The EU AI Act Compliance Guide: Timeline, Who's Affected & What to Do

The EU AI Act is the world's first comprehensive law for artificial intelligence — and in 2026 it stopped being a future problem. The bans on the riskiest systems are already enforceable, the rules for general-purpose AI models are live, and national regulators now have the power to issue fines that reach into the tens of millions of euros.

Then the goalposts moved. The Digital Omnibus — a simplification package that the Council of the EU gave its final green light on 29 June 2026 — pushed several of the heaviest deadlines back and softened a few edges. Most compliance checklists you'll find online are now out of date.

This guide brings it up to date. It covers the full timeline, who is actually on the hook, how the Act sorts AI into four risk tiers, what each tier has to do, what non-compliance costs, and a practical seven-step plan to get ready.

This is a plain-English explainer for builders and operators — not legal advice. For anything consequential, talk to a qualified lawyer in your jurisdiction.

The compliance timeline at a glance

The Act entered into force on 1 August 2024, but its obligations switch on in waves rather than all at once. Here is where things stand after the Digital Omnibus.

Here are the same milestones in text:

What the Digital Omnibus changed. The original text made high-risk obligations bite in August 2026 (Annex III) and August 2027 (Annex I). Regulators weren't ready — the harmonised technical standards and support tools simply didn't exist — so the Omnibus introduced a "stop-the-clock" mechanism that ties those obligations to the availability of those standards and pushes the dates to 2 December 2027 and 2 August 2028 respectively. It also gave existing systems a four-month grace period on the Article 50 transparency rules (to 2 December 2026) and added two new prohibitions to Article 5: AI "nudifiers" that generate non-consensual intimate imagery, and AI-generated child sexual abuse material.

The headline for planning: the bans and the GPAI rules are already live; the big high-risk compliance lift now lands at the end of 2027, not in 2026.

How the Act classifies AI: four risk tiers

The Act is risk-based. It doesn't regulate "AI" as one thing — it sorts every system into one of four tiers and scales the obligations accordingly.

Unacceptable risk (banned). A short list of practices is prohibited outright: government-style social scoring, systems that manipulate behaviour through subliminal or deceptive techniques, exploitation of the vulnerabilities of children or people with disabilities, untargeted scraping of faces to build recognition databases, emotion recognition in workplaces and schools, most real-time remote biometric identification in public spaces, and — added by the 2026 Omnibus — AI that generates non-consensual intimate imagery or child sexual abuse material. These cannot be sold or used in the EU, full stop. High risk (strictly regulated). AI used in sensitive domains where a bad decision can seriously harm someone: medical devices and other safety components of regulated products (Annex I), plus the Annex III list — biometric identification, critical infrastructure, education and exam scoring, hiring and worker management, access to essential services (credit scoring, insurance, benefits), law enforcement, migration and border control, and the administration of justice. These are legal but carry the full weight of the Act: risk management, data governance, technical documentation, event logging, human oversight, accuracy and cybersecurity, a conformity assessment, and registration in an EU database. Limited risk (transparency). Systems that interact with people or generate content must be honest about it. Chatbots have to tell users they're talking to a machine; AI-generated or manipulated images, audio and video ("deepfakes") must be labelled and carry a machine-readable watermark. That is essentially the whole obligation: disclosure. Minimal risk (unregulated). Everything else — spam filters, recommendation engines, AI in video games, inventory optimisation. This is the vast majority of AI in use, and the Act imposes no mandatory obligations on it, only voluntary codes of conduct.

Who is actually affected?

This is where a lot of people wrongly assume the Act isn't their problem. Two things make its reach very wide: it regulates by role, and it applies extraterritorially.

Providers carry the most obligations. You're a provider if you develop an AI system or a general-purpose AI model and place it on the market or put it into service under your own name or trademark — whether for payment or free. Crucially, if you take an open-source model and fine-tune it, wrap it in a product, or substantially modify a high-risk system, you can become the provider in the eyes of the law. Deployers are organisations that use an AI system under their own authority in a professional context — a bank using an AI credit-scoring tool, a hospital using diagnostic AI, an HR team using an AI CV-screener. Deployers have real duties too, especially for high-risk systems: ensure human oversight, use the system according to instructions, monitor it, and keep logs. Importers and distributors sit in the supply chain. An importer places a non-EU provider's system on the EU market; a distributor makes a system available further down the line. Both must check that the upstream provider did their homework before the product reaches EU users. The extraterritorial catch. You do not have to be in the EU. The Act applies to providers and deployers established anywhere in the world if the output of their AI system is used in the EU. A US SaaS company whose AI feature is used by European customers is in scope.

A few important nuances:

• SMEs and start-ups get proportionate treatment — simplified documentation and the lower of the two fine caps — but they are not exempt.
• Free and open-source models get a partial carve-out from some provider duties, but not when the model carries systemic risk, and not once it is put to a high-risk use or bundled into a commercial service.
• General-purpose AI (GPAI) models — the large foundation models — have their own dedicated regime, layered on top of the tiers above.

What GPAI providers must do (and the systemic-risk overlay)

Because a single foundation model can power thousands of downstream apps, the Act regulates GPAI models directly. Since 2 August 2025, providers of GPAI models must:

• Maintain up-to-date technical documentation of the model and how it was trained and tested.
• Provide information and documentation to downstream developers who integrate the model.
• Put in place a policy to comply with EU copyright law.
• Publish a sufficiently detailed summary of the training data.

Models trained with more than 10²⁵ FLOPs of compute are presumed to carry systemic risk and face extra duties: state-of-the-art model evaluations and adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protection. Providers can meet much of this by signing up to the EU's GPAI Code of Practice.

Running open models yourself? If you self-host an open-weight LLM inside your own product or infrastructure, you need to know whether you're acting as a provider, a deployer, or both — and self-hosting changes what your compliance evidence looks like, because you control the logs, the model version, and the inference path. We go deeper on that in our guide to the EU AI Act and on-premise AI and on open-model licences for business.

What non-compliance costs

The Act has teeth. Fines are calculated as the higher of a fixed euro amount or a percentage of the company's total worldwide annual turnover.

For SMEs and start-ups, the lower of the euro figure and the percentage applies. Fines are assessed per infringement and sit alongside other consequences — products pulled from the market, reputational damage, and civil liability.

What you actually need to do: a 7-step plan

You don't need to boil the ocean. The work is sequential, and most organisations make fast progress by following the same order.

• 1. Inventory — Build a register of every AI system and GPAI model you develop, buy, or use, including the AI features buried inside SaaS tools you already pay for.
• 2. Classify — Map each item to a risk tier. This single step tells you where your obligations, and your exposure, actually are.
• 3. Gap analysis — For each high-risk and limited-risk system, compare what you do today against what the Act requires.
• 4. Governance — Assign a clear owner, write an AI policy, and stand up a risk-management process. Most of the Act is really about being able to show your work.
• 5. Documentation — Assemble the paper trail: technical documentation, data-governance records, and event logs that let you reconstruct how a system behaved.
• 6. Oversight and transparency — Put meaningful human oversight on high-risk systems, and switch on disclosure: label AI interactions and watermark synthetic media.
• 7. Train and monitor — Meet the AI-literacy duty with staff training, and set up post-market monitoring so problems surface before regulators find them.

Start with steps 1 and 2 now. The bans and GPAI rules are already enforceable, and the inventory-plus-classification work is the foundation for everything else — you can't manage risk you haven't mapped.

The bottom line

The Digital Omnibus bought high-risk operators time — the biggest deadlines now land in December 2027 and August 2028 — but it did not change the direction of travel. Prohibited-practice bans and GPAI obligations are live today, transparency duties arrive through 2026, and the extraterritorial reach means "we're not an EU company" is not a defence.

The organisations that will find 2027 easy are the ones that start their inventory and classification in 2026. If you're weighing how self-hosted and open models fit into a defensible compliance posture, our enterprise AI hub and our write-up on privacy-safe document analysis with local LLMs are good next reads.

---

Sources: Regulation (EU) 2024/1689 (the EU AI Act); the European Commission's Digital Omnibus on AI, given final approval by the Council of the EU on 29 June 2026. This article is general information, not legal advice.