The EU AI Act Is Now Enforceable
As of February 2025, the EU AI Act's prohibited practices provisions are in force. By August 2025, the transparency obligations for general-purpose AI models applied. And starting August 2026, the full regulation — including high-risk AI system requirements — becomes enforceable with penalties up to EUR 35 million or 7% of global annual turnover, whichever is higher.
This is not theoretical. The European AI Office is actively setting up enforcement mechanisms. If you deploy or develop AI systems that serve EU citizens, this regulation applies to you — regardless of where your company is headquartered.
Step 1: Classify Your AI Systems by Risk Level
The EU AI Act uses a risk-based framework. Your first task is to classify every AI system your organisation develops, deploys, or uses.
Prohibited (Banned)
These AI practices are banned outright since February 2025:
- Social scoring by governments
- Real-time biometric identification in public spaces (with narrow law enforcement exceptions)
- Emotion recognition in workplaces and educational institutions
- AI systems that manipulate behaviour to cause harm
- Indiscriminate scraping of facial images from the internet or CCTV
High-Risk
Subject to the strictest requirements. Includes AI systems used in:
- Employment: CV screening, interview assessment, performance monitoring, automated hiring/firing decisions
- Credit scoring and insurance: Automated risk assessment that affects access to financial services
- Education: Automated grading, student assessment, admission decisions
- Critical infrastructure: AI systems in energy, water, transport management
- Law enforcement: Predictive policing, evidence evaluation
- Migration and border control: Automated visa assessment, risk profiling
Limited Risk (Transparency Obligations)
AI systems that interact directly with people must be transparent:
- Chatbots must disclose they are AI, not human
- AI-generated content (deepfakes, synthetic media) must be labelled
- Emotion recognition systems (where still permitted) must inform users
Minimal Risk
Most AI systems fall here — spam filters, recommendation engines, search rankings, predictive maintenance. These have no specific obligations under the EU AI Act, but GDPR still applies to any personal data processing.
Step 2: High-Risk AI System Requirements Checklist
If any of your AI systems are classified as high-risk, you must comply with these requirements by August 2026:
Risk Management System (Article 9)
- ☐ Identify and analyse known and foreseeable risks
- ☐ Implement risk mitigation measures
- ☐ Test the AI system against risk scenarios before deployment
- ☐ Document residual risks and communicate them to users
- ☐ Establish continuous risk monitoring post-deployment
Data Governance (Article 10)
- ☐ Document training, validation, and testing datasets
- ☐ Ensure datasets are relevant, representative, and free of errors
- ☐ Assess and mitigate bias in training data
- ☐ Comply with GDPR for any personal data used in training
- ☐ Maintain data provenance records
Technical Documentation (Article 11)
- ☐ Document the AI system's intended purpose and limitations
- ☐ Describe the system architecture and algorithms used
- ☐ Document training methodology and data sources
- ☐ Provide performance metrics on relevant benchmarks
- ☐ Describe the human oversight mechanisms
- ☐ Detail the cybersecurity measures in place
Record-Keeping and Logging (Article 12)
- ☐ Implement automatic logging of AI system operations
- ☐ Logs must be sufficient to trace inputs to outputs
- ☐ Retain logs for a period appropriate to the system's purpose
- ☐ Ensure logs are accessible for regulatory audits
Transparency (Article 13)
- ☐ Provide clear instructions for use to downstream deployers
- ☐ Disclose the AI system's capabilities and limitations
- ☐ Inform users when they are interacting with an AI system
- ☐ Provide contact information for queries about the system
Human Oversight (Article 14)
- ☐ Design the system so humans can effectively oversee its operation
- ☐ Provide mechanisms for human intervention and override
- ☐ Ensure the human overseer can understand the system's outputs
- ☐ Implement a "stop button" — the ability to halt the AI system
Accuracy, Robustness, and Cybersecurity (Article 15)
- ☐ Achieve and maintain appropriate accuracy levels
- ☐ Test resilience against adversarial attacks and data poisoning
- ☐ Implement failsafe mechanisms for errors or inconsistencies
- ☐ Apply cybersecurity controls proportionate to the risk level
Step 3: General-Purpose AI (GPAI) Model Obligations
If you develop or fine-tune foundation models / large language models, additional obligations apply under Article 52+:
- ☐ Publish a sufficiently detailed summary of training data (respecting trade secrets)
- ☐ Comply with EU copyright law, including the text and data mining opt-out
- ☐ Draw up and maintain technical documentation
- ☐ For GPAI models with systemic risk (>10^25 FLOPs training compute): conduct model evaluations, adversarial testing, track and report serious incidents, ensure adequate cybersecurity
For most companies deploying third-party LLMs (via API from Anthropic, OpenAI, Google, etc.): you are a deployer, not a provider of the GPAI model. Your obligations focus on how you use the model in your application, not on the model itself. However, if you fine-tune a model, you may become a provider with additional obligations.
Step 4: Technical Implementation Checklist
Translating regulatory requirements into engineering tasks:
// Example: AI system logging for EU AI Act compliance
interface AIAuditLog {
requestId: string;
timestamp: Date;
systemId: string;
systemVersion: string;
inputData: {
raw: string; // Original input (redact PII if needed)
preprocessed: string; // Input after preprocessing
};
modelInfo: {
provider: string; // e.g., "anthropic"
model: string; // e.g., "claude-sonnet-4-20250514"
version: string;
};
output: {
raw: string; // Raw model output
postprocessed: string; // Output after guardrails/filtering
confidence?: number; // If applicable
};
humanOversight: {
required: boolean;
reviewedBy?: string;
reviewedAt?: Date;
decision?: "approved" | "rejected" | "modified";
};
metadata: {
latencyMs: number;
tokensUsed: number;
costEur: number;
guardrailsTriggered: string[];
};
}Step 5: Ongoing Compliance Operations
- Quarterly bias audits: Re-evaluate your AI systems for discriminatory outcomes across protected characteristics
- Annual risk reassessment: Review and update your risk management documentation
- Incident reporting: Establish a process for reporting serious incidents to national authorities within the required timeframe
- Model update governance: When the underlying AI model is updated (new GPT version, new Claude version), re-run your evaluation suite and update documentation
Penalties for Non-Compliance
| Violation Type | Maximum Fine |
|---|---|
| Prohibited AI practices | EUR 35M or 7% global turnover |
| High-risk system non-compliance | EUR 15M or 3% global turnover |
| Incorrect information to authorities | EUR 7.5M or 1.5% global turnover |
For SMEs and startups, the fines are proportionally lower but still significant.
Get Compliant Before the Deadline
The August 2026 enforcement deadline for high-risk systems is approaching. If you need help classifying your AI systems, implementing technical controls, or preparing documentation, our AI consulting team runs a structured EU AI Act compliance programme. Book a free compliance assessment to understand your exposure and build a remediation roadmap.