The EU AI Act: risk tiers, obligations, and timeline

What the EU AI Act is

The EU AI Act is Regulation (EU) 2024/1689, the European Union's horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies its obligations in phases rather than all at once. The Act takes a risk-based approach: instead of regulating every AI system identically, it sorts systems by the level of risk they pose to health, safety, and fundamental rights, and scales the obligations accordingly.

Its reach is extraterritorial. The Act applies to providers that place AI systems on the EU market or put them into service in the EU regardless of where the provider is established, and to providers and deployers located outside the EU where the output of the system is used within the EU. Because of that scope, organizations well beyond Europe assess whether their AI systems fall in scope, much as they did with the GDPR.

The Act sits alongside — not on top of — existing EU law. It does not replace the GDPR, product-safety directives, or sector rules; it adds AI-specific obligations that operate in parallel. Enforcement is shared between national market-surveillance authorities and, for general-purpose AI models, a central AI Office within the European Commission.

The four risk tiers

Every AI system in scope falls into one of four tiers. The tier determines the obligations. Most systems in ordinary business use fall into the minimal-risk tier, which carries no mandatory obligations under the Act; the regulatory weight concentrates on the high-risk tier.

Prohibited practices (Article 5)

The unacceptable-risk tier is defined by Article 5, which lists AI practices banned outright because they are considered a clear threat to people's rights and safety. These prohibitions were the first substantive obligations to take effect. In broad terms, the banned categories include:

• Subliminal, manipulative, or deceptive techniques that materially distort behavior and cause harm.
• Exploiting vulnerabilities related to age, disability, or a specific social or economic situation to distort behavior.
• Social scoring — evaluating or classifying people over time based on behavior or characteristics leading to detrimental treatment.
• Assessing or predicting the risk of a person committing a crime based solely on profiling or personality traits.
• Untargeted scraping of facial images from the internet or CCTV to build facial-recognition databases.
• Inferring emotions in the workplace or in education, except for medical or safety reasons.
• Biometric categorization that infers sensitive attributes such as race, political views, or sexual orientation.
• Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, outside narrowly defined exceptions.

High-risk systems and what providers must do

High-risk is where most of the compliance work lives. A system is high-risk if it is a safety component of a product already regulated under EU law listed in Annex I, or if it falls within one of the areas in Annex III: biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services, law enforcement, migration and border control, and administration of justice and democratic processes.

For high-risk systems, the Act requires the provider — the actor that develops the system, or has it developed, and places it on the market under its own name — to build and maintain a defined set of controls before and after the system goes to market. These provider obligations (Articles 8 to 17 and related provisions) are the heart of the regime:

• A risk management system running across the full lifecycle of the AI system.
• Data and data governance — training, validation, and testing data managed for quality, representativeness, and bias.
• Technical documentation demonstrating conformity, kept up to date.
• Automatic record-keeping (logging) of events over the system's lifetime to enable traceability.
• Transparency and clear instructions for use so deployers can operate the system correctly.
• Human oversight designed into the system so people can understand, monitor, and intervene.
• Appropriate accuracy, robustness, and cybersecurity for the system's intended purpose.
• A quality management system, a conformity assessment, CE marking, and registration in the EU database before market entry, followed by post-market monitoring.

Providers vs deployers: who does what

The Act assigns different duties to different actors along the value chain. The two that matter most for in-scope organizations are the provider and the deployer, and the distinction is consequential: the provider carries the build-time obligations, while the deployer carries the use-time obligations. Importers and distributors sit in between and mainly verify that upstream conformity is in place.

A note on drift: an organization that materially modifies a high-risk system, or puts its own name on it, can itself become a provider and inherit the provider obligations. Mapping which role you occupy for each system is an early step in any readiness effort.

General-purpose AI models

The Act adds a distinct layer for general-purpose AI (GPAI) models — the foundation models that can be adapted to many downstream tasks. Providers of GPAI models have their own obligations, centered on technical documentation, information for downstream providers who build on the model, a policy to respect EU copyright law, and a published summary of the content used for training.

A subset of GPAI models are designated as carrying systemic risk, based on their capabilities. Providers of those models take on additional obligations, including model evaluation, systemic-risk assessment and mitigation, incident tracking and reporting, and cybersecurity protection. Governance of GPAI models is coordinated centrally by the AI Office rather than solely by national authorities.

The phased timeline

The Act's obligations switch on in stages counted from its entry into force on 1 August 2024. Reading the timeline correctly matters, because the date an obligation applies is the date it becomes enforceable — not a target you can slip. The main milestones set out in the Regulation are:

How to prepare

Preparation is less about a single deadline and more about knowing where each of your AI systems sits and building the evidence the Act expects. A practical starting sequence:

• Inventory your AI systems and, for each, determine your role — provider, deployer, importer, or distributor.
• Classify each system by tier; confirm none fall under the Article 5 prohibitions, and flag anything in Annex I or Annex III as high-risk.
• For high-risk systems, stand up the required artifacts: a lifecycle risk management process, data-governance records, technical documentation, event logging, and a documented human-oversight design.
• For deployers, confirm you can operate within the provider's instructions, keep logs, and — where required — complete a fundamental rights impact assessment.
• For GPAI models you provide or build on, prepare model documentation, downstream information, a copyright policy, and a training-content summary.
• Keep evidence traceable and current: the Act rewards records that show a control operated over time, not a one-time snapshot.

Frequently asked questions