EU AI Act: Complete Compliance Guide (2025–2028)

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI law. It applies in tiers: prohibited practices from February 2025, GPAI rules from August 2025, and high-risk AI obligations from December 2027 (Annex III) and August 2028 (Annex I) after the 2026 omnibus amendments.

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive horizontal legal framework for artificial intelligence. It entered into force on 1 August 2024 and applies progressively across four risk tiers.

The Act uses a risk-based approach: the higher the potential harm, the stricter the obligations. It does not govern all software — only systems that qualify as AI under the definition in Art. 3(1) and Annex I, which covers machine learning, logic- and knowledge-based approaches, and statistical models.

Who must comply?

The AI Act applies to four categories of actors:

• Providers — organisations that develop AI systems or general-purpose AI models and place them on the EU market or put them into service in the EU
• Deployers — organisations or individuals that use AI systems under their own authority in a professional context
• Importers — entities established in the EU that import AI systems from third countries
• Distributors — entities in the supply chain other than providers and importers

Geographic reach: the Act applies whenever the AI system's output is used in the EU, regardless of the provider's location. A US-based provider whose AI is used by European companies is in scope.

The four risk tiers

Application timeline

The 2026 Digital Omnibus on AI extended the two high-risk AI deadlines by 16 and 24 months respectively, without changing the obligations themselves.

High-risk AI systems: what triggers full obligations?

An AI system is high-risk under Annex III if it falls into one of these eight areas:

1. Biometric identification and categorisation
2. Critical infrastructure management (energy, water, transport)
3. Education and vocational training (access decisions, grading)
4. Employment — recruitment, performance assessment, promotion decisions
5. Essential private and public services (credit scoring, insurance, emergency services)
6. Law enforcement (risk assessment, evidence evaluation)
7. Migration, asylum, border control
8. Administration of justice and democratic processes

An additional filter applies (Art. 6(3)): Annex III systems must pose a significant risk of harm to health, safety, or fundamental rights. Low-risk AI tools in these sectors may be exempt.

Key compliance obligations for high-risk AI providers

1. Risk management system (Art. 9) — continuous process throughout the lifecycle
2. Data governance (Art. 10) — training, validation, and testing datasets must be appropriate
3. Technical documentation (Art. 11 + Annex IV) — before placing on market
4. Transparency and logging (Art. 12–13) — automatic logging, user instructions
5. Human oversight (Art. 14) — measures enabling humans to monitor and intervene
6. Accuracy, robustness, cybersecurity (Art. 15)
7. Quality management system (Art. 17)
8. Conformity assessment (Art. 43) — third-party for some categories
9. EU database registration (Art. 71)
10. CE marking (Art. 48) before placing on market

Convergence with DORA and NIS2

Financial institutions face overlapping obligations across AI Act, DORA, and NIS2. The AI Act's risk management system (Art. 9) maps closely to DORA's ICT risk management framework (Art. 5–16). Dual-mapping documentation reduces compliance burden. See our convergence analysis →.