outside the EU.
Owes: Article 23: verify that the provider ran the conformity assessment, drew up the documentation and appointed an authorised representative before the system is placed on the market.
Makes a system available on the EU market without being its provider or importer — resellers, marketplaces, integrators who do not rebrand.
Owes: Article 24: check the CE marking, the declaration of conformity and the instructions for use, and withhold a system that does not conform.
Not sure which you are? Provider or deployer walks the Article 25 triggers that turn one into the other, and the free check asks the role question first.
The Act applies chapter by chapter. Four milestones are behind us; the high-risk wall is ahead. Every date below is read from the regulatory registry that runs the product, not typed into this page.
| Date | What applies | Articles |
|---|---|---|
| 01.08.2024In force | The Act enters into forceRegulation (EU) 2024/1689 was published in the Official Journal and became binding law. Nothing applied yet — the dates below are when each chapter started to bite. | Art. 113 |
| 02.02.2025In force | Prohibited practices and AI literacy applyThe Article 5 bans — social scoring, emotion recognition at work and in education, untargeted facial scraping and the rest — and the Article 4 duty to make staff AI-literate. These reach every provider and deployer, whatever the risk tier. | Art. 5Art. 4 |
| 02.08.2025In force | GPAI obligations, governance and penalties applyProviders of general-purpose AI models owe documentation, copyright and training-data transparency duties; models with systemic risk owe more. The penalty regime and the national authorities came online the same day. | Art. 53Art. 55Art. 99 |
| 02.08.2026In force | Article 50 transparency duties applyChatbots must say they are AI, generated content must be marked, deepfakes must be disclosed. This date was not moved by the Digital Omnibus. | Art. 50 |
| 02.12.2026Ahead | Two new Article 5 prohibitions applyRegulation (EU) 2026/1744 adds bans on AI nudification tools and on AI-generated child sexual abuse material. | Art. 5 |
| 02.12.2027Ahead | High-risk (Annex III) obligations applyThe bulk of the Act: risk management, data governance, technical documentation, human oversight, conformity assessment, CE marking, registration and the deployer duties. Deferred from 02.08.2026 by Regulation (EU) 2026/1744, in force since 27.07.2026. | Art. 6Art. 8–15Art. 26 |
| 02.08.2028Ahead | AI in Annex I regulated products appliesHigh-risk AI that is a safety component of a product already covered by EU product law — machinery, medical devices, vehicles, toys. Deferred from 02.08.2027. | Art. 6(1) |
Systems already on the market before the high-risk date are covered by the transitional rules in Art. 111; the free tracker carries the original and Omnibus dates side by side.
Two routes into the tier, one filter out of it. Annex III names eight areas of use; Article 6(1) adds AI that is a safety component of a product already regulated under Annex I; Article 6(3) lets a provider document that an Annex III system does not pose a significant risk — unless it profiles people.
Deeper: the Annex III areas and the Article 6(3) exception in the help centre.
A first orientation in under a minute. Answer for one system at a time; the result names the tier and the articles that follow from it.
Social scoring, untargeted facial-image scraping, emotion recognition at work or in education, real-time remote biometric identification in public spaces for law enforcement (outside the narrow exceptions), and — from the Digital Omnibus — AI nudification and AI-generated child sexual abuse material.
The same high-risk system produces two different obligation lists depending on which side of it you sit. In the rules Veritome ships, a deployer of one high-risk system carries 12 obligations and a provider carries 23, out of 69 EU AI Act requirements the engine models.
| Obligation | Provider | Deployer | Importer | Distributor |
|---|---|---|---|---|
| Art. 9Risk management system | ● | — | — | — |
| Art. 10Data and data governance | ● | — | — | — |
| Art. 11Technical documentation (Annex IV) | ● | — | — | — |
| Art. 12Record-keeping and automatic logging | ● | ● | — | — |
| Art. 13Transparency and instructions for deployers | ● | — | — | — |
| Art. 14Human oversight | ● | ● | — | — |
| Art. 15Accuracy, robustness and cybersecurity | ● | — | — | — |
| Art. 17Quality management system | ● | — | — | — |
| Art. 23–24Verify the provider's conformity before supply | — | — | ● | ● |
| Art. 26Deployer duties: use as instructed, oversight, logs, worker notice | — | ● | — | — |
| Art. 27Fundamental rights impact assessment (FRIA) | — | ● | — | — |
| Art. 43Conformity assessment and CE marking | ● | — | — | — |
| Art. 49Registration in the EU database | ● | ● | — | — |
| Art. 50Transparency to people (chatbots, generated content, deepfakes) | ● | ● | — | — |
| Art. 72–73Post-market monitoring and serious-incident reporting | ● | ● | — | — |
Importers and distributors owe the verification duties in Art. 23 and Art. 24, and any of the four becomes the provider under Art. 25 by rebranding a high-risk system, changing its intended purpose, or substantially modifying it.
Article 50 applies on top of the risk tier, based on how the AI touches people. It has been in force since 02.08.2026 and was not deferred by the Digital Omnibus.
Article 99 sets three bands. The higher of the amount or the percentage applies; for SMEs and start-ups, the lower. National market-surveillance authorities enforce the Act for AI systems; the Commission's AI Office enforces it for general-purpose AI models.
| Infringement | Maximum fine |
|---|---|
| Prohibited practices (Art. 5) | €35m or 7% of worldwide annual turnover |
| Most other obligations (e.g. high-risk duties) | €15m or 3% of worldwide annual turnover |
| Incorrect/incomplete/misleading info to authorities | €7.5m or 1% of worldwide annual turnover |
The fine is the ceiling, not the tariff: authorities weigh the nature and duration of the breach, whether it was intentional, and what the operator did about it (Art. 99(7)). Details in penalties and enforcement.
The order the work has to happen in — the same six gated phases the product runs. You cannot register what you have not assessed, or assess what you have not classified.
The two regimes apply at the same time. A high-risk system that processes personal data owes both an Annex IV technical file and, usually, a DPIA — and the Act itself sends deployers to the GDPR in Article 26(9).
Where they overlap the work is shared, not doubled: the Article 27 fundamental rights impact assessment and the GDPR Article 35 DPIA answer overlapping questions, the Article 13 information a provider hands over feeds the deployer's DPIA, and Article 22 (solely automated decisions) sits next to the Article 26(11) duty to inform affected people. How Veritome models the five frameworks as one register shows which records count twice.