Regulation (EU) 2024/1689, the EU AI Act, is a product-safety style law. It targets AI systems, not AI as a technology, and sorts them by the harm they can do:
In force since 01.08.2024, it applies in stages, so “is it in force?” has a different answer per chapter. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27.07.2026) moved the high-risk dates and added two prohibitions. Article 50 stayed put.
Article 3 names six operator roles, and yours decides which articles you owe. Like the GDPR, the Act reaches beyond the EU whenever a system's output is used in the Union.
Develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free.
Owes: The most: Articles 8 to 15 for high-risk systems, conformity assessment, CE marking, registration, post-market monitoring, and Article 50(1) and (2).
Uses an AI system under its own authority at work: an HR screening tool, a bank's credit model, a clinic's triage software.
Owes: Article 26: use as instructed, assign human oversight, keep logs, inform workers and affected people. A FRIA where Article 27 applies; Article 50(4) deepfake disclosure.
Established in the EU and places on the market a system bearing the name of a provider established outside the EU.
Owes: Article 23: before placing it on the market, verify the provider's conformity assessment, documentation and authorised representative.
Makes a system available on the EU market without being its provider or importer: resellers, marketplaces, integrators who do not rebrand.
Owes: Article 24: check the CE marking, declaration of conformity and instructions for use; withhold a system that does not conform.
Not sure which you are? Provider or deployer walks the Article 25 triggers; the free check asks the role question first.
The Act applies chapter by chapter: four milestones have passed, the high-risk obligations are ahead. Every date comes from the regulatory registry the product runs on.
| Date | What applies | Articles |
|---|---|---|
| 01.08.2024In force | The Act enters into forceRegulation (EU) 2024/1689 became binding law on publication in the Official Journal. Nothing applied yet: each chapter applies from the dates below. | Art. 113 |
| 02.02.2025In force | Prohibited practices and AI literacy applyThe bans (social scoring, emotion recognition at work and in education, untargeted facial scraping and the rest) and the duty to make staff AI-literate, for every provider and deployer, whatever the tier. | Art. 5Art. 4 |
| 02.08.2025In force | GPAI obligations, governance and penalties applyGPAI model providers owe documentation, copyright and training-data transparency; models with systemic risk owe more. Penalties and national authorities started the same day. | Art. 53Art. 55Art. 99 |
| 02.08.2026In force | Article 50 transparency duties applyChatbots say they are AI, generated content is marked, deepfakes are disclosed. The Digital Omnibus did not move this date. | Art. 50 |
| 02.12.2026Ahead | Two new Article 5 prohibitions applyRegulation (EU) 2026/1744 adds bans on AI nudification tools and on AI-generated child sexual abuse material. | Art. 5 |
| 02.12.2027Ahead | High-risk (Annex III) obligations applyThe bulk of the Act: risk management, data governance, technical documentation, human oversight, conformity assessment, CE marking, registration and the deployer duties. Deferred from 02.08.2026 by Regulation (EU) 2026/1744, in force since 27.07.2026. | Art. 6Art. 8–15Art. 26 |
| 02.08.2028Ahead | AI in Annex I regulated products appliesHigh-risk AI that is a safety component of a product under EU product law, such as machinery, medical devices, vehicles and toys. Deferred from 02.08.2027. | Art. 6(1) |
Systems on the market before the high-risk date fall under the transitional rules in Art. 111. The free tracker shows original and Omnibus dates side by side.
Two routes into the tier, one filter out: Annex III's eight areas of use, safety components of Annex I products, and the Article 6(3) filter, which profiling overrides.
Deeper in the help centre: the Annex III areas and the Article 6(3) exception.
A first orientation in under a minute, one system at a time. The result names the tier and the articles that follow.
Social scoring, untargeted facial-image scraping, emotion recognition at work or in education, real-time remote biometric identification in public spaces for law enforcement (outside the narrow exceptions), plus the two bans the Digital Omnibus added: AI nudification and AI-generated child sexual abuse material.
One high-risk system, two obligation lists. In the rules Veritome ships, its deployer carries 13 obligations and its provider 25, out of 87 EU AI Act requirements the engine models.
| Obligation | Provider | Deployer | Importer | Distributor |
|---|---|---|---|---|
| Art. 9Risk management system | ● | ○ | ○ | ○ |
| Art. 10Data and data governance | ● | ○ | ○ | ○ |
| Art. 11Technical documentation (Annex IV) | ● | ○ | ○ | ○ |
| Art. 12Record-keeping and automatic logging | ● | ● | ○ | ○ |
| Art. 13Transparency and instructions for deployers | ● | ○ | ○ | ○ |
| Art. 14Human oversight | ● | ● | ○ | ○ |
| Art. 15Accuracy, robustness and cybersecurity | ● | ○ | ○ | ○ |
| Art. 17Quality management system | ● | ○ | ○ | ○ |
| Art. 23–24Verify the provider's conformity before supply | ○ | ○ | ● | ● |
| Art. 26Deployer duties: use as instructed, oversight, logs, worker notice | ○ | ● | ○ | ○ |
| Art. 27Fundamental rights impact assessment (FRIA) | ○ | ● | ○ | ○ |
| Art. 43Conformity assessment and CE marking | ● | ○ | ○ | ○ |
| Art. 49Registration in the EU database | ● | ● | ○ | ○ |
| Art. 50Transparency to people (chatbots, generated content, deepfakes) | ● | ● | ○ | ○ |
| Art. 72–73Post-market monitoring and serious-incident reporting | ● | ● | ○ | ○ |
Importers and distributors owe the verification duties in Art. 23 and Art. 24. Any of the four becomes the provider under Art. 25 by rebranding a high-risk system, changing its intended purpose or substantially modifying it.
On top of the risk tier, based on how the AI touches people. Applies since 02.08.2026; the Digital Omnibus did not defer it.
Article 99 sets three bands: the higher of amount or percentage applies, the lower for SMEs and start-ups. National market-surveillance authorities enforce for AI systems; the Commission's AI Office for GPAI models.
| Infringement | Maximum fine |
|---|---|
| Prohibited practices (Art. 5) | €35m or 7% of worldwide annual turnover |
| Most other obligations (e.g. high-risk duties) | €15m or 3% of worldwide annual turnover |
| Incorrect/incomplete/misleading info to authorities | €7.5m or 1% of worldwide annual turnover |
These are maximums. Authorities weigh the nature and duration of the breach, intent, and what the operator did about it (Art. 99(7)). More in penalties and enforcement.
The work runs in this order, as do the product's six gated phases. You cannot register what you have not assessed, or assess what you have not classified.
Both apply at once. A high-risk system processing personal data owes an Annex IV file and, usually, a DPIA; Article 26(9) sends deployers to the GDPR.
Where they overlap, one piece of work can serve both:
How Veritome models the five frameworks as one register shows which records are credited in more than one.