JOURNAL / EUROPEAN AI POLICY · UPDATED 22 OCTOBER 2026

The EU AI Act,
translated for AI teams.

The Act does not impose one identical checklist on every model. The rules depend on what an AI system is intended to do, who provides or deploys it, and when each provision applies. Here is a practical map based on the current official timeline.

European Union flags outside a modern glass building in Brussels. — A REGULATION IS A MAP OF RESPONSIBILITIES
Start with the system, its use, and the people affected.
The same underlying model can be part of different products and decisions. The Act’s obligations follow the system’s intended purpose and the role an organisation plays around it.

01 / NOT ONE RULE FOR EVERY MODEL

The Act regulates uses and responsibilities—not just model size.

The EU AI Act is Regulation (EU) 2024/1689. Its risk-based framework includes prohibited practices, requirements for certain high-risk AI systems, transparency duties for specific uses, and obligations for providers of general-purpose AI (GPAI) models. Those are different parts of the law, with different operators and dates.

High-risk classification depends on intended purpose and how a system is used. The Act identifies high-risk AI in two broad situations: an AI system is a safety component of a product covered by specified EU product laws, or it is intended for one of the listed Annex III use cases. Examples include certain systems for hiring, education, essential services, critical infrastructure, biometrics, law enforcement, migration, and justice. Being an AI model—or being used in a broad sector—does not by itself settle the classification.

Start by describing the actual system and decision: what it outputs, who relies on it, and what happens to the people affected. The European Commission’s classification FAQ ↗ explains the intended-purpose test and examples.

02 / WHO IS RESPONSIBLE?

Trace the role each organisation plays in the system.

ProviderAn organisation that develops an AI system—or has it developed—and places it on the market or puts it into service under its name or trademark.

DeployerAn organisation that uses an AI system under its authority in a professional setting. Using a hosted model inside a product can make the system’s provider and the model provider different parties.

GPAI model providerA provider of a general-purpose model has a separate set of duties under the Act. Those duties do not automatically become the same duties for every downstream customer.

System and modelA model can be one component inside a larger AI system. The product’s purpose, interface, data, workflow, and human decisions can all matter to its classification.

Write down who selects the intended purpose, integrates the model, presents the system to people, and makes the consequential decision. Then check the Act’s definitions for the exact situation. For the model-provider side, our guide to copyright and AI training transparency ↗ explains the Act’s training-content summary requirement.

Tool-using AI agents are assessed through the same system and model roles; the label “agent” does not create a separate category. Read how the EU AI Act applies to agent systems ↗.

03 / THE OFFICIAL TIMELINE

Several dates apply. The high-risk schedule changed in 2026.

The AI Act entered into force on 1 August 2024. Regulation (EU) 2026/1744—the Digital Omnibus on AI—later amended the implementation timeline. As of 22 October 2026, the European Commission lists these key application dates:

2 February 2025 — first provisions. The definitions, first eight prohibited practices, and Article 4 AI literacy obligation began to apply. Article 4 was amended in July 2026: providers and deployers must take measures to support AI literacy, but do not have to guarantee a specific level for every individual.
2 August 2025 — governance and GPAI. Governance provisions and obligations for providers of general-purpose AI models began to apply.
2 August 2026 — general application and enforcement. The Act’s general application date arrived, and the AI Office and national authorities began supervising and enforcing provisions then in scope. Article 50 transparency duties also apply, subject to the Regulation’s specific rules and exceptions.
2 December 2026 — new prohibitions and a transition deadline. The Article 5 prohibitions covering AI systems that generate non-consensual intimate material or child sexual abuse material begin to apply. Providers of certain AI systems that generate synthetic content, already placed on the market before 2 August 2026, have until this date to meet Article 50(2)’s machine-readable marking requirements.
2 August 2027 — earlier GPAI models and national sandboxes. Providers of general-purpose AI models placed on the market before 2 August 2025 must take the necessary steps to comply by this date. Each Member State must also have at least one AI regulatory sandbox in operation.
2 December 2027 — Annex III high-risk systems. The high-risk obligations for listed use cases such as certain employment, education, infrastructure, and biometric systems apply from this date.
2 August 2028 — Annex I product systems. The corresponding high-risk obligations for AI systems covered as safety components of regulated products apply from this date.

Article 111 has separate transition rules for systems already on the market. In general, a pre-existing high-risk AI system comes under the Act if it undergoes a significant design change after the relevant application date. High-risk systems intended for use by public authorities have an outside compliance date of 2 August 2030; specified large-scale IT systems have a date of 31 December 2030. Check Article 111’s conditions ↗ for the system in question.

The later high-risk dates do not postpone every AI Act duty. The two December 2026 dates are also different: one starts new prohibitions, while the other is a transition deadline for providers of certain systems already on the market. Content generated before 2 August 2026 does not have to be labelled retroactively. The AI Act Service Desk timeline ↗, the Commission’s AI Act implementation page ↗, and the amending Regulation ↗ provide the current schedule.

04 / TRANSPARENCY AND LITERACY

Some obligations already concern the experience people see.

Article 50 sets four kinds of duties, plus a shared rule for how people receive notices. The obligation depends on whether an organisation provides an AI system or deploys it in a professional context.

Provider · direct interactionDesign a directly interactive system so people know they are interacting with AI, unless that is obvious in context (Article 50(1)).

Provider · generated outputMake certain AI-generated or manipulated synthetic audio, images, video, and text machine-readable and detectable (Article 50(2)).

Deployer · exposed peopleInform people exposed to emotion-recognition or biometric-categorisation systems (Article 50(3)).

Deployer · published contentDisclose qualifying deepfakes and label some AI-generated or manipulated public-interest text unless it has received human review or editorial control and a person holds editorial responsibility (Article 50(4)).

Shared rule · notice designNotices under these duties must be clear, distinguishable, and accessible, and arrive no later than the first interaction or exposure (Article 50(5)).

A machine-readable mark and a visible notice do different jobs. An embedded provider mark alone does not replace a deployer’s clear disclosure when people encounter a deepfake.

The Commission’s 2026 Article 50 guidelines ↗ and questions and answers ↗ define the scope and exceptions. For the text exemption, substantive human review or editorial control must come with a natural or legal person who holds editorial responsibility; proofreading or spell-checking alone does not qualify. Artistic, creative, satirical, or fictional deepfakes have a narrower disclosure requirement that should not disrupt the work.

The Commission-reviewed, voluntary Code of Practice on AI-generated content ↗ offers a route for showing how marking and labelling obligations are met. Organisations using another method must demonstrate adequate compliance.

There is a limited transition for Article 50(2): providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to take the necessary steps to meet the marking and detection requirement. It does not extend the other Article 50 duties, and it does not require old content to be labelled retroactively.

AI literacy is a separate part of the framework. Article 4 requires providers and deployers to take measures that support the development of AI literacy among staff and others who operate or use systems on their behalf. Those measures should account for people’s knowledge and experience, the system’s context, and the people affected by its use. The amended text does not mandate a specific or “sufficient” level for each person.

The Commission recommends mapping an organisation’s role, the systems it provides or deploys, and their risks before choosing guidance or training for different groups. Article 4 does not prescribe one course format, a knowledge test, a certificate, or a particular governance structure; organisations can keep an internal record of their measures. That flexibility still leaves an obligation to take measures. Separate training duties for staff overseeing high-risk systems remain in force. See the Commission’s AI literacy questions and answers ↗ and our guide to AI literacy at work ↗.

Transparency is not the same as proving an output is true, and literacy is not a substitute for risk controls. Keep disclosure, factual verification, security testing, and human oversight as distinct parts of a system’s design.

05 / A PRACTICAL FIRST PASS

Turn the regulation into a reviewable system map.

Inventory the system. Record the product boundary, model providers, inputs, outputs, connected tools, and intended purpose.
Identify the operator roles. Determine who is provider, deployer, model provider, importer, or distributor for the use in question.
Screen the intended use. Check prohibited-practice provisions first, then the relevant Annex I or Annex III categories and their conditions.
Map obligations to owners and dates. Track applicable transparency, documentation, oversight, risk-management, and GPAI duties without mixing their timelines.
Keep evidence current. Save the rationale, source version, system changes, and the tests used to review behavior.

The Commission’s AI Act Compliance Checker ↗ can help identify which rules may apply to a system. The Commission labels it a beta tool; use it as an orientation to the official text, not as an automatic classification decision.

For related engineering practice, continue with AI red teaming ↗, system evaluation ↗, and content provenance ↗.

KEEP LEARNING

Regulation starts with precise descriptions of real systems.

Before asking whether an AI system is “compliant,” define its purpose, its users, its data path, and the people affected by its decisions. Then trace the legal role and obligations attached to that specific use. Explore the broader AI field guide ↗ or read how teams turn intended behavior into tests ↗.

The EU AI Act,translated for AI teams.

Start with the system, its use, and the people affected.