EU AI Act

Regulation on Artificial Intelligence

Regulation (EU) 2024/1689Upcoming — High-risk obligations August 2026

The world’s first comprehensive AI law. Establishes risk-based classification for AI systems with strict prohibitions, conformity assessments for high-risk AI, transparency obligations, and GPAI model requirements. Penalties up to EUR 35M or 7% of global turnover.

113

Articles

Annexes

Risk Tiers

€35M

Max Fine

Implementation Timeline

1 August 2024

AI Act enters into force

2 February 2025

Prohibited AI practices ban takes effect

2 August 2025

GPAI model provider obligations apply

2 August 2026

High-risk AI system requirements apply

2 August 2027

Full scope including embedded AI in regulated products

Who's In Scope

AI Providers

Developers placing AI systems on the EU market
GPAI model providers (general-purpose AI)
Open-source AI developers (limited exemptions)

AI Deployers

Organisations using AI systems in the EU
Public bodies deploying AI in decision-making
Private sector operators of high-risk AI

High-Risk Domains

Biometric identification and categorisation
Critical infrastructure management
Credit scoring and employment decisions
Education and vocational training
Law enforcement and migration management
Administration of justice and democratic processes

Key Requirements

Art. 5

Prohibited AI Practices

Bans social scoring, real-time remote biometric identification in public spaces (with limited exceptions), manipulation techniques exploiting vulnerabilities, and emotion recognition in workplace and education settings.

Art. 6–49

High-Risk AI Obligations

Risk management system, data governance, technical documentation, record-keeping, transparency to users, human oversight, and requirements for accuracy, robustness, and cybersecurity.

Art. 50

Transparency Obligations

All AI systems interacting with persons must disclose they are AI. Deepfakes and AI-generated content must be labelled as such.

Art. 51–56

GPAI Model Requirements

Technical documentation, copyright policy compliance, compute reporting for systemic risk models, adversarial testing, and serious incident reporting.

Art. 27

Fundamental Rights Impact Assessment

Deployers of high-risk AI in public sector and certain private contexts must assess impact on fundamental rights before deployment.

Art. 62

Post-Market Monitoring & Incidents

Providers must establish a post-market monitoring system and report serious incidents to market surveillance authorities.

Penalties & Enforcement

Prohibited AI violations

EUR 35M or 7% global turnover

Whichever is higher. Applies to banned practices under Art. 5.

Other non-compliance

EUR 15M or 3% global turnover

Applies to high-risk obligations, GPAI requirements, and most other provisions.

False information to authorities

EUR 7.5M or 1% global turnover

Supplying incorrect, incomplete, or misleading information to authorities.

How Orizon Can Help

Compliance Management

We provide structured preparation and compliance support for EU AI Act.

Learn more

Official Sources

Assess Your Readiness

Schedule a consultation with our regulatory experts to assess your EU AI Act compliance posture and build a practical roadmap.

Get Started