EU AI Act compliance guide: what applies now and what changed

The Digital Omnibus on AI, the EU regulation amending the Act, is now law, and it's moved the dates most organisations were planning around. Same work, later deadlines.

This guide sets out what applies today, what the Omnibus changed, and how governance, risk and compliance (GRC) teams can build an AI governance programme that's ready as each date arrives.

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive, legally binding framework for artificial intelligence. It classifies AI systems by risk level and sets proportionate obligations for providers, deployers, importers, and distributors.

Proposed in 2021, adopted in June 2024, and entered into force on 1 August 2024, the Act phases in obligations across a staged timeline running through to 2028.

Its stated goals:

1. Promote safe, trustworthy, and transparent AI
2. Ensure accountability for AI design and deployment
3. Protect citizens from harmful or high-risk applications
4. Support innovation through consistent, predictable rules

The Act applies in stages, and 2 August 2026 moved most of it from planning to enforcement. From that date the Commission’s AI Office and the Member State authorities supervise it, including the obligations on general-purpose AI (GPAI) models.

The Digital Omnibus on AI (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It changed several things that matter for planning, and the table below lists them. The dates below follow the Commission's timeline of implementation.

The AI Act Service Desk runs an official Compliance Checker that shows the rules that may apply to your AI system, including possible obligations for providers and deployers. The tool is in beta, so confirm its result with legal counsel. For the next step, SureCloud's AI governance platform holds a register of your AI systems.

The EU AI Act classifies AI systems into four risk categories, each with different obligations.

Unacceptable Risk: Prohibited

These practices are banned outright under Article 5, with effect from 2 February 2025. The Digital Omnibus on AI adds two further prohibitions, effective 2 December 2026.

Prohibited from 2 February 2025:

1. Subliminal, manipulative or deceptive techniques that materially distort behaviour, and exploitation of vulnerabilities linked to age, disability or social or economic situation
2. Social scoring of people or groups based on their behaviour or characteristics, where it leads to unrelated or unjustified detrimental treatment
3. Individual risk assessments that predict criminal offences based solely on profiling or personality traits
4. Biometric categorisation systems inferring sensitive attributes (race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation)
5. Untargeted facial image scraping to build recognition databases
6. Emotion recognition in workplace or educational settings
7. Real-time remote biometric identification in public spaces by law enforcement (permitted only in narrowly defined serious cases, with strict safeguards)

Prohibited from 2 December 2026 (via Omnibus):

1. AI systems that generate non-consensual intimate imagery, including so-called "nudifier" applications
2. AI-generated child sexual abuse material

Where scrutiny is likely to start:

1. Emotion recognition deployed in workplaces or schools
2. Biometric categorisation without a clear lawful basis
3. Missing intended purpose documentation, or absence of oversight design

High Risk: Heavily Regulated

High-risk AI systems face the most demanding compliance requirements. These are split into two categories with different deadlines following the Omnibus.

Annex III (use-based): obligations apply from 2 December 2027. Includes AI systems used in: biometric identification, critical infrastructure, education and vocational training, employment (recruitment, performance evaluation, task allocation, promotion, termination), access to essential services (credit scoring, insurance), law enforcement, migration and asylum, administration of justice, and democratic processes.

Annex I (product-embedded): obligations apply from 2 August 2028. Includes AI components that are safety components of regulated products: medical devices, toys, lifts and radio equipment. Vehicles and aviation sit in Annex I Section B, where Article 2(2) limits how the Act applies.

Note on Annex I: The Omnibus also narrows the definition of "safety component." AI systems used solely for non-safety aspects such as user assistance, performance optimisation, efficiency, automation, convenience or quality control fall outside the safety-component definition, unless their failure would endanger health and safety.

Limited Risk: Transparency Obligations

Obligations have applied since 2 August 2026. Providers must design AI systems that interact directly with people so that users are informed they are dealing with AI. AI-generated synthetic content must be labelled in a machine-readable way.

Deployers carry the disclosure duties for emotion recognition, biometric categorisation and deepfakes. Exceptions exist for law enforcement uses authorised by law, minor assistive editing, and certain artistic or editorial contexts.

Providers of generative AI systems must mark their outputs as artificially generated in a machine-readable format. Systems already on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking duty.

Minimal Risk: Few or No Requirements

Everyday AI uses that pose minimal risk (spam filtering, basic recommendation tools) have no material obligations beyond general EU law.

The Act applies to:

1. Providers: Organisations that develop and place AI systems on the EU market, or put them into service, including outside the EU where the output is used in the EU.
2. Deployers: Organisations using AI systems in a professional context. Deployers have lighter but real obligations, particularly around intended purpose, human oversight, logging, and incident reporting.
3. Importers, distributors, deployers and other third parties: Treated as providers if they put their name or trademark on a high-risk system, change its intended purpose so that it becomes high-risk, or modify it substantially.
4. Product manufacturers: Those who integrate AI into regulated products under Annex I.

UK organisations: The Act does not apply in the UK domestically, but UK organisations providing AI systems to EU users or placing systems on the EU market are likely in scope. The UK maintains a separate pro-innovation, regulator-led approach with no single omnibus AI statute.

High-risk providers and deployers must evidence the Article 9 to 15 controls and Article 72 to 73 duties below from 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems). The Article 5, 50 and 51 to 55 rows already apply. The Article-level detail sits in our EU AI Act technical compliance requirements guide.

A management system gives you a repeatable way to meet the Act's obligations at scale. The Act defines what outcomes are required; a management system defines how you deliver them consistently across teams, releases, and audits.

ISO/IEC 42001, the international standard for AI management systems, gives you a recognised structure for governance and supports many of the Act’s requirements. Our guide to ISO 42001 Annex A controls shows where the controls support these Articles.

The Commission notes that the goals and definitions of ISO/IEC 42001 differ from the quality management system the Act requires, as its standardisation FAQ explains. Certification can give customers and regulators evidence of governance intent; compliance is assessed against the Act itself. The detail sits in EU AI Act versus ISO 42001: what is the difference and ISO 42001 and the EU AI Act: dual compliance.

Phase 1: Foundations (Start Now)

Regardless of which deadline applies to you, this work underpins everything else and takes time to do properly.

1. Register and classify every AI system, including vendor and embedded AI. Write a one-paragraph intended purpose per system: who it serves, what decisions it informs or makes, and its limits and guardrails.
2. Centralise technical documentation and instructions for use. Enable event logging for key operations.
3. Define human oversight checkpoints: who intervenes, when, and how.
4. Run initial accuracy, robustness, and cybersecurity tests. Document results and limitations.

Evidence to keep: Register entries, intended-purpose statements, documentation index, logging design, test summaries.

Phase 2: Prove Control (Mature Your Programme)

1. Implement data governance: dataset acceptance criteria, lineage records, bias-testing cadence.
2. Build post-market monitoring: issue intake, corrective action workflows, serious incident triggers.
3. Begin third-party and GPAI supplier due diligence. Collect attestations, review use restrictions, and document supplier evidence. Use the GPAI Code of Practice as a reference for what providers should supply.
4. Use dashboards to track control status, open actions, and exceptions.

Evidence to keep: Dataset lineage and test evidence, post-market monitoring records, supplier questionnaires, control status reports.

Phase 3: Continuous Governance

1. Move to scheduled control testing and periodic model reviews. Re-assess on any material change.
2. Maintain a living risk register and oversight record. Keep logs and artefacts mapped to specific Act obligations for audit retrieval.
3. Monitor implementing acts and Commission guidance. Adjust templates and controls to reflect updated requirements with minimal rework.

Evidence to keep: Control test results, change assessments, management reports, incident logs, remediation tracking.

The EU AI Act establishes three tiers of administrative fines under Article 99:

1. Prohibited practices (Art. 5): Up to €35 million or 7% of global annual turnover, whichever is higher.
2. Violations of operator and notified-body obligations, including the Article 50 transparency duties: Up to €15 million or 3% of global annual turnover, whichever is higher.
3. Supplying incorrect or misleading information to authorities: Up to €7.5 million or 1% of global annual turnover, whichever is higher.

These are maximum figures. They're ceilings, and for SMEs, including start-ups, the lower of the two amounts applies to every tier. Since the Digital Omnibus, the same rule covers small mid-cap companies for the second and third tiers. Authorities set the actual penalty in each case, taking into account the nature, gravity and duration of the infringement.

Where AI systems also process personal data, GDPR obligations apply concurrently with the Act.

UK organisations serving EU users should not assume the UK approach provides sufficient cover for EU AI Act obligations. Read: EU vs UK AI regulation guide.

GRC teams did not grow when the EU AI Act arrived. The obligation to classify, document, monitor, and evidence every AI system in scope lands on the same people managing everything else.

SureCloud's AI governance platform helps you convert the Act's requirements into auditable daily work inside the programme you've already built.

1. AI use case and model register: Maintain a live register of every AI system in scope, with a light screening and an EU AI Act risk assessment for each one. SureCloud documents each classification decision and keeps it retrievable.
2. Control workflows aligned to Act obligations: Configurable control sets mapped to the Act's key articles. Named owners, due dates, automated reminders, and exception tracking. Controls can be aligned to ISO 42001 simultaneously, avoiding duplication across frameworks.
3. Evidence capture and audit pack: Centralise dataset tests, oversight logs, technical documentation, supplier attestations, and risk decisions into audit-ready records. A conformity assessment pack can be assembled from a single source, not from seven different folders.
4. Third-party and GPAI risk management: Supplier questionnaires and due diligence workflows for external AI providers and foundation model vendors. Track licence restrictions, collect evidence of provider compliance, and document your review decisions.
5. Policy lifecycle management: Version control, approval workflows, and staff attestations for AI governance policies and procedures.
6. Real-time compliance dashboards: Track control status, open remediation actions, and exceptions across every AI system in scope. Board-ready reporting without manual data assembly.
7. Gracie AI: Within SureCloud's AI governance application, Gracie AI Agents with Personas and Skills interpret assessment results, identify gaps and offer different governance perspectives on the same decision, from a Compliance, Data Privacy or regulator point of view. AI operates the role. Humans lead the programme.

1. How to Implement ISO 42001 Using AI Governance Tools: Practical Steps for Responsible AI

2. ISO 42001 and the EU AI Act: How to Comply with Both Frameworks Efficiently

3. EU vs UK AI Regulation: What It Means for Governance & Risk

4. EU AI Act Technical Compliance Requirements: 2026 Guide

5. EU AI Act vs ISO 42001: What’s the Difference?