The EU AI Act is the world's first comprehensive, horizontal law regulating artificial intelligence, and like GDPR before it, its influence extends well beyond the EU's own borders — any organisation whose AI systems are placed on the EU market, or whose AI output is used within the EU, needs to understand where they fall in its structure, regardless of where the company itself is based.
A risk-based, tiered approach
Rather than regulating "AI" as one category, the Act sorts AI systems into risk tiers, with obligations that scale with the potential harm:
- Unacceptable risk — practices banned outright, such as government-run social scoring, certain manipulative or exploitative AI techniques, and (with narrow, tightly defined exceptions) real-time remote biometric identification in publicly accessible spaces for law enforcement purposes.
- High-risk — AI systems used in contexts like employment and worker management, access to essential services (including credit scoring), critical infrastructure, law enforcement, migration, education, and certain medical devices. These carry the bulk of the Act's compliance obligations.
- Limited risk — systems subject mainly to transparency obligations: users must be told they're interacting with an AI system (e.g. a chatbot), and AI-generated or manipulated content (including deepfakes) must generally be disclosed as such.
- Minimal or no risk — the large majority of everyday AI applications (spam filters, AI-enabled video games, and similar), which carry no specific obligations under the Act beyond generally applicable law.
What high-risk AI systems actually have to do
If your AI system falls into the high-risk category, the obligations are substantial and resemble a formal product compliance regime more than a typical data-protection checklist:
- A risk management system covering the AI system's full lifecycle.
- Data governance — ensuring training, validation, and testing data meet quality criteria and are examined for possible bias.
- Technical documentation and record-keeping (logging) sufficient to demonstrate compliance and enable traceability.
- Transparency to downstream users — clear instructions for use so deployers can operate the system correctly.
- Human oversight — designed so a human can meaningfully oversee and, where necessary, override the system.
- Accuracy, robustness, and cybersecurity appropriate to the system's intended purpose.
- A conformity assessment before the system is placed on the market or put into service, and registration in an EU database for many high-risk use cases.
General-purpose AI models get their own rules
Foundation and general-purpose AI (GPAI) models — the large models underpinning many downstream products — are addressed separately from the risk-tier system above. Providers of GPAI models face baseline obligations around technical documentation and transparency (including summarising training content for copyright purposes), and models classified as carrying "systemic risk" — generally the most capable models, assessed partly against compute thresholds — face additional obligations, including risk assessment and incident reporting.
Who it applies to — and it's extraterritorial like GDPR
The Act applies to providers placing AI systems on the EU market, deployers of AI systems located in the EU, and — critically — providers and deployers located outside the EU where the AI system's output is used within the EU. A company with no EU office at all can still be squarely in scope if its AI product serves EU users or its output affects people in the EU.
Penalties are tiered like the risk categories
Enforcement follows the same tiered logic as the obligations themselves: the most serious violations (deploying banned/unacceptable-risk practices) carry the highest maximum fines, running up to a significant percentage of global annual turnover or a fixed amount in the tens of millions of euros, whichever is higher — with materially lower tiers for high-risk-system noncompliance and for supplying incorrect information to authorities. Because this is a genuinely new and still-maturing regulatory area, the exact current figures and enforcement timelines are worth confirming directly against the latest official guidance rather than a secondary summary.
This guide is general information, not legal advice. The EU AI Act is new and its implementation is phased and still evolving — verify current obligations, effective dates, and enforcement guidance directly with a qualified professional or official EU sources before making compliance decisions.
Turning risk classification into an ongoing practice
The hardest part of AI Act compliance in practice is rarely the initial classification — it's proving, on an ongoing basis, that risk management, data governance, and human oversight are genuinely operating as AI systems and their use cases evolve. ComplianceDesk's EU AI Act framework gives you the Act's core obligations pre-built as trackable controls, with an evidence vault so your documentation reflects your AI systems as they actually are today.