The EU AI Act: what outside firms must know

What the EU AI Act is

The EU AI Act is the first set of rules on AI adopted by the European Union, agreed in June 2024, according to the European Parliament.

It works by risk. The higher the risk an AI system poses to people, the more duties fall on the company behind it.

Wondering what is the EU AI Act in one line? It is a product-safety style law for AI: classify the system, then follow the rules for that class.

This guide is general information, not legal advice. Ask a qualified lawyer before acting on any rule.

The four risk levels

• Unacceptable

  Practices that are prohibited

• High risk

  Strict duties and assessment

• Limited risk

  Tell people they are dealing with AI

• Minimal risk

  No extra duties under the Act

The EU AI Act risk categories run from banned uses at the top to systems with no new duties at the bottom.

Unacceptable risk covers practices the law bans outright. The Parliament says the ban started to apply on 2 February 2025.

High-risk systems face the heaviest duties. The Parliament notes they are assessed before reaching the market and throughout their lifecycle.

Limited-risk systems mainly carry transparency duties. Generative tools are not labeled high-risk, but they must meet transparency requirements and EU copyright law.

Does the EU AI Act apply outside Europe?

Yes, in many cases. The Parliament describes obligations for both providers and users of AI, depending on the risk level.

A US company that sells an AI product to EU customers, or whose AI output is used in the EU, should assume the law is relevant.

A firm that only deploys a tool inside its own US operations, with no EU users, is in a different position. Confirm this with counsel.

• Provider: builds the system or puts it on the market
• Deployer: uses a system in its own business
• Both roles can sit in one company

EU AI Act timeline and effective dates

The law applies in stages. The European Commission's service desk says the full roll-out of main milestones is foreseen by 2 August 2028.

Its timeline reflects the changes made by the Digital Omnibus on AI.

Prohibitions began on 2 February 2025. Most Article 50 transparency duties remain scheduled for 2 August 2026, according to law firm Jones Walker.

Rules for high-risk systems listed in Annex III are set to apply on 2 December 2027, per the AI Act explorer at artificialintelligenceact.eu.

A common search is when was the EU AI Act passed. The first rules were adopted in June 2024; the dates above are when each part starts to apply.

Jones Walker calls the delay a reprieve rather than a repeal, so planning should continue.

High-risk systems and what they require

Some systems count as high-risk under Article 6(2) and Annex III of the Act.

For those systems, the Parliament says assessment happens before market entry and continues over the system's life.

In practice, expect documentation, risk controls and human oversight. A governance policy is the usual starting point.

If a tool screens job candidates or scores customers, check whether it falls into this class before you deploy it.

• Document how the system was built and tested
• Keep human oversight in place
• Monitor performance after launch
• Record incidents and fixes

Transparency requirements and Article 50

Article 50 sets transparency duties for certain AI systems, such as telling people when they interact with AI.

Jones Walker notes that most of these duties stay scheduled for 2 August 2026 even after the Digital Omnibus delay.

Chatbots, voice agents and generated content are the usual places these duties show up for a business.

Fines and penalties

Jones Walker reports that Article 50 violations fall in a penalty tier of up to €15 million.

For a company, the alternative cap is 3 percent of total worldwide annual turnover, whichever is higher.

Other parts of the Act carry their own penalty tiers, so check the tier that matches the rule at issue.

EU AI Act compliance checklist

A mid-size company can start without a large legal team. These steps work for most firms.

Voluntary frameworks help. NIST describes its AI Risk Management Framework as voluntary guidance for building trustworthiness into AI design and use.

AI governance consulting is one route to this kind of setup, and an AI risk management process keeps it current.

• List every AI system you build, buy or use
• Mark which ones touch EU customers or users
• Assign each a risk level
• Decide if you are provider, deployer or both
• Write a short AI policy and name an owner
• Add human review where decisions affect people
• Plan transparency notices before August 2026