The EU AI Act in Plain English: What Actually Ships and When

Ask a compliance team whether their organization is ready for the EU AI Act and watch the pause. Not because they don't care, but because the regulation is 144 pages of legal text, the timeline keeps shifting, and the gap between "we've read the summary" and "we can prove compliance on demand" is measured in months of work nobody has started.

Here's the operational reality: the EU AI Act is already partially in force. Some obligations landed in February 2025. Others arrive in December 2026. The big high-risk deadlines just got pushed to late 2027 and 2028. But treating that extension as breathing room is a mistake. The teams that will survive enforcement are the ones building systems now, not the ones planning to panic later.

This is the plain-English breakdown: what the regulation actually requires, who it applies to, and what needs to happen before the deadlines hit.

The Risk Tiers That Determine Everything

The EU AI Act sorts AI systems into four risk categories. The category determines the compliance burden.

Unacceptable risk means banned outright. Nine practices are prohibited, including social scoring systems, real-time biometric identification in public spaces for law enforcement, emotion recognition in workplaces and schools, and AI that manipulates behavior in harmful ways. These prohibitions have applied since 2 February 2025. If an organization is running any of these systems in the EU, they're already in violation.

High risk is where most of the regulatory weight lands. This covers AI used in hiring, credit scoring, education, law enforcement, critical infrastructure, and medical devices. High-risk systems face mandatory requirements: risk management systems, data governance, technical documentation, human oversight, accuracy and robustness standards, and registration in an EU database.

Limited risk triggers transparency obligations. Chatbots must disclose they're AI. Deepfakes and synthetic content must be labeled. Users need to know when they're interacting with a machine.

Minimal risk is largely unregulated. Spam filters, recommendation engines for entertainment, and similar low-stakes applications face no mandatory requirements.

The classification isn't always obvious. A CV-scanning tool that ranks job applicants is high-risk. A chatbot answering customer service questions is limited-risk. The same underlying model could fall into different categories depending on how it's deployed.

Who the Regulation Actually Covers

The extraterritorial reach mirrors GDPR. The AI Act applies to:

Providers (developers) of AI systems placed on the EU market or put into service in the EU, regardless of where the company is headquartered. A San Francisco startup selling AI tools to German customers is covered.

Deployers (organizations using AI in professional contexts) located in the EU, or located elsewhere but using AI systems whose output affects people in the EU.

Importers and distributors bringing AI systems into the EU market.

The key distinction: providers carry the heaviest obligations. They're responsible for conformity assessments, technical documentation, and ensuring the system meets requirements before it reaches the market. Deployers have lighter but still significant duties: human oversight, monitoring, and ensuring the system is used as intended.

The Timeline That Actually Matters

The Digital Omnibus agreement reached in May 2026 reshuffled the deadlines. Here's what's already in force and what's coming:

Already enforceable (since February 2025): Prohibitions on unacceptable-risk AI practices.

Already enforceable (since August 2025): Obligations for general-purpose AI model providers, including technical documentation requirements and copyright compliance.

December 2026: Transparency obligations for limited-risk systems. New prohibition on non-consensual intimate imagery generated by AI.

December 2027: Compliance deadline for high-risk standalone systems listed in Annex III (recruitment, credit scoring, education, law enforcement, and similar use cases). This was originally August 2026.

August 2028: Compliance deadline for AI embedded in regulated products under Annex I (medical devices, machinery, vehicles).

The extension for high-risk systems is not a free pass. Organizations still need to build the infrastructure for compliance: model inventories, risk classification processes, documentation systems, and audit trails. That work takes 12 to 18 months for most enterprises. Starting in late 2027 means missing the deadline.

General-Purpose AI: The Rules for Foundation Models

The Act creates a separate regime for GPAI (General-Purpose AI) models, the foundation models that power downstream applications. All GPAI providers must:

• Provide technical documentation to the AI Office and national authorities on request
• Supply information and documentation to downstream AI system providers
• Comply with the Copyright Directive
• Publish a summary of training data content

GPAI models presenting "systemic risk" face additional requirements: model evaluations, risk assessments and mitigations, serious incident tracking and reporting, and cybersecurity protections.

Open-source GPAI models get a lighter touch. They only need to comply with copyright law and publish the training data summary, unless they present systemic risk.

The Penalty Structure

The fines exceed GDPR. The most serious violations (prohibited practices) can reach €35 million or 7% of global annual turnover, whichever is higher. GDPR's maximum is €20 million or 4%.

For high-risk system violations, penalties can reach €15 million or 3% of turnover. For providing incorrect information to authorities, €7.5 million or 1% of turnover.

SMEs and startups get proportionate penalties, but "proportionate" still means significant.

What Compliance Actually Requires

For high-risk systems, the practical requirements break down into seven areas:

Risk management: Establish a system to identify, analyze, and mitigate risks throughout the AI system's lifecycle. This isn't a one-time assessment. It's continuous.

Data governance: Training, validation, and testing datasets must meet quality criteria. Bias detection and mitigation processes must be documented.

Technical documentation: Detailed records of system design, development, and testing. Enough information for authorities to assess compliance.

Record-keeping: Automatic logging of system operation. Audit trails that can be reviewed.

Transparency: Clear instructions for deployers. Information about system capabilities and limitations.

Human oversight: Design the system so humans can effectively oversee its operation. This means interpretable outputs and intervention mechanisms.

Accuracy, robustness, and cybersecurity: The system must perform as intended and resist manipulation.

The Protiviti guide emphasizes that transparency and explainability run through the entire regulation. If the decision can't be explained to the user, it can't be shipped.

The Implementation Gap Nobody Wants to Discuss

Most organizations can't answer basic questions about their AI systems: How many models are in production? What risk category does each fall into? Where's the documentation? Who approved deployment?

Model inventories live in spreadsheets. Approvals run through email. Risk classifications get assigned once and drift out of date. The gap between "we have AI governance" and "we can prove compliance on demand" is where enforcement will hurt.

The teams that will navigate this well are treating compliance as infrastructure, not a periodic audit. That means a single system of record for AI assets, automated documentation, continuous monitoring, and clear ownership for every system in production.

The EU AI Act isn't going away. The question is whether organizations build the systems to comply before the deadlines hit, or scramble afterward when the fines start landing.

For ongoing coverage of how European AI governance is evolving in practice, the Human × AI Europe Content Hub tracks the implementation details that matter.