EU AI Act: What Companies Need to Do

Step 1: Does the Act apply to you

Start with the definition in Article 3(1). An AI system is a machine-based system that operates with some autonomy, may adapt after deployment, and infers from its input how to generate outputs such as predictions, content, recommendations, or decisions. Deterministic software that follows hardcoded rules sits outside that definition. A model that infers does not.

Then check jurisdiction, because this is where non-EU companies get caught. The Act applies to providers placing systems on the EU market no matter where they are established, and to providers and deployers in third countries whenever the output of the system is used inside the EU. You are in scope with no EU entity, no EU office, and no EU staff.

The exemptions are narrow. Military, defence, and national security uses are out of scope, as is AI used only for scientific research and development, along with personal non-professional use. Everything else is in.

Step 2: Work out your role

Your obligations follow your position in the value chain, so settle this before anything else. Most organisations turn out to be both a provider and a deployer across different systems.

Step 3: Inventory and classify

Every downstream obligation depends on a complete list of the AI you run, including third-party tools and anything a team adopted without telling procurement. Audit internal tools, vendor software, embedded models, and agent frameworks, then sort each one into a tier.

Step 4: Remove prohibited practices

These have been illegal since 2 February 2025 and carry the largest fines in the Act. There is no conformity route and no paperwork that makes them acceptable. If you find one, the system comes out or gets re-engineered.

Two of these catch ordinary enterprise software. Emotion inference shows up in employee monitoring suites, candidate video interview scoring, and learning platforms. Personalisation engines can drift into manipulative territory when optimisation targets override informed choice. Check those two first.

Step 5: High-risk obligations

High-risk is where the real engineering work sits, and the Annex III set became enforceable on 2 August 2026. A system gets there by one of two routes.

The eight Annex III domains

The Article 6(3) escape hatch

Article 6(3) can pull a system back out of high-risk even when it sits squarely in an Annex III domain. It applies when the system performs a narrow procedural task, improves the result of a completed human activity, detects decision patterns without replacing human review, or does purely preparatory work. One hard limit: any system that profiles natural persons stays high-risk, and no derogation is available. If you rely on Article 6(3), document the assessment before market placement and register the system anyway.

Provider checklist

• Run a documented risk management system across the whole lifecycle, and keep it current as the system changes.
• Govern your data. Training, validation, and test sets need examination for bias, gaps, and representativeness.
• Write the technical documentation in Annex IV and keep automatic logging switched on.
• Design human oversight into the interface so an operator can understand, override, or stop the system.
• Hit the accuracy, robustness, and cybersecurity levels appropriate to the intended purpose.
• Complete conformity assessment, issue the EU Declaration of Conformity, apply CE marking, and register in the EU database.
• Run post-market monitoring and report serious incidents to the national authority.

Deployer checklist

• Operate the system according to the provider instructions for use.
• Assign human oversight to people with the competence, training, and authority to intervene.
• Make sure input data is relevant and representative for your context.
• Retain the automatically generated logs for the statutory period.
• Run a Fundamental Rights Impact Assessment under Article 27 where it applies, which covers public bodies and private providers of public services, plus creditworthiness assessment and life and health insurance pricing.
• Tell workers and their representatives before putting a high-risk system into use in the workplace, and inform people subject to its decisions.

Step 6: General-purpose AI duties

If you train and release a foundation model, Chapter V applies to you and has done since 2 August 2025. The Act splits these providers into two tiers.

Most companies consume these models rather than build them. If that is you, Chapter V is the model provider's problem, and your obligations attach to the system you build on top.

Step 7: Transparency obligations

Article 50 applies whatever tier your system sits in, and it is the requirement most consumer products will feel. Three duties matter.

Importers and distributors

If you resell or ship AI built by someone else, your duty is due diligence rather than engineering. Before a high-risk system reaches the EU market, verify that the third-country provider completed conformity assessment, compiled the technical documentation, applied CE marking, and registered the system. Keep records of those checks. If you have reason to believe a system is non-compliant, you cannot place it on the market until it is fixed, and you have to inform the provider and the relevant authority.

Penalties for non-compliance

Article 99 sets ceilings above GDPR at the top end. Each is expressed as a fixed amount or a share of worldwide turnover, whichever is higher.

SMEs and startups get the reverse calculation, paying whichever figure is lower rather than higher. National authorities can also restrict, withdraw, or recall a system from the EU market, which tends to hurt more than the fine.