EU AI Act Compliance Guide: Requirements, Timeline and Checklist

Last updated: 22 October 2026

Quick answer: EU AI Act compliance means working out which of your AI systems fall into each risk category, confirming whether you act as provider, deployer, importer or distributor, and meeting the obligations that follow. Prohibited practices and AI literacy have applied since 2 February 2025 and general-purpose AI (GPAI) rules since 2 August 2025. Most remaining obligations, including those for Annex III high-risk systems, apply from 2 August 2026, and high-risk AI in Annex I regulated products follows on 2 August 2027.

Like the GDPR, the AI Act reaches organisations outside the EU and is enforced through national authorities, with fines linked to worldwide turnover.

For most organisations the work is about knowing which AI systems they already use, from HR screening tools to chatbots, and showing that each is classified, documented, overseen and monitored.

This guide explains the risk categories and roles, the timeline, high-risk obligations, penalties, the GDPR overlap, national supervision and how the NIST AI RMF and ISO/IEC 42001 fit in, and ends with a checklist.

What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689, which sets harmonised rules for placing on the market, putting into service and using AI systems in the EU. It was proposed by the Commission in April 2021, politically agreed by the Council and Parliament in December 2023, published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024.

As a regulation it applies directly in every Member State, though national law designates authorities and sets penalty procedures.

Who does the AI Act apply to?

Under Article 2, it applies to providers placing AI systems or GPAI models on the EU market wherever they are established, to deployers in the EU, to non-EU providers and deployers whose AI output is used in the EU, and to importers, distributors and authorised representatives.

Exclusions cover AI used exclusively for military, defence or national security, AI developed and used solely for scientific research, and purely personal use. Free and open-source systems are partly exempt, but not if they are prohibited, high-risk or subject to transparency rules.

What are the EU AI Act risk categories?

The Act sorts AI systems into four levels of risk, with GPAI models regulated separately.

Prohibited AI practices

Article 5 bans harmful manipulative or deceptive techniques; exploiting vulnerabilities linked to age, disability or social or economic situation; social scoring; predicting criminal offending based solely on profiling; untargeted scraping of facial images; emotion recognition at work or in education (except for medical or safety reasons); biometric categorisation to infer sensitive characteristics; and real-time remote biometric identification in public spaces for law enforcement, save in narrow cases.

High-risk AI systems

There are two routes into the high-risk category:

• Annex I: AI that is a safety component of, or is itself, a product covered by the EU product safety laws listed in Annex I (such as machinery, toys, medical devices and lifts) and that must undergo third-party conformity assessment under those laws.
• Annex III: AI used in eight areas: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential private and public services (including credit scoring and risk assessment and pricing for life and health insurance); law enforcement; migration, asylum and border control; and the administration of justice and democratic processes.

Article 6(3) lets a provider conclude that an Annex III system is not high-risk if it does not pose a significant risk of harm, for example because it performs a narrow procedural task or only improves the result of a completed human activity. The provider must document that assessment and register the system. An Annex III system that profiles individuals is always high-risk.

General-purpose AI models

Providers of GPAI models must prepare technical documentation, give information to downstream providers who build on the model, put in place a copyright policy and publish a summary of training content. Models with systemic risk, presumed where training compute exceeds 10²⁵ floating-point operations, carry extra duties: model evaluations including adversarial testing, systemic risk assessment and mitigation, serious incident reporting and cybersecurity protection. The Commission’s AI Office supervises GPAI models, and the July 2025 GPAI Code of Practice offers one way to show compliance.

Are you a provider, deployer, importer or distributor?

Your obligations depend on your role for each AI system, and one organisation can hold different roles for different systems.

• Provider: develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. Providers carry most high-risk obligations.
• Deployer: uses an AI system under its authority in a professional capacity. Most organisations buying AI tools are deployers.
• Importer: established in the EU and places on the market a system from a non-EU provider, after checking its conformity assessment, documentation and CE marking.
• Distributor: makes an AI system available in the supply chain without being the provider or importer, and must check CE marking and documentation.

Common mistake: assuming you can never become a provider by buying a tool. Under Article 25, a deployer, importer or distributor is treated as the provider of a high-risk system if it puts its own name or trademark on it, makes a substantial modification, or changes the intended purpose of a system so that it becomes high-risk, for example by using a general chatbot to screen job applicants.

What is the EU AI Act timeline?

The Act applies in stages from its entry into force on 1 August 2024.

What is the Digital Omnibus proposal?

In November 2025 the Commission proposed a “Digital Omnibus” package with targeted AI Act amendments. Among other changes, it would link the start of high-risk obligations to the availability of harmonised standards and support tools, with later backstop dates. It must be agreed by the Parliament and the Council before it changes anything.

In practice: until an amendment is adopted and published in the Official Journal, plan against the dates in Regulation 2024/1689. The prohibitions, AI literacy and GPAI rules apply regardless.

What are the requirements for high-risk AI systems?

Providers of high-risk systems must meet the requirements in Articles 9 to 15 and the provider duties in Articles 16 to 21, and deployers have their own list in Article 26.

Provider obligations

Deployer obligations

Under Article 26, deployers of high-risk systems must:

• use the system in line with the provider’s instructions for use;
• assign human oversight to people with the necessary competence, training and authority;
• ensure input data under their control is relevant and sufficiently representative;
• monitor operation and report risks or serious incidents;
• keep automatically generated logs for at least six months, unless other law requires otherwise;
• inform workers’ representatives and affected workers before using a high-risk system at work;
• inform people when a high-risk system makes, or assists in making, decisions about them.

Fundamental rights impact assessment (FRIA)

Article 27 requires a FRIA before first use by deployers that are bodies governed by public law, private entities providing public services, and deployers of Annex III systems for credit scoring or for risk assessment and pricing in life and health insurance. It covers how and how often the system is used, who is affected, the specific risks of harm, oversight measures and remedies. Results are notified to the market surveillance authority.

What are the penalties for non-compliance?

Article 99 sets maximum fines, with the higher of the fixed amount or the turnover percentage applying to most companies.

For SMEs and start-ups, the lower amount applies. The Commission can fine GPAI model providers up to €15 million or 3% under Article 101.

How does the AI Act overlap with GDPR?

Where an AI system processes personal data, the GDPR applies in full alongside the AI Act, and much of the evidence you need can be shared between the two.

• DPIA and FRIA: a DPIA under Article 35 GDPR focuses on risks to individuals from processing personal data. A FRIA looks more widely at fundamental rights such as non-discrimination. Article 27(4) of the AI Act says a FRIA complements an existing DPIA, so you can build one on the other. Our guide to when and how to carry out a DPIA covers the GDPR side.
• Automated decisions: Article 22 GDPR sits alongside AI Act human oversight and the Article 86 right to explanation.
• Data governance: AI Act data quality and bias testing still need a lawful basis under GDPR; Article 10(5) allows limited use of special category data to correct bias, with strict safeguards.
• Records: your record of processing activities shows which AI systems use personal data.

For financial entities and essential services, the AI Act also overlaps with DORA and NIS2 on ICT risk, incident reporting and third-party oversight. Our article on the overlap between DORA, NIS2 and the EU AI Act looks at how to align them.

Who enforces the AI Act in each Member State?

Each Member State must designate at least one notifying authority and one market surveillance authority, and a single point of contact. Check national law in each country where you operate. Common features include:

• For AI used by financial institutions, the financial supervisor generally acts as market surveillance authority.
• For certain high-risk uses, including biometrics in law enforcement, migration and justice contexts, data protection authorities play a role as market surveillance authorities.
• Data protection authorities remain competent for the GDPR aspects of every AI system that processes personal data.
• At EU level, the AI Office supervises GPAI models and the European Artificial Intelligence Board coordinates national authorities.

Belgium, France and Cyprus

In Belgium, France and Cyprus the same EU timeline and risk categories apply. What varies is which national body supervises which type of AI system and the state of national designation and penalty laws. In each, the data protection authority (Belgium’s APD-GBA, France’s CNIL and the Cyprus Commissioner for Personal Data Protection) still supervises personal data processing by AI, so GDPR evidence remains central.

For related national context, see our articles on the Belgian DPA’s 2026–2028 strategic plan and GDPR in Cyprus under Law 125(I)/2018. Some Member States have also passed their own AI laws, as covered in our guide to Italy’s Law 132/2025.

How do the NIST AI RMF and ISO 42001 relate to the AI Act?

Both are voluntary frameworks that help you build the governance the AI Act expects, but neither replaces it.

• NIST AI Risk Management Framework: published in January 2023, it organises AI risk management into four functions: Govern, Map, Measure and Manage. It maps well to AI Act risk management, data governance and monitoring.
• ISO/IEC 42001:2023: a certifiable AI management system standard, structured like ISO 27001. Its policies, roles, impact assessments and continual improvement support the AI Act QMS and post-market monitoring.

In practice: ISO 42001 certification does not on its own give a presumption of conformity with the AI Act. That comes from harmonised European standards, which CEN-CENELEC is developing. Treat ISO 42001 and the NIST AI RMF as a management framework around which you build AI Act-specific evidence such as technical files, FRIAs and conformity assessments. Our ISO 42001 certification roadmap explains the certification steps.

EU AI Act compliance checklist

Work through these steps in order, and repeat them whenever you add or change an AI system.

1. Build an AI inventory. List every AI system in use or development, including AI embedded in SaaS tools and unapproved “shadow AI”, with owner, supplier, purpose and data used.
2. Confirm scope and role. For each system, decide whether it is an AI system under the Act and whether you are provider, deployer, importer or distributor. Record any Article 25 triggers that could make you a provider.
3. Classify risk. Screen against Article 5, then Annex I and Annex III, then Article 50. Document Article 6(3) assessments where you conclude an Annex III system is not high-risk.
4. Stop prohibited uses. These have been banned since February 2025. Withdraw or redesign any system that falls within Article 5.
5. Run AI literacy training. Give staff who operate or oversee AI a level of understanding suited to their role, and keep records.
6. Close high-risk gaps. Providers work through Articles 9 to 17, conformity assessment and registration; deployers through Article 26.
7. Complete impact assessments. Carry out FRIAs where Article 27 applies and link them to existing DPIAs.
8. Meet transparency duties. Tell people when they interact with AI, label deepfakes and mark synthetic content as required by Article 50.
9. Manage suppliers. Ask AI vendors for instructions for use, conformity documentation and GPAI information, and build AI questions into your vendor risk assessment questionnaire.
10. Set up monitoring and incident reporting. Define how you detect performance drift, bias and malfunctions, and who reports serious incidents and within what timeframe.
11. Keep evidence current. Store technical files, assessments and approvals in one place with version history.

In practice: the inventory is where most programmes stall. An existing asset register with owners and vendors is a good start: add AI systems as an asset type rather than a separate spreadsheet.

How can a GRC platform help with AI Act compliance?

A GRC platform keeps the AI inventory, assessments, controls and evidence linked, so a change such as a model update shows up everywhere it matters.

Enactia’s AI-powered GRC platform covers the EU AI Act and ISO 42001 alongside GDPR, ISO 27001, NIS2 and DORA. Teams typically use Asset Management to record AI systems with owners, vendors and linked processing activities, the DPIA module for privacy impact assessments, the enterprise risk register to track AI risks and controls, and Compliance Universe to map requirements across frameworks. Compare any tool against your own inventory and role.

If your organisation is deploying AI agents that plan and act on their own, our guide to agentic AI governance covers the additional access, oversight and logging controls they need alongside the AI Act requirements above.

Frequently asked questions

Does the EU AI Act apply to companies outside the EU?
Yes, if you place AI systems or GPAI models on the EU market or the output of your AI system is used in the EU. Non-EU providers of high-risk systems and GPAI models must appoint an EU authorised representative.

When do high-risk AI obligations apply?
Under Regulation 2024/1689, from 2 August 2026 for Annex III systems and 2 August 2027 for Annex I regulated products. The Digital Omnibus proposal would adjust this timing, so check whether any amendment has been adopted before planning against a later date.

What is the difference between a DPIA and a FRIA?
A DPIA under the GDPR assesses risks from processing personal data. A FRIA under Article 27 of the AI Act assesses wider fundamental rights risks, such as discrimination, from using a high-risk AI system. A FRIA can complement an existing DPIA, so the two are often prepared together.

Do we need to do anything if we only use off-the-shelf AI tools?
Yes. As a deployer you must ensure AI literacy, avoid prohibited uses and meet transparency duties, and for high-risk systems follow the instructions, assign human oversight, keep logs and inform affected people. Changing a tool’s intended purpose can make you its provider.

Does ISO 42001 certification mean we comply with the AI Act?
No. ISO/IEC 42001 supports many AI Act requirements but does not by itself give a presumption of conformity. You still need technical documentation, conformity assessment, registration and, where relevant, FRIAs.

Building your AI Act programme

AI Act compliance starts with an accurate inventory and a clear view of your role for each system, then moves to classification, gap closure and monitoring. If you already run GDPR and ISO 27001 programmes, extend them to AI rather than starting again.

For help organising your AI Act and AI governance work, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.