EU Regulation 2024/1689
EU AI Act: risk tiers, obligations and deadlines
The EU AI Act entered into force in August 2024, and its obligations phase in up to August 2028, after the 2026 Digital Omnibus moved the high-risk deadlines. This page covers how risk classification works, what each tier requires, who the Act applies to and how to prepare.
In short
The EU AI Act (Regulation 2024/1689) is the EU's regulation on artificial intelligence. It sorts AI systems into four risk tiers: unacceptable (prohibited), high-risk (heavy obligations), limited risk (transparency requirements) and minimal risk (no specific obligations). It applies to any organisation that provides or deploys AI systems on the EU market, wherever the organisation is based. Obligations phase in up to August 2028, and the bans on unacceptable-risk practices already apply.
The four risk tiers
Every AI system placed on the EU market falls into one of four tiers. Your obligations depend on which tier applies to your system.
| Tier | Examples | Obligations | Timeline |
|---|---|---|---|
| Unacceptable risk | Social scoring, real-time biometric identification in public spaces (with exceptions), manipulative AI | Prohibited | February 2025 |
| High risk | AI in recruitment, credit scoring, law enforcement, critical infrastructure, education, medical devices | Risk management, data governance, transparency, human oversight, conformity assessment | December 2027 (Annex III); August 2028 (Annex I) |
| Limited risk | Chatbots, deepfakes, emotion recognition | Transparency: disclose that the user is interacting with AI or that content is AI-generated | August 2026 |
| Minimal risk | Spam filters, AI-enabled games, inventory management | No specific obligations (voluntary codes of conduct encouraged) | N/A |
What high-risk classification requires
If your AI system is classified as high-risk, you must meet and document a set of requirements before placing it on the market or putting it into service. These are legal obligations, and national authorities can enforce them with fines.
- A risk management system operated throughout the AI system's lifecycle
- Data governance: training, validation and testing datasets must meet quality criteria
- Technical documentation sufficient for a third party to assess compliance
- Record-keeping: automatic logging of the system's operation
- Transparency: instructions for use that allow the deployer to interpret outputs
- Human oversight measures appropriate to the risk
- Accuracy, robustness and cybersecurity appropriate to the system's purpose
- A conformity assessment before the system is placed on the market
Who the EU AI Act applies to
The Act applies to providers (those who develop AI systems or place them on the market) and deployers (those who use AI systems in a professional capacity) of AI systems that are placed on the EU market or whose output is used in the EU. Your company does not need to be based in the EU.
If you sell AI-powered software to EU customers, or your AI system's outputs affect people in the EU, the regulation probably applies to you. Its reach outside the EU is similar to GDPR's.
Enforcement timeline
The EU AI Act entered into force on 1 August 2024 and its obligations phase in over four years. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and moved the high-risk deadlines back. It did not move the transparency deadline.
- February 2025
- Bans on unacceptable-risk AI practices take effect; AI literacy obligations begin
- August 2025
- Rules for general-purpose AI (GPAI) models apply; governance structures must be in place
- August 2026
- Transparency requirements for limited-risk systems apply (Article 50)
- December 2027
- Obligations for high-risk AI systems listed in Annex III, such as recruitment, credit scoring and education
- August 2028
- Obligations for high-risk AI systems listed in Annex I (those already regulated under EU product safety law)
EU AI Act alongside ISO 42001 and NIST AI RMF
The EU AI Act's requirements for high-risk AI systems overlap substantially with ISO 42001 and NIST AI RMF. All three address risk management, data governance, transparency, human oversight and post-market monitoring. A programme built on ISO 42001 or NIST AI RMF covers much of what the EU AI Act requires.
The Act adds three things the voluntary frameworks do not: legal enforcement, conformity assessment before market placement, and the risk-tier classification that decides which obligations apply.
The path to compliance
Risk classification shapes the rest of the work. Once each system is classified, the scope is clear.
-
01
Inventory and classify
List every AI system you provide or deploy. Classify each into its risk tier using the Act's criteria.
Your product and legal leads, with implementation support where you need it
-
02
Gap assessment
For high-risk systems, compare each requirement with your current state. Identify documentation and control gaps.
Your team
-
03
Build and document
Put risk management, data governance, transparency and human oversight controls in place. Prepare the technical documentation.
Your team, in Certifyi
-
04
Conformity assessment
For high-risk systems, complete the conformity assessment procedure (self-assessment or third-party, depending on the system type).
Your team or notified body
Who does what
Software, implementation support and the independent assessor are different jobs. This is how they divide.
| Task | Your team | Certifyi | Self-assessment or notified body (high-risk) |
|---|---|---|---|
| Classification | Classify each AI system | Records each system and its risk tier | Validates classification (market surveillance) |
| Controls | Implement and operate them | Holds controls, documentation and evidence | Not involved |
| Documentation | Prepare technical documentation | Keeps the documents for each system together | Reviews during conformity assessment |
| Conformity | Not involved | Holds the evidence the assessor reviews | Assesses conformity (notified body, where required) |
| Market placement | Affix CE marking (where applicable) | Stores the declaration of conformity | Market surveillance authority monitors |
How Certifyi helps
Build your EU AI Act programme on the same record as your other frameworks
The AI systems register sits beside the controls and documents for ISO 42001, GDPR and the rest of your programme, so classifying a system and evidencing its controls happen in one place.
-
AI systems register with risk class
Keep a register of the AI systems you provide or deploy, each with its EU AI Act risk class.
-
Tamper-evident activity log
Evidence stays on the control it supports, and each change to it is written to the tamper-evident activity log, which helps when you have to show a market surveillance authority what was done and when.
-
Incident records
Log incidents involving your AI systems in the same incident register as the rest of your programme, and assign response tasks.
From the blog
EU AI Act articles
Longer answers to the questions teams ask while they work on EU AI Act.
Questions
EU AI Act, answered
Does the EU AI Act apply if my company is not in the EU?
Yes. If you provide or deploy an AI system that is placed on the EU market, or whose output is used in the EU, the Act applies wherever your company is based. The territorial scope is similar to GDPR.
How do I know if my AI system is high-risk?
The Act defines high-risk AI systems in two ways: systems that are safety components of products already regulated under EU law (Annex I), and standalone AI systems used in specified areas such as recruitment, credit scoring, law enforcement, education and critical infrastructure (Annex III). If your system falls into either category, it is high-risk.
What are the penalties?
Up to €35 million or 7% of worldwide annual turnover for prohibited practices. Up to €15 million or 3% for non-compliance with high-risk requirements. Up to €7.5 million or 1% for supplying incorrect information. Reduced caps apply to SMEs and start-ups.
What is the relationship between the EU AI Act and ISO 42001?
ISO 42001 is a management-system standard for responsible AI. Implementing it covers many of the EU AI Act's requirements for high-risk systems, such as risk management, data governance and transparency. The EU AI Act is the legal obligation, and ISO 42001 is one structured way to show you meet it.
Do I need to act now or can I wait?
The bans on unacceptable-risk practices have applied since February 2025, GPAI rules since August 2025 and transparency duties since August 2026. High-risk obligations apply from December 2027 for Annex III systems and August 2028 for Annex I systems. Classifying systems and building documentation takes time, so it makes sense to start now.
Can I reuse work from NIST AI RMF or ISO 42001?
Yes. Risk management, data governance, transparency and monitoring controls carry across. The EU AI Act adds the legal conformity assessment and classification obligations on top.
Talk through your AI systems in a 30-minute call.
Bring your AI system inventory, however rough. We can work through the classification questions for each system and what its tier would require.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them