The EU AI Act Explained: Risk Tiers, Who It Affects, and the Timeline

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive, binding AI regulation, and its reach is broad: if you build, deploy, or even procure AI systems that touch anyone in the European Union, it applies to you regardless of where your company is headquartered [1]. That extraterritorial scope is why it matters to US and other non-EU enterprises, not just European ones. This guide explains the four risk tiers, who the Act applies to, its recently shifted timeline, the penalties, and what it means practically for teams building with AI. For the broader governance picture, see the enterprise AI governance pillar.

One caveat before the details: the Act’s timeline is actively evolving. A package known as the Digital Omnibus, provisionally agreed in May 2026 and reported as approved by the Council at the end of June 2026, deferred several deadlines. Treat every date here as point-in-time and verify it against the current official text, and note that this is general information, not legal advice.

The risk-based approach

The Act classifies AI systems into four risk tiers, and the obligations scale with the risk [2][3].

Unacceptable risk (prohibited). Systems in this tier are banned outright because of the risk they pose to fundamental rights, for example social scoring and certain manipulative or exploitative uses [4]. These prohibitions, under Article 5, have been enforceable since February 2025.

High risk. This is the heavily regulated tier, defined by Article 6 together with Annexes I and III. Annex III covers standalone high-risk uses such as hiring and employment decisions, credit scoring, biometrics, education, and essential services, while Annex I covers AI embedded in already-regulated products like medical devices, machinery, and vehicles [5]. High-risk systems carry extensive obligations: risk management, detailed technical documentation, data governance, human oversight, a formal conformity assessment, often by a designated Notified Body, leading to CE marking, and post-market monitoring [6].

Limited risk (transparency). Systems that interact directly with people must disclose that they are AI, and synthetic audio, image, video, and text content must be labeled in a machine-readable format, under Article 50 [7].

Minimal risk. The large majority of AI systems fall here and carry no specific obligations.

Separately, general-purpose AI (GPAI) models are handled on their own track rather than slotted into the risk tiers, which we come to below.

Regulated

• Unacceptable risk Banned Social scoring, and certain manipulative or exploitative uses. Prohibited outright under Article 5, enforceable since February 2025.
• High risk Dec 2027 Hiring, credit scoring, biometrics, education, essential services (Annex III), plus AI inside regulated products (Annex I). Risk management, technical documentation, data governance, human oversight, conformity assessment and CE marking, post-market monitoring.

Light touch

• Limited risk Applies now Disclose that a system is AI, and label synthetic audio, image, video and text in a machine-readable format. Article 50, and the duty that catches nearly everyone.
• Minimal risk Where the large majority of AI systems sit. No specific obligations under the Act.

Separate track

• General-purpose AI Not a tier. Technical documentation, copyright compliance, a training-data summary. Above roughly 10^25 floating-point operations, add evaluations, red-teaming, cybersecurity and incident reporting.

Who it applies to

The Act assigns obligations by role, and knowing your role is the first step to knowing what you owe.

A provider develops an AI system and places it on the market, and carries the heaviest obligations. A deployer uses an AI system under its own responsibility, and has lighter duties centered on transparency, human oversight, and ensuring the provider has done its documentation [1][8]. Importers and distributors have obligations too. Crucially, under Article 25, substantially modifying or rebranding a system can turn a deployer into a provider, with all the heavier obligations that entails [8].

GPAI providers face a separate set of requirements: technical documentation, copyright compliance, and a summary of training data, with models above the systemic-risk compute threshold (on the order of 10^25 floating-point operations) additionally required to perform model evaluations, red-teaming, cybersecurity measures, and incident reporting [8]. And certain high-risk deployers, such as public bodies and providers of services like credit and insurance, must also complete a Fundamental Rights Impact Assessment under Article 27 [8].

The timeline

The Act entered into force on 1 August 2024 and phases in over several years. The settled milestones:

• 2 February 2025: prohibited practices (Article 5) and AI-literacy obligations (Article 4) apply, and penalties are already in force [7].
• 2 August 2025: GPAI model obligations apply. Models placed on the market after this date must comply immediately, while models already on the market beforehand have until 2 August 2027 [7].
• 2026: the Act’s general application and the Article 50 transparency duties land in this window; the Digital Omnibus adjusted the precise timing, so confirm the current date [9][1].
• 2 December 2027: the high-risk obligations for Annex III systems apply. This was deferred from an original date of 2 August 2026 by the Digital Omnibus [2][9].
• 2 August 2028: high-risk obligations for AI embedded in Annex I regulated products apply [9].

The most important thing to understand about the deferral is that it is a change of date, not a change of requirement [9]. The high-risk regime is coming; organizations simply have more time to prepare. Because these dates have already moved once and formal adoption steps were still settling through mid-2026, anyone with EU exposure should track the official timeline rather than rely on any single published version.

The penalties

Enforcement has teeth. Fines are tiered to the severity of the violation, reaching up to €35 million or 7 percent of global annual turnover for breaches of the prohibited-practice rules under Article 99, and ranging down to lower caps, on the order of €7.5 million or 1 percent of turnover, for lesser infractions [2][3]. SMEs and startups benefit from proportionate, reduced caps [3].

What it means for teams building with AI

For most organizations building on top of AI, the practical impact is real but manageable, and it depends heavily on your role.

If you are a deployer, using an API or an existing model to build an application, your main obligations are transparency, human oversight, and making sure the model provider has done its documentation homework [1]. If you provide or substantially modify a model, the obligations are heavier, but the GPAI Code of Practice offers a compliance roadmap [1].

There is one duty that catches nearly everyone: the Article 50 transparency obligations apply to every organization with a chatbot or a generated-content workflow, whether or not it operates anything high-risk. That work, disclosing AI interactions and labeling AI-generated content, is small, cannot be deferred, and should be done first [9].

And the practical starting point is the same one good governance always begins with: an inventory. You cannot assess your obligations without a list of every AI system you run, its model type, its use case, and your role as provider or deployer for each [8]. This is the same discovery step the NIST AI RMF guide recommends starting with, which is not a coincidence, since a single AI inventory feeds compliance across both.

Where to start

A sensible sequence for an organization with EU exposure: inventory your AI systems and classify each by risk tier and by your role; handle the Article 50 transparency duties now, since they apply broadly and are quick; check Annex III to determine whether any system is high-risk and, if so, begin preparing for the heavier obligations well ahead of the 2027 deadline; and align your work with a recognized framework such as the NIST AI RMF or ISO 42001, using the official crosswalks so that one governance program satisfies the EU AI Act and other regimes at once, as covered in the pillar. The security controls that underpin several high-risk requirements are covered in enterprise RAG security and data governance.

The bottom line

The EU AI Act is binding, extraterritorial, and risk-based. Most AI falls into the low-obligation tiers, but if you build or deploy AI that reaches EU users, you need to know your risk tier and your role. The immediate and near-universal work is the transparency duties; the heavier high-risk regime has been deferred to late 2027 but not weakened. The organizations that handle it well inventory their AI, classify it honestly, and fold EU compliance into a broader governance program rather than treating it as a standalone fire drill. And because the timeline keeps moving, keep an eye on the official dates.

---

Trying to work out where the EU AI Act leaves you? It usually comes down to an honest AI inventory, your role for each system, and handling the transparency duties first. The heavier obligations apply only if a system is genuinely high-risk.

---

Sources

1. Decode the Future (2026). EU AI Act Explained (four risk tiers; extraterritorial scope; Article 99 penalties; the Digital Omnibus deferral; deployer-versus-provider obligations for teams building with foundation models). https://decodethefuture.org/en/eu-ai-act-explained/
2. QuantaMix Solutions (2026). EU AI Act Compliance Guide 2025-2027 (post-Omnibus timeline; risk classes; fine ranges and SME caps). https://quantamixsolutions.com/insights/eu-ai-act-compliance-guide/
3. ModelOp (2026). EU AI Act: Summary & Compliance Requirements (four risk tiers; penalties; extraterritorial application; the unacceptable-risk tier). https://www.modelop.com/ai-governance/ai-regulations-standards/eu-ai-act
4. (See ModelOp, above, on the unacceptable-risk tier.)
5. Compliance Kit (2026). EU AI Act Guide 2026 (risk classes by article; provider and deployer definitions; Article 25; GPAI Articles 53-55 and the systemic-risk compute threshold; Article 27 Fundamental Rights Impact Assessment; the AI-inventory starting point). https://compliance-kit.eu/en/knowledge/eu-ai-act-guide
6. Trilateral Research (2026). EU AI Act Implementation Timeline (high-risk obligations; conformity assessment, Notified Bodies, and CE marking). https://trilateralresearch.com/responsible-ai/eu-ai-act-implementation-timeline-mapping-your-models-to-the-new-risk-tiers
7. SureCloud (2026). EU AI Act Compliance Guide (AI-literacy duty; GPAI obligations under Articles 51-55; Article 50 transparency and content-labeling). https://www.surecloud.com/resource-hub/eu-ai-act-complete-compliance-guide
8. (See Compliance Kit, above, on roles, GPAI obligations, and inventory.)
9. Legiscope (2026). EU AI Act Timeline: Deadlines (the phased 2024-2028 timeline; the Digital Omnibus deferral and its reported Council approval; the transparency duties applying broadly; “a change of date, not a change of requirement”). https://www.legiscope.com/blog/eu-ai-act-timeline-deadlines.html