Who has to comply with the EU AI Act?

Providers who develop AI systems or general-purpose AI models and place them on the EU market, deployers who use AI systems in a professional capacity in the EU, and importers and distributors who make AI available on the EU market. It also reaches operators outside the EU when the output of their AI system is used inside the EU.

When does the EU AI Act apply?

The Act entered into force on 1 August 2024. Article 5 prohibitions applied from 2 February 2025, general-purpose AI obligations from 2 August 2025, general application including Annex III high-risk requirements from 2 August 2026, and Annex I embedded high-risk requirements from 2 August 2027.

What are the penalties under the EU AI Act?

Breaking the Article 5 prohibitions carries fines up to 35 million euro or 7% of total worldwide annual turnover, whichever is higher. Failing high-risk obligations carries up to 15 million euro or 3%. Supplying incorrect or misleading information to authorities carries up to 7.5 million euro or 1.5%.

Are we covered if we just use the OpenAI or Anthropic API?

The model provider handles the rules about the model. You are still responsible for the system you built with it. If your feature screens CVs, that feature is high-risk and the obligation is yours.

Do we have until 2027 to comply with the EU AI Act?

No. The bans landed in February 2025 and the main high-risk deadline was 2 August 2026. Only AI embedded inside regulated hardware waits for 2027.

What are the four EU AI Act risk tiers?

Banned practices under Article 5, high-risk systems under Annex I and Annex III, limited-risk systems that owe transparency duties under Article 50, and minimal-risk systems that carry no new obligations. Most AI lands in the bottom tier.

EU AI Act Explained Simply, What Is the AI Act in Plain English

The Law Sorts AI by Who It Could Hurt

A tiny model that decides who gets a mortgage carries the full weight of the law. An enormous model that recommends films carries almost none. Sophistication has nothing to do with it.

It Works Like Rules for Vehicles

On a public road

• Tanks are not allowed at all
• Buses need inspections and a licence
• Learner drivers display a plate
• Bicycles just go

Under the AI Act

• Social scoring is banned outright
• Loan and hiring AI needs an audit
• Chatbots have to say they are AI
• Spam filters just run

The Four Buckets

Banned

Turn it off

The EU decided these should not exist, so there is no form to fill in and no audit that makes them acceptable.

• Scoring citizens on their general behaviour
• Scraping the internet for faces to build a recognition database
• Guessing employee or student emotions from their face

Switch it off. Redesigning the practice out is the only way back.

High risk

Heavy duties

Allowed, with real paperwork and a human who can step in. This is where the work lives.

• Filtering job applicants
• Deciding who gets a loan
• Grading exams or marking students
• AI inside a medical device or a car

Document it, test it, log what it does, register it, and make sure a person can override it.

Needs a label

Disclose it

Fine to build. You have to be honest that a machine is involved.

• A support chatbot
• AI-generated images, video, or copy
• Anything that makes a convincing fake of a real person

Say it is AI, and mark generated output so other software can spot it.

Free to go

No new duties

Most AI lands here, and the Act adds nothing new.

• Spam filters
• Demand forecasting
• Product recommendations
• Most internal tooling

Carry on as you were.

Are you the maker or the user?

The Act asks this question constantly, and it changes what you owe. If you build the AI and put your name on it, you are a provider and you carry the documentation and testing burden. If you buy AI and use it at work, you are a deployer and you carry the day-to-day duties: keep a human in charge, feed it sensible data, keep the logs, tell the people it affects.

One trap worth knowing. Buy a model, fine-tune it, ship it under your own brand, and you have just become the provider. The paperwork moves to you.

The dates, in plain terms

Already happenedThe bans took effect in February 2025. Rules for big foundation models followed in August 2025.

2 August 2026The main event. High-risk systems in hiring, credit, education, and public services have to be properly documented, logged, registered, and supervised.

2 August 2027AI built into regulated hardware such as medical devices and vehicles has to meet the same bar.

Five things people get wrong

"It only applies to European companies."

It applies wherever you are, if your system is sold in the EU or if its output is used there. Plenty of US companies are covered.

"We just use the OpenAI or Anthropic API, so we are fine."

The model provider handles the rules about the model. You are still responsible for the thing you built with it. If your feature screens CVs, that feature is high-risk and it is yours.

"It is about chatbots and generative AI."

A plain scoring model with no language involved can be high-risk. Credit decisions and CV filters are the classic cases, and neither has to be generative.

"We have until 2027."

The bans landed in February 2025 and the big high-risk deadline was 2 August 2026. Only the AI embedded inside regulated hardware waits for 2027.

"Someone will warn us before it gets enforced."

Each country has an authority that can investigate, fine, and pull a product from the market. The fines top out above GDPR at 7% of worldwide turnover.

Where to start on Monday

Write down every AI system your company uses, including the ones a team signed up for on a company card. Put each one in a bucket. Almost everything will land in the bottom two, and the handful that does not is your actual project. If you want the codebase half of that list generated for you, run the free AI Posture Analyzer.

Go deeper

What Companies Need to Do Implementation Timeline EU AI Act Hub

How Prismor helps with the EU AI Act

Most of the Act's operational load comes down to two questions: which AI systems do you run, and can you show what they did. Prismor answers both for the AI inside your codebase.

Find every AI system you run

Phasing out Article 5 practices and classifying under Annex III both start from an inventory. Prismor finds the SDKs, models, agent configs, and MCP servers in your repos, including the ones nobody wrote down.

Records that hold up in an audit

Article 12 requires high-risk systems to log their operation automatically. Prismor captures every tool call and file touch with the session context an auditor asks about.

Human oversight you can enforce

Article 14 expects a person who can step in. Prismor holds risky agent actions for approval and blocks the ones that break your policy.

Check your AI posture Log in

The AI Posture Analyzer is free. Public repos scan instantly with no signup. Private repos sign in with GitHub and run on your own access.