EU AI Act explained: risk levels, deadlines and what organizations must do

A practical guide for professionals

Artificial intelligence is now part of everyday business, from recruitment tools and credit decisions to customer chatbots and content generation.

With that growth, the European Union has introduced the world’s first comprehensive law for artificial intelligence: the EU AI Act.

For organizations that build, sell, or use AI in the EU, the AI Act is quickly becoming as important as the GDPR became for personal data.

This guide explains what the EU AI Act is, how its risk-based approach works, which deadlines apply, and what organizations should be doing now.

What is the EU AI Act?

The EU AI Act, formally Regulation (EU) 2024/1689, is a European regulation that sets harmonized rules for the development, placing on the market, and use of AI systems in the European Union.

It entered into force on 1 August 2024 and applies in stages, so different obligations take effect at different times.

Its aim is to make sure AI used in the EU is safe, transparent, and respectful of fundamental rights, while still supporting innovation.

Like the GDPR, the AI Act has a broad reach. It can apply to organizations outside the EU when they place AI systems on the EU market or when the output of their AI systems is used in the EU.

Who does the EU AI Act apply to?

The AI Act assigns obligations according to an organization’s role in the AI value chain. The main roles are:

• Providers – organizations that develop an AI system or have it developed and place it on the market under their own name.
• Deployers – organizations that use an AI system under their authority in a professional context.
• Importers and distributors – organizations that bring AI systems into the EU market or make them available.
• Product manufacturers – organizations that integrate AI into products covered by EU product legislation.

Many organizations are deployers without realizing it. If your HR team uses an AI tool to screen candidates, your organization is likely a deployer of an AI system, and the Act may apply to that use.

The risk-based approach

The core idea of the EU AI Act is simple: the higher the risk an AI system poses, the stricter the rules.

Unacceptable risk – prohibited practices

Some AI practices are banned outright. These include, for example:

• Manipulative or deceptive techniques that cause significant harm
• Exploiting the vulnerabilities of specific groups
• Social scoring that leads to unjustified or disproportionate treatment
• Untargeted scraping of facial images to build facial recognition databases
• Emotion recognition in workplaces and educational institutions, with limited exceptions
• Real-time remote biometric identification in public spaces for law enforcement, except in narrowly defined cases

High risk

High-risk AI systems are allowed, but they must meet strict requirements before and after they reach the market. They fall into two groups:

• AI used as a safety component of products already regulated by EU law (Annex I), such as medical devices or machinery
• AI used in sensitive areas listed in Annex III, such as recruitment and employee management, education, access to essential services like credit, and law enforcement

Transparency risk

Some AI systems carry specific transparency duties. People should know when they are interacting with a chatbot, and AI-generated or manipulated content, such as deepfakes, must be identifiable as such.

Minimal risk

Most AI systems, such as spam filters or AI in video games, fall into this category and face no new mandatory obligations, although voluntary codes of conduct are encouraged.

General-purpose AI models

The Act also includes rules for providers of general-purpose AI models, such as large language models, covering technical documentation, copyright policies, and additional obligations for models with systemic risk.

Key EU AI Act deadlines

The AI Act applies in phases. In July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) adjusted several dates, most notably for high-risk systems. The main milestones are:

• 2 February 2025 – prohibited practices and AI literacy measures apply
• 2 August 2025 – rules for general-purpose AI models, governance, and penalties apply
• 2 August 2026 – most transparency obligations apply
• 2 December 2026 – new prohibitions on AI generating non-consensual intimate imagery and child sexual abuse material apply
• 2 December 2027 – obligations for high-risk AI systems listed in Annex III apply
• 2 August 2028 – obligations for high-risk AI embedded in products covered by Annex I apply

The postponement gives organizations more time, but it is not a reason to wait. Building governance, inventories, and documentation for high-risk AI takes many months.

What high-risk AI requires

Providers of high-risk AI systems must, among other things:

• Establish a risk management system across the AI life cycle
• Apply data governance to training, validation, and testing data
• Prepare technical documentation and keep logs
• Provide clear instructions for use to deployers
• Design systems for effective human oversight
• Ensure appropriate accuracy, robustness, and cybersecurity
• Operate a quality management system, complete a conformity assessment, and carry out post-market monitoring

Deployers also have duties. They must use systems according to the instructions, assign human oversight to competent people, monitor operation, and keep logs. Certain deployers, such as public bodies, must also carry out a fundamental rights impact assessment.

What are the penalties?

Fines under the AI Act are significant. For prohibited practices, they can reach €35 million or 7% of worldwide annual turnover, whichever is higher. Most other breaches can lead to fines of up to €15 million or 3%, and supplying incorrect information to authorities up to €7.5 million or 1%. Lower caps apply to SMEs and start-ups.

How organizations can prepare

A practical starting point for most organizations looks like this:

• Build an AI inventory – identify every AI system you develop, buy, or use.
• Classify each system – determine its risk category and your role as provider or deployer.
• Assign responsibility – define who owns AI governance and compliance.
• Invest in AI literacy – make sure the people who operate and oversee AI understand it.
• Set up governance processes – risk management, documentation, human oversight, and supplier management.
• Monitor developments – guidelines, harmonized standards, and codes of practice continue to be published.

The EU AI Act and ISO/IEC 42001

The AI Act sets legal requirements. ISO/IEC 42001, the international standard for AI management systems, provides a structured way to govern AI inside an organization.

The two work well together. An AI management system based on ISO/IEC 42001 can give organizations the policies, roles, risk processes, and continual improvement needed to support AI Act compliance, although certification against ISO/IEC 42001 does not by itself demonstrate legal compliance.

Training paths for the EU AI Act

Professionals can build EU AI Act expertise through several PECB training paths available at MIC:

Certified EU AI Governance Professional

This course focuses directly on the EU AI Act. It covers how the Act applies to an organization’s AI systems and roles, how to plan an AI governance and compliance framework alongside the EU Data Act, and how to manage AI risks, data governance, documentation, and human oversight across the AI life cycle.

It is particularly relevant to compliance officers, legal and privacy professionals, risk managers, and anyone responsible for AI governance.

ISO/IEC 42001 Lead Implementer

For professionals who need to build the management system behind AI governance, this course develops the competence to establish, implement, maintain, and continually improve an AI management system.

Certified Artificial Intelligence Security Professional

Cybersecurity is one of the requirements for high-risk AI. This course covers AI threats, security controls, and how to design an AI security program.

Start your EU AI Act learning journey with MIC

The EU AI Act is changing how organizations design, buy, and use artificial intelligence. Professionals who understand it are becoming increasingly valuable to employers and clients.

My ISO Certification (MIC) provides access to official PECB training, with study materials, the exam, and the certification application fee included.

Ready to become an EU AI governance professional?

Explore the Certified EU AI Governance Professional course and take the next step toward building your expertise in AI regulation and governance.

---