EU AI Act Compliance Guide for AI and Software Companies

The EU AI Act is the first broad law regulating artificial intelligence by risk. It reaches software companies anywhere in the world whose AI systems are placed on the EU market or whose AI output is used in the EU. Its dates also moved in 2026: the Digital Omnibus on AI, published in the Official Journal in July 2026, pushed back the high-risk obligations and added new prohibitions. This guide explains the current timeline, how to classify your AI systems, what providers and deployers must do, and a practical plan for IT and SaaS companies.

What is the EU AI Act?

The AI Act is an EU regulation that sets harmonised rules for developing, placing on the market, putting into service and using AI systems in the EU. It follows a product safety approach: the higher the risk an AI system poses to health, safety or fundamental rights, the stricter the rules.

Full form and definition

Its formal name is Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). An AI system is defined in Article 3(1) as a machine-based system designed to operate with varying levels of autonomy, that may adapt after deployment, and that infers from inputs how to generate outputs such as predictions, content, recommendations or decisions. The European Commission has published guidelines on this definition; simple rule-based software usually falls outside it.

Law, standard or certification?

It is a law. For high-risk systems it requires a conformity assessment and CE marking, but there is no general "AI Act certificate". Harmonised European standards are being developed to give a presumption of conformity; ISO/IEC 42001 is not one of them but supports many of the same processes.

History and background of the EU AI Act

The European Commission proposed the AI Act in April 2021. The rise of generative AI during negotiations led to new rules for general-purpose AI models. The regulation was published on 12 July 2024 and entered into force on 1 August 2024, with obligations phased in.

In November 2025 the Commission proposed a Digital Omnibus on AI to simplify implementation and give time for standards and guidance. The amending regulation was published in the Official Journal in July 2026. It moved the high-risk dates, added prohibitions on AI used to generate child sexual abuse material and non-consensual intimate imagery, and adjusted transition rules for existing generative AI systems.

Why was the EU AI Act introduced?

AI is increasingly used in decisions about jobs, credit, education, public services and law enforcement, where errors and bias can harm people at scale. The EU wanted a single market rulebook that protects fundamental rights and safety without banning useful AI, and to avoid 27 different national laws.

Main objectives and purpose

• Ban AI practices that pose unacceptable risks to people's rights.
• Set requirements for high-risk AI so it is safe, transparent, accurate and under human oversight.
• Make AI-generated content and AI interactions identifiable.
• Regulate the most capable general-purpose AI models, including those with systemic risk.
• Support innovation through regulatory sandboxes and lighter rules for SMEs.

Who needs to comply with the EU AI Act?

Roles

• Providers develop an AI system or model, or have it developed, and place it on the market or put it into service under their own name. Most duties fall on providers.
• Deployers use an AI system under their authority in a professional context, such as a company using an AI hiring tool.
• Importers, distributors and authorised representatives have supply chain duties.
• Product manufacturers that integrate AI into regulated products.

A company can become a provider by putting its name on someone else's system or making a substantial modification to a high-risk system, so resellers and integrators should check their role carefully.

Geography

The Act applies to providers placing AI systems or general-purpose models on the EU market regardless of where they are established, to deployers in the EU, and to providers and deployers outside the EU where the output of the AI system is used in the EU (Article 2). An Indian or US software company selling an AI feature to EU customers is in scope as a provider.

Typical IT company exposure

• SaaS products with AI features (chatbots, summarisation, recommendations, scoring)
• HR tech vendors with CV screening or candidate ranking
• Fintech and insurtech vendors with credit scoring or risk pricing
• Edtech vendors that evaluate learning outcomes or proctor exams
• Development agencies building AI systems for EU clients
• Companies fine-tuning or distributing general-purpose models

Key requirements of the EU AI Act

Risk categories

AI Act risk categories

Category	Examples	Rules
Prohibited (Article 5)	Social scoring, manipulative techniques causing significant harm, exploiting vulnerabilities, untargeted scraping of facial images, emotion recognition at work or school, biometric categorisation by sensitive traits, predictive policing based only on profiling, and (from 2 December 2026) AI generating CSAM or non-consensual intimate imagery	Banned, with narrow exceptions
High-risk (Article 6, Annexes I and III)	AI in safety components of regulated products; AI in biometrics, critical infrastructure, education, employment, access to essential services such as credit and insurance, law enforcement, migration and justice	Full requirements, conformity assessment, registration
Transparency (Article 50)	Chatbots, generative AI, deepfakes, emotion recognition and biometric categorisation systems	Disclosure and marking duties
Minimal risk	Spam filters, AI in games, most internal productivity tools	No specific obligations beyond AI literacy and existing law

The Annex III exception

An Annex III system is not high-risk if it does not pose a significant risk of harm, for example because it performs a narrow procedural task or only improves the result of a completed human activity (Article 6(3)). Systems that profile natural persons are always high-risk. Providers relying on the exception must document their assessment and register the system.

Requirements for high-risk AI systems (Articles 8 to 15)

• A risk management system across the life cycle
• Data governance: relevant, representative and, as far as possible, error-free training, validation and test data, with bias examination
• Technical documentation (Annex IV)
• Automatic logging of events
• Transparency and instructions for use for deployers
• Human oversight measures
• Accuracy, robustness and cybersecurity

Provider obligations for high-risk systems

A quality management system (Article 17), conformity assessment (mostly internal control, with notified bodies for some biometric systems), EU declaration of conformity, CE marking, registration in the EU database, post-market monitoring and reporting of serious incidents.

Deployer obligations for high-risk systems

Use the system according to instructions, assign trained human oversight, monitor operation, keep logs for at least six months, inform workers before using high-risk AI in the workplace, and inform people subject to certain decisions. Public bodies and deployers using AI for credit scoring or life and health insurance pricing must carry out a fundamental rights impact assessment (Article 27).

Transparency obligations (Article 50)

• Tell people when they interact with an AI system, unless obvious.
• Mark synthetic audio, image, video and text output in a machine-readable way so it is detectable as AI-generated.
• Disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless human-reviewed under editorial responsibility.
• Inform people exposed to emotion recognition or biometric categorisation.

General-purpose AI models

Providers of general-purpose AI models must keep technical documentation, provide information to downstream providers, have a copyright policy and publish a summary of training content. Models with systemic risk (presumed above 10²⁵ floating point operations of training compute) have extra duties on evaluation, risk mitigation, incident reporting and cybersecurity. A General-Purpose AI Code of Practice, published in July 2025, offers a voluntary way to show compliance. Companies that only build applications on top of a third-party model are generally not GPAI model providers.

AI literacy

Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff dealing with AI systems. It has applied since 2 February 2025.

How to comply with the EU AI Act: step by step

1. Inventory AI. List every AI system and model you build, buy or embed, including features using third-party model APIs.
2. Determine your role for each: provider, deployer, importer, distributor or GPAI model provider.
3. Classify risk. Screen against Article 5 prohibitions, Annex I and Annex III high-risk uses, and Article 50 transparency triggers. Document the reasoning.
4. Stop or redesign prohibited uses immediately; these are already banned.
5. Implement transparency for chatbots and generative features ahead of 2 August 2026, including machine-readable content marking.
6. Plan high-risk compliance for 2 December 2027 (Annex III) or 2 August 2028 (Annex I): risk management, data governance, documentation, logging, human oversight, testing, QMS and conformity assessment.
7. Update contracts with model providers and customers to share the information each party needs.
8. Train staff to meet AI literacy expectations.
9. Set up monitoring and incident reporting for systems in production.
10. Use a management system such as ISO 42001 to run all of this as a repeatable process.

Documentation required

• AI system inventory with roles and risk classification
• Article 6(3) assessments for Annex III systems treated as not high-risk
• For high-risk systems: risk management file, data governance records, Annex IV technical documentation, logs, instructions for use, QMS documentation, EU declaration of conformity and registration
• Transparency and content marking design records
• For GPAI models: technical documentation, downstream information, copyright policy and training content summary
• Fundamental rights impact assessments where required
• AI literacy training records

Audit and assessment requirements

Most high-risk systems in Annex III follow a conformity assessment based on internal control, meaning the provider assesses itself against the requirements and its QMS. Certain biometric systems need a notified body where harmonised standards are not fully applied. AI in Annex I products follows the conformity assessment of the relevant product law. National market surveillance authorities enforce the Act, and the European Commission's AI Office supervises general-purpose AI models.

Estimated implementation timeline

Typical effort for an AI-enabled software company

Work	Duration
AI inventory, roles and risk classification	4 to 8 weeks
Transparency and content marking for chatbots and generative features	4 to 10 weeks
High-risk system compliance (documentation, testing, QMS, conformity)	9 to 18 months
Ongoing monitoring and updates	Continuous

Cost considerations

• Legal and technical classification work
• Engineering for logging, human oversight features and content marking
• Data governance and bias testing
• Technical documentation and QMS design
• Notified body fees where applicable
• Training programmes for AI literacy

SMEs and start-ups get reduced fines, simplified documentation forms and priority access to regulatory sandboxes.

Benefits of AI Act compliance

• Continued access to the EU market for AI products.
• Better-engineered AI: documented data, tested accuracy and monitored behaviour reduce incidents.
• Sales advantage as enterprise buyers add AI Act clauses to procurement.
• Readiness for similar rules elsewhere.

Risks and consequences of non-compliance

• Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices.
• Up to EUR 15 million or 3% for most other obligations, including high-risk and transparency duties.
• Up to EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information to authorities.
• For SMEs and start-ups, the lower of the two amounts applies.
• Withdrawal or recall of AI systems from the market.

Common implementation mistakes

• Assuming the Act only applies to model developers; deployers and application providers have duties too.
• Assuming non-EU companies are out of scope.
• Relying on old timelines from before the 2026 Omnibus.
• Forgetting AI features embedded through third-party APIs in the inventory.
• Treating Article 6(3) as a way to avoid high-risk status without documented reasoning.
• Planning only for the AI Act and missing GDPR duties for personal data in training and inference.

Compliance challenges for IT companies

• Dependence on model providers for information about training data and model behaviour.
• Standards still maturing: harmonised standards are being finalised, so early compliance relies on the text, guidelines and international standards.
• Agile release cycles versus documentation and substantial modification rules.
• Content marking across text, images, audio and video in a robust, interoperable way.
• Client contracts that push all AI Act duties onto the vendor regardless of role.

Best practices and recommendations

• Make AI classification part of product discovery so high-risk use cases are spotted early.
• Record design decisions, data sources and evaluation results as you build; reconstructing them later is expensive.
• Build human oversight and logging into the product, not as an afterthought.
• Use ISO 42001 to run AI governance, and ISO 27001 for the security requirements.
• Track Commission guidelines, codes of practice and standards; they change how requirements are interpreted.

Tools and technologies that help

• AI inventory and governance platforms
• Model evaluation and bias testing tools
• Data lineage and dataset documentation tools
• Content provenance and watermarking technologies, such as C2PA content credentials
• Logging and monitoring for model inputs, outputs and drift

Relationship with other compliance frameworks

AI Act and related frameworks

Framework	Relationship
ISO 42001	Certifiable AI management system that supports risk management, documentation and monitoring
GDPR	Applies in parallel whenever AI processes personal data, including automated decision rights under Article 22
ISO 27001	Supports the cybersecurity requirement for high-risk systems
ISO 27701	Privacy management for personal data used in AI

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

HR tech vendor

A recruitment platform with AI candidate ranking classified the feature as high-risk under Annex III (employment). It built a risk management file, documented training data and bias tests, added reviewer override and explanation screens for recruiters, and planned its conformity assessment for 2027.

SaaS company with a support chatbot

A B2B SaaS company classified its support chatbot as a transparency-only system, added a clear "AI assistant" label, a hand-off to human agents and logging, and confirmed in contracts that its model provider handled GPAI model duties.

Frequently asked questions

When does the EU AI Act apply?

In phases: prohibitions from 2 February 2025, general-purpose AI model duties from 2 August 2025, transparency duties from 2 August 2026, new prohibitions from 2 December 2026, Annex III high-risk duties from 2 December 2027 and Annex I high-risk duties from 2 August 2028.

Did the Digital Omnibus delay the AI Act?

It delayed the high-risk obligations (Annex III to 2 December 2027 and Annex I to 2 August 2028). Prohibitions and GPAI duties were not delayed, and new prohibitions were added.

Does the AI Act apply to companies outside the EU?

Yes, if they place AI systems on the EU market or the output of their AI systems is used in the EU.

Is a chatbot high-risk?

Usually not. Most chatbots are subject to transparency duties: users must be told they are interacting with AI.

Is AI used in hiring high-risk?

Yes. AI for recruitment, selection, promotion, termination, task allocation or performance monitoring is listed in Annex III.

Do we need a CE mark for AI?

Only for high-risk AI systems, after a conformity assessment.

Are we a provider if we use OpenAI, Anthropic or Google models in our product?

You are usually the provider of your AI system, while the model company is the provider of the general-purpose model. Your duties depend on your system's risk category.

What are the fines?

Up to EUR 35 million or 7% of turnover for prohibited practices, EUR 15 million or 3% for other obligations and EUR 7.5 million or 1% for misleading information, with lower caps for SMEs.

Does ISO 42001 certification mean AI Act compliance?

No. It supports compliance but does not cover every legal requirement and is not a harmonised standard.

Who enforces the AI Act?

National market surveillance authorities in each member state, and the European Commission's AI Office for general-purpose AI models.

Does open-source AI have to comply?

Open-source systems have some exemptions, but not if they are high-risk, prohibited or subject to transparency duties, and open-source GPAI models with systemic risk have full duties.

Conclusion and next steps

The AI Act asks IT companies to know what AI they ship, classify it honestly and engineer it responsibly. The Omnibus gave more time for high-risk systems, but prohibitions, GPAI rules and transparency duties already apply.

1. Build your AI inventory and assign roles.
2. Classify each system and record the reasoning.
3. Implement Article 50 transparency now.
4. Plan high-risk compliance for 2027 or 2028.
5. Adopt ISO 42001 to keep governance running.

This guide is general information, not legal advice.

How we keep this guide up to date

We review this guide every three to six months while implementation rules are still evolving, and whenever the Commission adopts guidelines, delegated acts, codes of practice or harmonised standards, or the AI Act is amended.