The EU AI Act,
explained plainly

The EU AI Act is Regulation (EU) 2024/1689 — the first comprehensive law anywhere to regulate artificial intelligence. It entered into force on 1 August 2024 and takes a risk-based approach: rather than treating all AI the same, it sorts systems by the risk they pose to health, safety and fundamental rights, and scales the obligations accordingly. The riskier the use, the heavier the duties; some uses are banned outright.

It is important to be precise about what kind of instrument this is, because the language around it is often misused. The EU AI Act is a law, not a standard you certify against. There is no "EU AI Act certificate" to hang on the wall. Where the regulation requires it, for high-risk systems, you carry out a conformity assessment and affix CE marking, the same mechanism the EU already uses for regulated products. Throughout, the right words are "comply" and "conformity", not "get certified".

As a regulation rather than a directive, it applies directly across all EU member states without needing to be transposed into national law. Its reach is also extraterritorial: it can apply to providers and deployers outside the EU, including Swiss and other non-EU companies, when their AI systems are placed on the EU market or their output is used within the Union.

The whole regulation hangs on a single idea: classify each AI system by risk, then apply obligations proportionate to that risk. There are four tiers, and almost everything else in the law follows from which one your system falls into.

Unacceptable risk sits at the top: a short list of practices considered a clear threat to fundamental rights, which are prohibited entirely. Below that, high-risk covers specific listed use cases and AI used as a safety component of regulated products; these carry the bulk of the regulation’s obligations. Limited risk applies to systems that interact with people or generate content, and owes mainly transparency duties. Minimal risk, the vast majority of AI in everyday use, carries no obligations under the Act at all.

High-risk is where the EU AI Act has real weight. A system is high-risk in two broad situations: when it is used in one of the areas the regulation lists in Annex III, such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, or the administration of justice, or when it serves as a safety component of a product already covered by EU product-safety law.

For these systems the regulation sets out a substantial set of obligations. You must operate a risk management system across the lifecycle, apply data governance to the data your system is trained and tested on, maintain technical documentation and automatic record-keeping (logging), provide transparency and clear information to deployers, design for human oversight, and meet appropriate levels of accuracy, robustness and cybersecurity.

Those obligations are not a one-time deliverable. They describe a system you keep running: documentation that stays current, logs that keep flowing, oversight that is actually exercised. They are what a conformity assessment ultimately tests. Most of the work of EU AI Act readiness for a high-risk system is building and maintaining this evidence over time.

At the top of the risk pyramid is a category that is not regulated but banned. These are AI practices the EU considers an unacceptable threat to people’s rights and safety, and placing them on the market or putting them into service is prohibited outright.

The list includes practices such as social scoring by public authorities, certain manipulative or deceptive techniques that materially distort behaviour and cause harm, exploitation of vulnerabilities of specific groups, untargeted scraping of facial images to build recognition databases, and certain uses of biometric categorisation and real-time remote biometric identification — each defined with specific conditions and narrow exceptions in the text. Because the boundaries are precise, the prohibitions are worth reading against your actual use case rather than from memory.

The prohibitions were the first part of the regulation to bite: the bans on these practices have applied since 2 February 2025, ahead of the high-risk obligations. For most teams the prohibited list is a quick check rather than ongoing work — but it is a check worth doing early, because the consequences of crossing it are the most severe in the whole regulation.

The EU AI Act treats general-purpose AI models, the large, broadly capable models that can be adapted to many tasks, as a category of their own, separate from the risk-tier classification applied to AI systems. Providers of GPAI models carry their own set of obligations regardless of how any downstream system built on them is classified.

For all GPAI models, providers must maintain technical documentation, provide information to the downstream providers who integrate the model into their own systems, put a policy in place to respect EU copyright law, and publish a sufficiently detailed summary of the content used to train the model. Where a model is judged to pose systemic risk (broadly, the most capable, highest-impact models), additional duties apply, including model evaluation, assessment and mitigation of systemic risks, incident tracking and reporting, and heightened cybersecurity protection.

These obligations began applying on 2 August 2025, ahead of most high-risk system obligations. If you train or fine-tune your own general-purpose model, this part of the regulation applies to you directly; if you only build on someone else’s model, the relevant questions are which obligations they have met and what information they pass downstream to you.

The EU AI Act assigns obligations by role, so the first thing to settle is which role you play for a given system — because the same system can make you a provider in one situation and a deployer in another. The two central roles are providers and deployers, with importers and distributors carrying their own lighter duties in the supply chain.

A provider develops an AI system (or has one developed) and places it on the market or puts it into service under its own name or trademark. Providers carry the heaviest load, especially for high-risk systems: building the risk management, documentation and quality measures, running the conformity assessment and affixing CE marking. A deployer uses an AI system under its own authority — for example, a company using a high-risk hiring tool. Deployers owe a narrower but real set of duties: using the system in line with its instructions, ensuring human oversight, monitoring its operation, and keeping the logs it generates.

Getting the role right is foundational, because a wrong answer here cascades through everything else. In particular, certain actions, such as substantially modifying a high-risk system or putting your own name on it, can turn a deployer into a provider and pull the full provider obligations along with it.

The EU AI Act does not arrive all at once. It entered into force on 1 August 2024, but its obligations switch on in phases, so the deadline that matters to you depends entirely on what kind of AI you build or use.

The prohibitions on unacceptable-risk practices applied first, from 2 February 2025. The obligations on general-purpose AI models followed, from 2 August 2025. Most of the high-risk obligations apply from 2 August 2026, and a further set, covering certain high-risk AI systems that are embedded as safety components in products already regulated under EU product-safety law, applies from 2 August 2027.

The practical implication is that "are we ready for the EU AI Act?" is not a single yes or no. It depends on which systems you operate and which tier each one sits in. The sooner you classify your AI portfolio, the sooner you know which of these dates is actually yours — and how much runway you have to meet it.

For high-risk AI systems, demonstrating compliance runs through conformity assessment — the EU’s established route for showing a product meets its legal requirements before it reaches the market. Depending on the type of system, this is done either through an internal assessment carried out by the provider itself, or with the involvement of a notified body (an independent third party), with the route set by the regulation rather than chosen freely.

Once a high-risk system passes conformity assessment, the provider draws up an EU declaration of conformity, affixes CE marking, and, where required, registers the system in the EU database for high-risk systems. CE marking signals that the system meets the applicable EU requirements, the same mark already used across regulated products. This is the closest the EU AI Act comes to a "certificate", and it is deliberately not the same thing: it is a self-affixed (or notified-body-supported) declaration backed by the documentation behind it, not a badge issued by a certification body.

Harmonised standards play a quiet but central role here. Conformity to certain harmonised standards, including work aligned with ISO/IEC 42001, can grant a presumption of conformity with the corresponding requirements, which is why an AI management system is such a practical foundation: it produces much of the evidence the assessment expects to see.

These two are often mentioned in the same breath, and it helps to be clear on how they differ. The EU AI Act is a binding law with legal obligations and penalties; ISO/IEC 42001 is a voluntary international management-system standard, the AI counterpart to ISO 27001 for information security, that you can certify against. One is something you must comply with; the other is something you choose to adopt.

They are complementary rather than competing. ISO/IEC 42001 gives you an AI management system: a structured, auditable way to govern how AI is developed and used across the organization, with risk management, documentation and oversight built in. That is precisely the machinery the EU AI Act expects a high-risk provider to run, which is why an ISO 42001 management system is a practical way to operationalise EU AI Act readiness — and why harmonised standards aligned with it can support a presumption of conformity.

In short: ISO 42001 will not, by itself, make you compliant with the EU AI Act, because the law has specific requirements the standard does not exactly mirror. But it is one of the most direct ways to build the governance, evidence and discipline that compliance demands.

The EU AI Act backs its obligations with significant penalties, tiered to the severity of the breach. The heaviest fines are reserved for breaching the prohibitions on unacceptable-risk practices: up to €35 million or 7% of total worldwide annual turnover, whichever is higher.

Lower ceilings apply to other breaches — for example, fines for non-compliance with most other obligations are capped at a lower level, with a further, lower tier for supplying incorrect, incomplete or misleading information to authorities. The structure mirrors GDPR’s turnover-based approach, and the message is the same: classification and compliance are not paperwork exercises, because the downside is sized to the global business, not the local one.