The EU AI Act Explained: Risk Categories, Timeline and Penalties

Executive summary

The EU AI Act — formally Regulation (EU) 2024/1689 — is the world's first comprehensive law governing artificial intelligence. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024, though its obligations apply in stages rather than all at once. The Act takes a risk-based approach, sorting AI into four tiers: practices posing an unacceptable risk (such as social scoring by public authorities and most untargeted facial-recognition scraping) are prohibited; high-risk systems (used in areas like medical devices, recruitment, credit scoring and critical infrastructure) face strict obligations on risk management, data governance, human oversight and conformity assessment; limited-risk systems (chatbots, deepfakes) carry transparency duties; and minimal-risk uses are largely unregulated. Prohibitions and AI-literacy duties began applying on 2 February 2025, obligations for general-purpose AI (GPAI) models on 2 August 2025, and most high-risk requirements follow on 2 August 2026. Enforcement is backed by tiered fines of up to €35 million or 7% of global annual turnover for banned practices, €15 million or 3% for other breaches, and €7.5 million or 1% for supplying incorrect information. Because the rules apply wherever AI output is used in the EU, the Act reaches providers and deployers worldwide, making it a de facto global benchmark for AI governance.

Key findings

What is the EU AI Act and why does it exist?

The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council, the first comprehensive, horizontal legal framework for artificial intelligence anywhere in the world. It was adopted in 2024, published in the Official Journal of the European Union on 12 July 2024, and entered into force on 1 August 2024. As a Regulation, it is directly applicable in all 27 EU member states without needing national transposition.

Its stated purpose is to ensure that AI systems placed on the EU market are safe and respect fundamental rights, while supporting innovation and the free movement of AI-based goods and services across the single market. The Commission frames it as building an 'ecosystem of trust' — giving businesses legal certainty and citizens confidence that AI used in the EU is subject to enforceable safeguards.

The Act is deliberately technology-neutral and risk-based: instead of regulating specific techniques, it regulates uses of AI according to the risk they pose to health, safety and fundamental rights. This structure is designed to age well as the technology changes, and it has become a reference point that other jurisdictions study when drafting their own AI rules.

How does the AI Act classify risk?

The Act's core mechanism is a four-tier risk pyramid. The higher the risk an AI use poses, the stricter the obligations — ranging from an outright ban at the top to no mandatory rules at the base. Most everyday AI, from spam filters to recommendation engines, falls into the minimal-risk tier.

The table below summarises each tier, representative examples, and the obligations that attach to it. Note that general-purpose AI (GPAI) models are governed by a separate dedicated regime that cuts across these tiers.

This proportionate design means the compliance burden concentrates on a comparatively narrow set of high-stakes systems, while the bulk of AI applications remain free of mandatory requirements beyond general product and data-protection law.

Which AI practices are banned?

Article 5 lists AI practices considered a clear threat to fundamental rights and therefore prohibited across the EU. These bans have been in force since 2 February 2025 — the first substantive obligations of the Act to take effect.

Prohibited practices include: subliminal or purposefully manipulative techniques that materially distort behaviour and cause harm; exploitation of vulnerabilities due to age, disability or socio-economic situation; social scoring by public authorities leading to detrimental treatment; untargeted scraping of facial images from the internet or CCTV to build recognition databases; emotion recognition in workplaces and educational institutions (with narrow exceptions); certain predictive-policing profiling; and biometric categorisation inferring sensitive attributes such as race or sexual orientation.

Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes is also prohibited, subject to tightly defined exceptions (for example, searching for specific victims or preventing an imminent terrorist threat) that require prior authorisation. Breaching any Article 5 prohibition triggers the Act's highest fine tier of up to €35 million or 7% of global annual turnover.

What counts as high-risk, and what must providers do?

High-risk systems are the regulatory heart of the Act. Two routes make a system high-risk: it is a safety component of, or itself, a product already covered by EU harmonisation legislation listed in Annex I (for example medical devices, machinery, toys); or it falls within one of the use cases listed in Annex III, such as biometrics, critical infrastructure, education, employment, essential public and private services (including credit scoring), law enforcement, migration, and administration of justice.

Providers of high-risk AI must meet a demanding set of requirements: an operational risk-management system, high-quality and governed training data, detailed technical documentation, automatic record-keeping (logging), transparency and provision of information to deployers, human oversight, and appropriate levels of accuracy, robustness and cybersecurity. Before entering the market, systems must undergo conformity assessment, carry CE marking, and be registered in an EU database.

Obligations also flow down the value chain: deployers (users) of high-risk systems must operate them according to instructions, ensure human oversight, and in some cases carry out a fundamental-rights impact assessment. Most high-risk obligations begin to apply on 2 August 2026, with Annex I product-embedded systems following on 2 August 2027.

How does the Act regulate general-purpose AI (GPAI)?

General-purpose AI (GPAI) models — foundation models such as large language models that can be adapted to many tasks — are governed by a dedicated regime introduced during the negotiations to address models like GPT-class systems. These obligations have applied since 2 August 2025.

All GPAI providers must maintain up-to-date technical documentation, provide information and documentation to downstream providers who integrate the model, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training. Providers can demonstrate compliance by adhering to the Commission's General-Purpose AI Code of Practice.

A stricter layer applies to GPAI models deemed to carry 'systemic risk' — presumed where the cumulative compute used for training exceeds 10^25 floating-point operations (FLOP). These providers face additional duties: model evaluations and adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting, and adequate cybersecurity. GPAI models already on the market before 2 August 2025 have until 2 August 2027 to comply.

When does the EU AI Act take effect?

The Act entered into force on 1 August 2024 but applies in phases, giving organisations time to adapt. The staggered calendar means different obligations 'switch on' at different dates through 2030.

The table below sets out each application date and the obligations it activates.

What are the penalties for non-compliance?

Enforcement is backed by administrative fines set out in Article 99, scaled to the severity of the breach. Fines are calculated as the higher of a fixed euro ceiling or a percentage of the offender's total worldwide annual turnover for the preceding financial year — except for SMEs and start-ups, for whom the lower of the two applies.

The three tiers are shown below. Governance and enforcement are shared between national market-surveillance authorities and, for GPAI models, the European AI Office established within the Commission.

Beyond fines, authorities can require systems to be withdrawn from the market. Separate penalty provisions (Article 101) allow the Commission to fine GPAI providers up to 3% of worldwide annual turnover or €15 million for specified infringements.

Who does the AI Act apply to, and what does it mean for business?

The Act binds a broad range of actors: providers (those who develop an AI system or GPAI model and place it on the EU market), deployers (professional users), importers, distributors, and product manufacturers. It applies regardless of whether these actors are established in the EU.

Its reach is extraterritorial. The rules apply to providers placing AI on the EU market wherever they are located, and — critically — to providers and deployers outside the EU whenever the output produced by the AI system is used within the Union. A US or Asian company whose model is used by EU customers is therefore in scope, which is why the Act is widely described as setting a de facto global standard (a 'Brussels effect').

For business, the practical consequences are concentrated in the high-risk and GPAI tiers: mapping which systems fall into scope, building risk-management and documentation processes, ensuring human oversight, and — for GPAI integrators — obtaining compliance documentation from upstream model providers. Most companies using minimal-risk AI face few new mandatory duties beyond transparency where they deploy chatbots or generate synthetic media, plus a general AI-literacy obligation for staff.

What are the main criticisms and limitations?

The Act has drawn criticism from several directions. Parts of the technology industry and some member states warn that compliance costs and documentation burdens could slow European AI development and disadvantage smaller firms and start-ups relative to better-resourced US and Chinese competitors.

Civil-society and digital-rights groups argue the opposite — that the exceptions carved out for law-enforcement use of remote biometric identification and certain national-security uses weaken the fundamental-rights protections the Act is meant to guarantee. The reliance on self-assessment for many high-risk systems has also been questioned.

There are practical uncertainties too: much depends on forthcoming harmonised standards, Commission guidance and the codes of practice, which were still being finalised as the obligations phased in. The Commission has publicly discussed simplification measures to ease implementation, and the interaction between the AI Act and existing law (notably the GDPR) remains an area businesses must navigate carefully.

Scoreboard (machine-readable data)

Every headline indicator with its value, period, source and confidence. Free to reuse under CC BY 4.0.

↓ CSV · ↓ JSON

Methodology & verification

This report was compiled directly from the primary legal text — Regulation (EU) 2024/1689 (the EU AI Act) as published in the Official Journal — and the article-by-article and implementation-timeline references maintained at artificialintelligenceact.eu, cross-checked against the European Commission's official AI Act pages. Every date, fine, percentage and article reference was verified against these sources on 30 July 2026. Figures are stated as the maxima set out in the Regulation; actual penalties are determined by national authorities on a case-by-case basis. No figures were estimated or interpolated.

Data dictionary

Frequently asked questions

Glossary

High-risk AI system

An AI system that is a safety component of a product covered by EU harmonisation law (Annex I) or is used in a sensitive area listed in Annex III; subject to strict pre-market and ongoing obligations. ↗

General-purpose AI (GPAI) model

An AI model trained on broad data at scale that can perform a wide range of distinct tasks and be integrated into many downstream systems; governed by a dedicated regime from 2 August 2025. ↗

Prohibited AI practice

An AI use banned under Article 5 because it poses an unacceptable risk to fundamental rights, such as social scoring or untargeted facial-image scraping. ↗

Conformity assessment

The process by which a high-risk AI provider demonstrates that its system meets the Act's requirements before it is placed on the market, resulting in CE marking. ↗

Sources

• EU AI Act — Regulation (EU) 2024/1689 (EUR-Lex)
• European Commission — AI Act (Regulatory framework for AI)
• EU AI Act — Implementation Timeline
• EU AI Act — Article 99 (Penalties)
• EU AI Act — Full text and article explorer

Related reports & data

• National AI Power Index
• Enterprise AI Adoption in Europe