The EU AI Act: which obligations are already in force, and which are still ahead

Most coverage of the EU AI Act treats it as a single event. It is not. The Regulation entered into force on 1 August 2024 and then switched its duties on in tranches, each aimed at a different group. Reading the timetable is the fastest way to work out whether it currently affects you.

The staged timetable

Two caveats before you plan against this. First, transitional provisions treat systems already on the market differently from new ones. Second, the timetable has been the subject of active political debate about simplification and delay; the Regulation's own dates are the baseline, but implementing acts, harmonised standards and guidance continue to arrive. Check the Commission's implementation page rather than trusting a summary — including this one — that may have aged.

The four risk tiers

Unacceptable risk — banned. Social scoring by public authorities, manipulative techniques that materially distort behaviour and cause harm, untargeted scraping of facial images to build recognition databases, emotion inference in workplaces and schools, and — with narrow, authorised exceptions — real-time remote biometric identification in public spaces for law enforcement.

High risk — permitted, heavily conditioned. Two routes in: AI listed in Annex III (biometrics, critical infrastructure, education, employment, essential public and private services, law enforcement, migration, administration of justice), or AI acting as a safety component of a product already regulated under EU law. High-risk systems require a risk management system, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity measures, a conformity assessment, and registration.

Limited risk — transparency. People must be told they are interacting with an AI system unless it is obvious. Synthetic image, audio and video content must be marked in a machine-readable way, and deepfakes disclosed. This tier catches far more everyday products than the high-risk tier does, and it is the one most consumer-facing teams underestimate.

Minimal risk. Everything else. No obligations.

General-purpose models sit in their own track

GPAI providers face a separate set of duties: technical documentation, information for downstream providers who build on the model, a policy for complying with EU copyright law, and a sufficiently detailed public summary of training content. Models judged to present systemic risk carry additional duties — model evaluation, adversarial testing, incident reporting and cybersecurity protection.

The Commission's General-Purpose AI Code of Practice is the intended route to demonstrating compliance for this tier. It is voluntary in form; signing it is meant to reduce administrative burden relative to proving compliance some other way.

Anyone building on top of a general-purpose model should note the downstream effect: if the base model provider does not hand you the documentation you need, your own compliance story has a hole in it. That is a procurement question to raise before signing, not after.

Roles, not companies

The Act allocates duties by role, and a single organisation frequently holds more than one:

• Provider — develops a system, or has one developed, and places it on the market under its own name or trademark.
• Deployer — uses a system under its own authority in a professional context.
• Importer and distributor — place a third-party system on the EU market or make it available.

The provision that catches people: a deployer who puts their own name on a high-risk system, or substantially modifies it, or changes its intended purpose, becomes a provider for the purposes of the Regulation, with the full high-risk obligation set attached. Fine-tuning a model and shipping it as your own feature is exactly the kind of act that can trigger this.

What to do in the next quarter

For most organisations the honest first step is an inventory — what AI is in use, who supplied it, what it decides, and which role you hold for each system. Very few teams can answer that today, and none of the rest of the compliance work can start without it.

After that, in rough priority order: check nothing you operate falls in the prohibited list; satisfy the AI-literacy duty for staff who work with these systems; determine whether any use case lands in Annex III; implement the transparency markings for chatbots and generated media; and, if you build on a general-purpose model, obtain the provider's documentation in writing.

The Act rewards organisations that know what they are running. That is unglamorous, and it is where the work is.