TL;DR
EU AI Act compliance means knowing your legal role for each AI system, classifying its risk, and keeping evidence that each applicable duty is met. It also reaches US and other non-EU companies that sell AI into the EU or whose AI output is used there. Bans and the AI literacy duty have applied since February 2, 2025, and general-purpose AI rules since August 2, 2025. Transparency rules and enforcement followed on August 2, 2026. After the Digital Omnibus, high-risk rules apply to Annex III systems from December 2, 2027 and to Annex I products from August 2, 2028. Fines for banned practices reach EUR 35 million or 7% of worldwide turnover, so the work starts with a complete AI inventory.
Key Takeaways Your duties depend on your role, so label every AI system as provider, deployer, importer, distributor or general-purpose model provider before anything else. Classify each system into prohibited, high-risk, transparency-only or minimal risk, and record why, because the rationale is itself evidence. Prohibitions, AI literacy, general-purpose AI rules and transparency duties already apply, and national authorities have enforced them since August 2, 2026. High-risk providers prove compliance with a risk file, technical documentation, logs, oversight design and a conformity assessment, while deployers keep logs and oversight records. Deployers of high-risk systems keep automatic logs for at least six months by default, unless other Union or national law sets a different period. A six-step plan with an owner and dated evidence per step turns the law into work your teams can finish before the deadlines. Watch on YouTube
Enabling Real-time Compilance and Risk Detection Through an AI Agent
See how Kanerika built an AI agent that checks compliance and flags risk as work happens. That kind of control leaves an audit trail regulators can test.
27 Days, 392 Days and Two Clocks That Already Ran Out
On November 5, 2026, the EU AI Act calendar holds two numbers worth pinning to a compliance team’s wall. First, in 27 days, on December 2, 2026, new bans on AI that generates non-consensual sexual deepfakes take effect. Then, in 392 days, the high-risk rules reach hiring, credit scoring, insurance pricing and the other Annex III uses.
Two other clocks have already run out. The bans on prohibited practices and the AI literacy duty started on February 2, 2025. Enforcement of those rules then began on August 2, 2026.
So the Digital Omnibus delay bought time for high-risk paperwork, yet it paused nothing that already applies. And 392 days is short, especially when the evidence has to be built from scratch.
The EU AI Act Compliance Timeline After the Digital Omnibus
The AI Act, Regulation (EU) 2024/1689, entered into force on August 1, 2024. Today, the European Commission’s AI Act Service Desk timeline runs to August 2, 2028.
That end date comes from the Digital Omnibus on AI, Regulation (EU) 2026/1744 . It was published in the Official Journal on July 24, 2026 and has been in force since July 27, 2026. It delayed the high-risk rules, rewrote the AI literacy article and added two new prohibitions.
Many guides still print the original 2026 and 2027 high-risk dates, so check every date you plan against the amended text.
Date What Applies Status on November 5, 2026 August 1, 2024 AI Act enters into force Done February 2, 2025 Definitions, AI literacy and prohibited practices In force August 2, 2025 Obligations for general-purpose AI model providers; national authorities and penalty laws due In force July 27, 2026 Digital Omnibus amendments enter into force In force August 2, 2026 Most rules apply, including Article 50 transparency; enforcement starts for GPAI, prohibitions, transparency and AI literacy In force December 2, 2026 New bans on AI generating non-consensual sexual deepfakes and child sexual abuse material; Article 50(2) deadline for synthetic-content systems already on the market 27 days away August 2, 2027 GPAI models placed on the market before August 2, 2025 must comply; one regulatory sandbox per Member State 270 days away December 2, 2027 High-risk rules for Annex III systems 392 days away August 2, 2028 High-risk rules for AI in Annex I regulated products 636 days away
Who Must Comply With the EU AI Act?
The Act regulates roles rather than company types. For instance, one enterprise can be a provider for the model it built and a deployer for the HR tool it bought.
It can also be an importer for software it resells. So the first job is to assign a role to each system, not to the company as a whole.
Checklist
AI Governance Checklist
Check that your AI inventory, owners, policies and review gates are in place before you sign off risk classifications under the EU AI Act.
Get the Checklist → Does It Apply to US and Other Non-EU Companies?
Yes, in two common situations. First, Article 2 covers providers that place AI systems or general-purpose models on the EU market, even when they are based elsewhere. It also covers non-EU providers and deployers whose AI output is used in the Union.
A US lender that scores EU applicants from a server in Ohio is therefore in scope. The location of the data center matters far less than where the output lands. Our guide to the AI laws enterprises track worldwide also sets the EU rules beside US state laws and other regimes.
Provider, Deployer, Importer, Distributor or GPAI Provider
Each role carries its own evidence trail. So the table below sets out how to recognize each one and what an authority would ask you to show.
Role How to Recognize It Main Duty Evidence to Keep Provider When you develop an AI system, or have it developed, and place it on the market or put it into service under your name Make the system compliant before release Risk file, technical documentation, conformity records Deployer When you use an AI system under your authority in your business Use it as instructed, with human oversight Oversight roster, logs, worker notices Importer When you place a non-EU provider’s system on the EU market Check conformity before supply Supplier declarations, conformity checks Distributor When you make a system available in the supply chain Verify markings and documents before supply Distribution and corrective-action records GPAI model provider When you develop a general-purpose model and place it on the market Model-level documentation and copyright duties Model documentation, training-content summary, copyright policy
When Your Role Changes Under Article 25
Roles can also shift after a purchase. Under Article 25 , specifically, a deployer, importer or distributor becomes the provider of a high-risk system in three cases.
Putting its own name or trademark on the system. Making a substantial modification while the system stays high-risk. Changing the intended purpose so that the system becomes high-risk. The third case catches teams by surprise. For example, a chatbot bought for the internal help desk becomes high-risk once someone points it at job applicants. The company that repurposed it then inherits the provider file.
How to Classify Your AI Inventory Under the Four Risk Tiers
Classification decides almost everything that follows, so it deserves a written record for every system. Practitioners use four tiers, although the law itself works through separate articles rather than one ladder. General-purpose model duties then sit on top as an extra layer.
Tier Typical Example Compliance Response Prohibited Emotion recognition at work, social scoring Stop, remove or never deploy High risk Recruitment screening, credit scoring, safety components of regulated products Full provider or deployer obligations Transparency duties Customer chatbots, deep fakes Disclosure and machine-readable marking Minimal risk Spam filters, demand forecasting Proportionate internal governance
Start from a single register of every model, agent and AI feature, especially the ones staff adopted without approval. In particular, our guide to finding and managing shadow AI covers that discovery step.
Also, our roundup of AI governance tools compares software that keeps the register current. Then record the owner, vendor, intended purpose, EU exposure, role, tier, rationale and next review date for each entry.
Annex I, Annex III and the Article 6(3) Exception
A system becomes high-risk by one of two routes. Under Annex I, AI is a safety component of a product already covered by EU product law, such as machinery or medical devices. That route also requires third-party conformity assessment.
Under Annex III , it falls in a listed use area such as biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice. Classification therefore follows the intended purpose, not the vendor’s marketing label.
Article 6(3) lets an Annex III system escape the label when it poses no significant risk of harm. For instance, it may only perform a narrow procedural task or a preparatory step for a human decision.
However, the exception never covers a system that profiles natural persons. Also, a provider that claims it must document its assessment before the system reaches the market.
Worked Example: An AI Resume-Screening Tool
Take a US software company that sells a candidate-ranking tool to employers in Germany. Annex III point 4(a) lists AI used to analyze and filter job applications and to evaluate candidates.
Ranking candidates also profiles people, which closes the Article 6(3) door. The company is a high-risk provider, and its EU customers are deployers with their own duties from December 2, 2027.
The record should name the annex point, the profiling finding, the legal sign-off and the date. That one page answers the first question any market surveillance authority will ask.
Obligations Already in Force: Prohibitions, AI Literacy and Transparency
Three sets of duties need no further waiting. They apply today, and since national authorities can enforce them, they belong at the top of the work queue.
Prohibited Practices to Screen For
Article 5 bans several practices outright. So screen your inventory for each of these.
Manipulative or exploitative techniques that distort behavior and cause significant harm Social scoring that leads to unjustified detrimental treatment Predicting criminal offenses based solely on profiling or personality traits Untargeted scraping of facial images to build recognition databases Emotion recognition in workplaces and schools, except for medical or safety reasons Certain biometric categorization and real-time remote biometric identification in public spaces for law enforcement The Omnibus adds two bans from December 2, 2026, covering AI that generates non-consensual sexual deepfakes or child sexual abuse material. As a result, any image or video generator in your estate needs a documented check against them.
AI Literacy After the Digital Omnibus
The Omnibus rewrote Article 4 . Now providers and deployers must take measures to support the AI literacy of staff and others who operate AI on their behalf. Even so, they do not have to guarantee any specific level for any individual.
In practice, that favors role-based training grounded in responsible AI principles over one company-wide course. Keep the training plan, the materials and the attendance records, because those are the evidence.
Transparency Duties for Chatbots and Synthetic Content
Article 50 has applied since August 2, 2026. People must learn they are talking to an AI system unless that is obvious. In addition, generated audio, images, video and text must carry machine-readable marking.
Similarly, deployers that publish deep fakes must disclose that the content was generated or manipulated. Also, synthetic-content systems already on the market before August 2, 2026 have until December 2, 2026 to meet the marking rule.
Output filters from our guide to AI guardrails can enforce these disclosures in production. Our post on generative AI governance also covers the employee-side policies.
AI Assessment
Where Does Your AI Program Stand Today?
Score your AI foundations and governance readiness in a few minutes and find the gaps to close before the EU AI Act high-risk dates.
Start Your AI Assessment → High-Risk Requirements: What Providers Must Prove
The high-risk chapter reads like a quality manual because it largely is one. In practice, each article becomes a control, an owner and a record that someone outside the company can test. The table below maps them in order.
Article Requirement Typical Owner Evidence 9 Risk management system across the lifecycle, from design until retirement Product risk lead Risk register, test results, residual-risk sign-off 10 Data and data governance Data owner Dataset sheets, bias checks, lineage 11 Technical documentation Engineering lead Annex IV file, version history 12 Record-keeping Platform team Automatic event logs, retention settings 13 Transparency and instructions for deployers Product manager Instructions for use 14 Human oversight Process owner Oversight design, override and stop controls 15 Accuracy, robustness and cybersecurity ML and security leads Benchmark and red-team reports 17 Quality management system Compliance lead Written procedures, audit trail 43, 47-49 Conformity assessment, declaration, CE marking, registration Compliance lead Declaration of conformity, EU database entry 72-73 Post-market monitoring and serious-incident reporting Operations lead Monitoring plan, incident log
Two of these rows decide most of the effort. First, data governance under Article 10 depends on data lineage you can actually trace, which is why a working data governance framework often comes first. Second, Article 15 testing draws on the same methods described in our guide to AI red teaming .
Kanerika Service
AI Governance Consulting Services
Kanerika maps each high-risk article to an owner and a dated evidence item, then builds the logs, lineage and documentation that prove it.
Talk to an Expert Conformity Assessment, Registration and Monitoring
Most Annex III providers can assess themselves. Article 43 allows internal control for Annex III points 2 to 8. Biometric systems, however, need a notified body unless harmonized standards or common specifications are fully applied.
Next, the provider issues the EU declaration of conformity, applies the CE marking and registers the system in the EU database before launch. After that, a substantial modification sends it back through assessment.
After release, the post-market monitoring plan forms part of the technical documentation, and the Commission must publish guidance with a template by September 2, 2027. Article 73 requires a serious-incident report immediately once a causal link is established, and in any event within 15 days of becoming aware. That depends on the telemetry covered in our review of AI observability tools .
What Deployers of High-Risk AI Must Do
Buying a high-risk system does not hand the whole compliance burden to the vendor. Article 26 gives deployers a short but concrete list of their own.
Use the system according to the provider’s instructions for use. Assign human oversight to people with the competence, training and authority to intervene. Check that input data you control is relevant and representative for the intended purpose. Monitor operation, and then tell the provider and authorities about risks or serious incidents. Keep the automatically generated logs under your control for at least six months, unless other law sets a different period. Inform workers’ representatives and affected workers before using the system at work. The six-month period is a default minimum that other Union or national law, especially data protection law, can change. For that reason, legal and the platform team should set retention together. Our piece on human-in-the-loop controls for AI agents shows how to build intervention points people actually use.
Fundamental Rights Impact Assessments
In addition, Article 27 adds a fundamental rights impact assessment for public bodies and private entities providing public services. It also covers deployers of credit scoring and of life and health insurance pricing systems. After the Omnibus, a deployer can cross-reference an existing GDPR data protection impact assessment, and the AI Office will supply a questionnaire template.
General-Purpose AI Model Obligations
These rules have applied since August 2, 2025, and they target the companies that build models, not the ones that call them through an API. So an enterprise that adds a third-party model to an internal app is usually a deployer of an AI system, not a model provider.
For actual model providers, Article 53 sets four duties.
First, keep up-to-date technical documentation of the model, including training, testing and evaluation results. Give downstream providers the information they need to integrate the model and meet their own duties. Put in place a policy to comply with EU copyright law, including opt-outs from text and data mining . Finally, publish a sufficiently detailed summary of the training content, using the AI Office template. A model trained with more than 10^25 floating point operations is presumed to carry systemic risk under Article 51 . Such providers must also run documented adversarial testing, using methods like those in our LLM red teaming guide. They must then mitigate systemic risks, report serious incidents and maintain adequate cybersecurity.
In addition, the voluntary General-Purpose AI Code of Practice gives providers a route to show compliance. Specifically, it has three chapters, on transparency, copyright, and safety and security. Models placed on the market before August 2, 2025 have until August 2, 2027 to comply.
EU AI Act Penalties and Who Enforces Them
The fines scale with the seriousness of the breach as well as with company size. Article 99 sets three tiers for operators and Article 101 adds a cap for general-purpose model providers. For large companies, however, the higher of the two figures applies.
Breach Maximum Fine Prohibited practices under Article 5 EUR 35 million or 7% of worldwide annual turnover Most other operator obligations, including high-risk and transparency duties EUR 15 million or 3% of worldwide annual turnover Incorrect, incomplete or misleading information to authorities EUR 7.5 million or 1% of worldwide annual turnover General-purpose AI model providers, fined by the Commission (Article 101) EUR 15 million or 3% of worldwide annual turnover
Smaller companies get the lower of the two figures instead. Specifically, that rule covers SMEs and start-ups, and the Omnibus extended it to small mid-cap companies for the second and third tiers.
National market surveillance authorities enforce most rules, while the Commission’s AI Office handles general-purpose models. Teams with an existing AI governance, risk and compliance program can fold these exposures into the same risk register.
Datasheet
Klara: Document Intelligence and Compliance Agent
See how Klara, Kanerika’s document intelligence and compliance agent, helps enforce your governance playbook across policies, contracts and records.
Download the Datasheet → A Six-Step EU AI Act Compliance Workplan
Like any part of AI governance , the law becomes manageable once each duty has a name and a date next to it. This six-step plan covers the ground in the order the deadlines demand, and each step ends in a record you can hand to an auditor. It also slots into an existing AI auditing framework if you run one.
Step Owner Evidence It Produces Needed By 1. Build the AI inventory CIO or AI governance lead Register of every system with owner and EU exposure Now 2. Assign role and risk tier Legal with product owners Signed classification record per system Now 3. Screen out prohibited uses Legal and compliance Screening checklist, removal decisions Before December 2, 2026 4. Close in-force duties HR, product and marketing Literacy records, AI disclosures, content marking Now 5. Build high-risk evidence packs Engineering, data and risk leads Risk file, Annex IV documentation, logs, conformity declaration December 2, 2027 or August 2, 2028 6. Operate and monitor Operations and compliance Monitoring plan, incident log, change reviews Ongoing
Steps 1 and 2 also set the scope for teams that pursue ISO 42001 certification . The NIST AI RMF Playbook then supplies a method for mapping and measuring risk, and the AI governance framework guide shows where the three overlap. Still, neither framework replaces the law.
Step 5 is where most budgets go, so start with the systems nearest the Annex III date. Then use our AI governance strategy guide to see how to sequence that work across business units.
Kanerika Service
Data Governance Services
Kanerika sets up lineage, classification and retention on Microsoft Purview, so Article 10 and Article 12 evidence comes from the platform, not from spreadsheets.
Talk to an Expert How Kanerika Supports EU AI Act Compliance
For EU AI Act compliance, Kanerika’s AI governance consulting services map your AI systems against the Act’s classification framework. Then we build compliance programs for the systems in scope.
The work follows our IMPACT framework (Identify, Map, Prove, Analyze, Create, Transform). In practice, that means finding governance gaps before they become audit findings and proving controls on the highest-risk systems first. Over time, it also makes governance part of how AI runs day to day rather than a separate program.
Evidence lives in data, so the data layer sets the pace. Our data governance services combine kanGovern, kanGuard and kanComply on Microsoft Purview to give Article 10 traceable lineage. Our MLOps consulting team ties model versions to change control, so a substantial modification never slips past review.
Proof From a Recruitment Build
Recruitment shows what is at stake, because hiring is an Annex III use. For a leading IT solutions provider, Kanerika built an AI resume intelligence platform that ranks candidates by skills and experience. It cut resume screening time by 80%, sped up shortlisting by 45% and raised recruiter productivity by 30%.
The project was about hiring speed and match quality, not EU hiring or AI Act work. Still, it shows the kind of ranking system that would fall under Annex III point 4(a) if used for EU roles. For a system like that, the classification record from the worked example above applies from the first release.
Case Study
80% Faster Resume Screening with AI
Kanerika built a resume intelligence platform with semantic search and candidate ranking, cutting screening time by 80% and shortlisting time by 45%.
Read the Case Study → Where to Start Before the Next Deadline
The bans, AI literacy, transparency and general-purpose AI rules already apply, and two new bans arrive on December 2, 2026. The high-risk dates of December 2, 2027 and August 2, 2028 leave enough time only for teams that start this quarter. For the regulatory map beyond Europe, see our guide to AI compliance across regimes .
So build the inventory, sign the classifications and give each step of your EU AI Act compliance plan an owner.
Frequently Asked Questions
Does the EU AI Act apply to US companies?
Yes. Article 2 covers providers that place AI systems or general-purpose models on the EU market wherever they are based, and non-EU providers and deployers whose AI output is used in the Union. A US company that sells AI to EU customers, or scores EU residents from US servers, needs to classify those systems and meet the duties of its role.
What is the EU AI Act compliance deadline for high-risk AI systems?
After the Digital Omnibus, which entered into force on July 27, 2026, high-risk rules apply to Annex III systems such as hiring, credit scoring and insurance pricing from December 2, 2027. AI used as a safety component in Annex I regulated products, such as machinery or medical devices, follows from August 2, 2028.
Which EU AI Act obligations already apply?
Prohibited practices and the AI literacy duty have applied since February 2, 2025. Obligations for general-purpose AI model providers began on August 2, 2025. Article 50 transparency rules and national enforcement of prohibitions, AI literacy, transparency and general-purpose model rules started on August 2, 2026. Two new bans on harmful synthetic sexual content start on December 2, 2026.
What are the fines for EU AI Act non-compliance?
Article 99 sets three tiers. Prohibited practices can draw up to EUR 35 million or 7% of worldwide annual turnover, most other obligations up to EUR 15 million or 3%, and misleading information to authorities up to EUR 7.5 million or 1%. SMEs, start-ups and, for the lower tiers, small mid-caps pay whichever figure is lower.
How long must deployers keep logs under the EU AI Act?
Article 26 requires deployers of high-risk AI systems to keep the automatically generated logs under their control for at least six months. The period should fit the system’s intended purpose, and other EU or national law, especially data protection law, can set a different period. Financial institutions can keep logs within their existing regulatory documentation.
Who needs a fundamental rights impact assessment?
Article 27 requires one before deployment from public bodies, private entities providing public services, and deployers of high-risk systems used for credit scoring or for life and health insurance risk assessment and pricing. After the Digital Omnibus, a deployer can cross-reference an existing GDPR data protection impact assessment instead of repeating the same analysis.
What does the AI literacy requirement mean after the Digital Omnibus?
Amended Article 4 requires providers and deployers to take measures that support the AI literacy of staff and others operating AI on their behalf, considering their knowledge and the context of use. The text states it does not require them to guarantee any specific level of literacy for any individual, so role-based training with records works well.
Is a company that uses ChatGPT or another foundation model a GPAI provider?
Usually not. General-purpose AI model duties under Article 53 fall on the company that develops a model and places it on the market. An enterprise that calls a third-party model through an API to build an internal tool is typically a provider or deployer of an AI system, with duties set by that system’s risk tier.
Is there an EU AI Act certification?
There is no general EU AI Act certificate for a company. High-risk systems go through a conformity assessment, then carry an EU declaration of conformity and CE marking and get registered in the EU database. Most Annex III systems use internal control, while some biometric systems and Annex I products involve a notified body.
How does ISO 42001 relate to EU AI Act compliance?
ISO/IEC 42001 is a voluntary standard for an AI management system, while the EU AI Act is binding law. Certification to ISO 42001 does not prove legal compliance on its own, but its risk assessments, impact assessments, monitoring and internal audits produce records that support many Act requirements, especially the quality management and risk management duties.
Does the EU AI Act apply in the UK?
The UK is not an EU Member State, so the Act does not apply to purely domestic UK activity. A UK company falls within scope when it places AI systems on the EU market or when the output of its AI system is used in the Union, in the same way as a US or other non-EU company.
