EU AI Act
Vendor-neutral overview of Regulation (EU) 2024/1689 for founders, CTOs, and compliance owners — risk tiers, Article 113 application dates, and Article 99 penalty ceilings. Not legal advice. Does not determine that the Act applies to YOU. Does not start a clock.
What is the EU AI Act and when does it apply?
EU AI Act (Regulation (EU) 2024/1689): risk tiers, Art. 113 dates, Art. 99 penalties. Not legal advice. Does not determine that the Act applies to YOU.
Which EU AI Act obligations are in force in 2026?
EU AI Act Article 113 dates: 2 Feb 2025, 2 Aug 2025, 2 Aug 2026 and 2 Aug 2027, and what each date covers. Not legal advice.
What GPAI-provider obligations does the EU AI Act impose?
EU AI Act Art. 53 GPAI duties: Annex XI docs, Annex XII, copyright policy, training-content summary. Not legal advice. Does not determine that YOU are a GPAI provider.
When is a GPAI model classified as having systemic risk?
EU AI Act Art. 51–55: GPAI systemic-risk classification, 10^25 FLOP presumption, Art. 52 notification, Art. 55 extras. Not legal advice. Does not designate YOUR model.
Are we an AI provider or a deployer under the EU AI Act?
EU AI Act Arts. 3, 16, 25, 26: provider vs deployer, importer, distributor, substantial modification. Not legal advice. Does not classify YOUR role.
What AI governance does the EU AI Act require?
EU AI Act Arts. 4, 14, 26: AI literacy, human oversight, deployer duties. ISO 42001 is a standard, not a substitute. Not legal advice. Does not determine YOU need an AIMS.
What AI risk management does the EU AI Act require?
EU AI Act Arts. 9 and 55: high-risk RMS vs GPAI systemic-risk track. ISO 42001 and NIST AI RMF do not discharge Art. 9. Not legal advice. Does not determine YOU run an RMS.
What technical documentation does the EU AI Act require?
EU AI Act Arts. 11 and 53: Annex IV high-risk vs Annex XI/XII GPAI packs. A model card is not Annex XI. Not legal advice. Does not determine YOU have to produce those packs.
What training-content summary does the EU AI Act require?
EU AI Act Art. 53(1)(d) public training-content summary vs Art. 50 labeling. Not legal advice. Does not determine that YOU have to publish a summary.
What copyright policy does the EU AI Act require?
What Art. 53(1)(c) asks of GPAI providers on copyright, and how it relates to the DSM Directive Art. 4 text-and-data-mining reservation.
When must you report a serious incident under the EU AI Act?
EU AI Act Art. 73 high-risk 15/2/10-day clocks vs Art. 55 GPAI without undue delay. Not legal advice. Does not determine YOUR event is reportable.
What must an AI system inventory capture?
EU AI Act Arts. 49 and 71 plus Annex VIII registration versus ISO 42001 inventory practice. Not legal advice. Recording a row is not registering YOUR system.
Who is accountable for each AI system?
EU AI Act Arts. 4, 14 and 26 oversight duties versus ISO 42001 accountability practice, with a RACI example. Not legal advice. Naming an owner is not Art. 14.
What AI-governance evidence should you retain, and for how long?
EU AI Act Art. 12 logging, Art. 18 ten-year documentation and Art. 19 at-least-six-month logs, with a retention matrix. Not legal advice. Not YOUR schedule.
Are we ready for the EU AI Act?
A deadline-anchored EU AI Act readiness checklist: every item carries its Art. 113 in-force date. Not legal advice. Does not determine the Act applies to YOU.
What evidence will an AI auditor or regulator request?
EU AI Act Arts. 21, 23, 26, 71 and 73–74 let authorities compel; ISO 42001 auditors ask by practice. Not legal advice. This is not a regulator filing pack.
What cybersecurity does the EU AI Act require of AI systems?
What the EU AI Act asks for AI cybersecurity: Art. 15 for high-risk systems vs Art. 55 for GPAI models. Not the Cyber Resilience Act.
What model evaluation and red teaming does the EU AI Act require?
EU AI Act Art. 15 high-risk accuracy, robustness and cybersecurity versus Art. 55(1)(a) GPAI adversarial testing. Code of Practice is guidance. Not legal advice.