EU AI Act

What it is, and who it reaches

Regulation (EU) 2024/1689 is a product-safety style law for AI: it sorts AI systems into risk categories and attaches obligations to each, from an outright ban at the top to nothing at all for most systems at the bottom. It entered into force on 1 August 2024 and applies in stages over four years.

Its reach is the first thing to get right. It applies to providers who place AI systems or general-purpose models on the EU market, to deployers established in the EU who use them, and to providers and deployers anywhere in the world where the system's output is used in the EU. A UK lender with EU customers, a US SaaS vendor with EU users, and an Indian outsourcer processing EU data on an EU client's behalf are all inside it. The site's financial services article works through what that means for UK firms specifically.

The four categories

Prohibited practices (Article 5). Eight uses the Act has banned outright since February 2025: manipulative or deceptive techniques that cause harm, exploitation of vulnerability, social scoring, individual criminal risk profiling from personality traits alone, untargeted facial-image scraping, emotion recognition in workplaces and education, biometric categorisation of sensitive attributes, and real-time remote biometric identification in public spaces by law enforcement, with narrow exceptions. The 2026 Digital Omnibus adds two more from 2 December 2026: AI systems that create or manipulate intimate material of a person without their consent, and AI systems that generate child sexual abuse material. The register carries the original eight as risks, deliberately with few controls mapped, because the correct response to a prohibition is not to build the system.

High-risk systems (Annex I and Annex III). Two routes in: a system that is a safety component of a product already covered by EU product law (Annex I: machinery, medical devices, vehicles and so on), or a system used in one of eight listed areas (Annex III: biometrics, critical infrastructure, education, employment, access to essential services including credit and insurance, law enforcement, migration, and justice). These carry the Act's full weight: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, a conformity assessment before market, registration, and for some deployers a fundamental rights impact assessment under Article 27. The Commission published draft guidelines on how to classify a system as high-risk on 19 May 2026; they are not yet final.

Limited-risk transparency duties (Article 50). Systems that interact with people, generate synthetic content, or perform emotion recognition or biometric categorisation must disclose that fact. The Commission's code of practice on marking and labelling AI-generated content, published in June 2026, is the voluntary route to showing compliance. The Article 50 article covers the obligation in detail; the register entry is undisclosed AI interaction.

Minimal risk. Everything else, which is most AI, carries no obligation beyond Article 4's literacy duty and whatever other law already applies.

General-purpose AI models

The Act treats foundation models separately from the systems built on them. Providers of general-purpose AI models must keep technical documentation, publish a summary of training content, respect EU copyright law and give downstream providers the information they need to comply. Models designated as posing systemic risk, by a compute threshold or by Commission decision, carry further duties: evaluation and adversarial testing, incident reporting, and cybersecurity. These obligations have applied since 2 August 2025, supported by a voluntary code of practice that most major providers have signed.

For a deploying organisation the practical point is the one the third-party risk entry makes: the documentation a GPAI provider is now obliged to hold is exactly the documentation a vendor questionnaire should ask for, and a provider that cannot produce it is telling you something.

The timeline, as of October 2026

The dates matter because the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, moved some of them and added others.

• 2 February 2025: the original eight Article 5 prohibitions and the Article 4 AI literacy duty apply.
• 2 August 2025: general-purpose model obligations apply; governance bodies including the AI Office are operational.
• 2 August 2026: Article 50 transparency duties apply, and the Commission's enforcement powers over GPAI providers begin.
• 2 December 2026: the two new Article 5 prohibitions apply, and generative systems already on the market before 2 August 2026 must meet the Article 50(2) machine-readable marking duty.
• 2 August 2027: national AI regulatory sandboxes are due (deferred from August 2026), and GPAI models placed on the market before 2 August 2025 must comply.
• 2 December 2027 (deferred from 2 August 2026): Annex III high-risk obligations apply.
• 2 August 2028 (deferred from 2 August 2027): Annex I embedded high-risk obligations apply.
• 2 August 2030: the outer deadline for high-risk systems already on the market that are intended for use by public authorities.

The Omnibus did more than move dates. It softened the literacy duty from ensuring a sufficient level of literacy to taking measures to support it, added the two prohibitions, narrowed what counts as a product's safety component, widened the legal basis for processing special-category data to detect and correct bias, and extended the SME documentation concessions to small mid-cap companies. It left the GPAI chapter and Article 50 as they were. An organisation that read the deferral as a general reprieve is already late on four sets of duties. Penalties run to 7% of worldwide turnover or 35 million euros for a prohibited practice and 3% or 15 million euros for most other breaches, whichever is higher.

What a deployer actually has to do now

Four things, in order. Classify every system in the AI inventory against the four categories, because every other obligation depends on the answer. Confirm no system is in an Article 5 use, including through a vendor feature, and including the two uses prohibited from December 2026, which matter to any organisation whose products generate or edit images. Meet Article 50 wherever a system interacts with people or generates content, which for most organisations means a disclosure line and a labelling mechanism. Keep a record of the measures taken to support Article 4 literacy. Then, for anything that will be high-risk in 2027 or 2028, start the documentation now, because the conformity assessment and the fundamental rights impact assessment are the slow parts.

One trap: a deployer that substantially modifies a high-risk system, or puts its own name on it, becomes its provider and inherits the provider's obligations. Configuration can do this. The third-party risk entry covers when.

Where it sits in the register

The Act runs through the register rather than sitting in one place in it. Undisclosed AI interaction is Article 50; AI-driven social scoring and its seven siblings are Article 5; missing AI impact assessment process is Article 27. On the control side, AI transparency and disclosure labelling, the AI impact assessment process and the AI literacy programme are the three the Act names most directly. The ISO/IEC 42001 entry covers the management system most organisations use to organise all of it.