The European AI Act is already in force and its obligations land in phases through 2028. This guide covers what applies to you depending on how you use AI, on which dates, what the fines are, and what you need documented before anyone asks for it.
Updated: 7 October 2026 · timeline revised following the AI Omnibus
Regulation (EU) 2024/1689 is the world's first comprehensive law on artificial intelligence. It does not regulate the technology in the abstract: it regulates uses. Every AI system is classified by the risk it poses to people's rights, with obligations proportional to that risk.
It applies to providers placing AI systems on the EU market and to organisations deploying them in their operations, whether or not they are established in the EU, as long as the output is used within the Union. In practice: if your team uses an LLM to process European customer data, it affects you, even when the model belongs to someone else.
Updated European Commission timeline: the AI Omnibus entered into force on 27 July 2026. The delay concerns high-risk rules; it does not suspend GDPR or all other AI Act obligations.
The Regulation enters into force and starts the clock on every later deadline.
Uses such as social scoring and untargeted facial scraping become banned. The original AI literacy requirement was simplified by the AI Omnibus in July 2026; review the current rule and your team’s training needs.
Transparency, technical documentation and copyright-policy duties for foundation model providers. Governance rules and penalties start to apply.
General application, including transparency duties. Annex III high-risk rules are delayed until 2 December 2027 by the AI Omnibus.
High-risk rules apply to uses such as recruitment, credit scoring and education under the AI Omnibus revised timeline.
Applies to AI systems that are safety components of products already covered by other Union legislation (Annex I).
Your first compliance task is classifying every AI system you use correctly.
What it covers
Social scoring, subliminal manipulation, emotion recognition at work or school, biometric categorisation using sensitive traits.
What it requires
Banned. There is no mitigation available: the use must stop.
What it covers
Recruitment, credit scoring, education, essential services, justice, migration, and AI acting as a product safety component.
What it requires
Risk management system, data governance, technical documentation, automatic event logging, human oversight, accuracy and cybersecurity, plus registration in the EU database.
What it covers
Chatbots, content generators, deepfakes, systems interacting directly with people.
What it requires
Tell users they are interacting with an AI and label generated or manipulated content in a machine-readable way.
What it covers
Spam filters, video games, internal recommenders and most office use cases.
What it requires
No specific obligations. Voluntary codes of conduct are encouraged.
Ten concrete steps you can start today, ordered by what regulators ask for first.
Include the ones you did not buy as AI: assistants inside your CRM, code copilots, meeting transcribers. What is not inventoried cannot be governed.
Document the reasoning, not just the conclusion. Justifying why something is not high risk matters as much as the classification itself.
Providers and deployers carry very different duties. Fine-tuning a model on your own data can turn you into a provider.
Original requirement from February 2025, simplified by the AI Omnibus. Document training appropriate to your team’s roles and risks.
Which data enters each system, where it comes from, on what legal basis, and what happens to sensitive data before it reaches a model.
The Regulation requires automatic event traceability for high-risk systems. A record of who asked what, to which model, with which data, is your baseline evidence.
Define who can review, correct or reverse an AI-assisted decision, and show they genuinely can.
Disclose when someone is talking to an AI and label generated content. These are the easiest duties to check from the outside.
Data retention, training use, processing location and sub-processors. Their failures end up being yours.
Technical documentation, risk assessments, logs and incidents in one exportable place. Conformity is demonstrated, not declared.
Privaro does not deliver compliance on its own: it covers the technical part that is hardest to improvise, which is controlling and proving what data leaves for the models.
Yes, if the system's output is used within the Union or you place the system on the EU market. The test is where the effect happens, not where you are headquartered.
Usually not: you would be a deployer, with lighter duties. But if you fine-tune the model, ship it under your own brand or substantially change its intended purpose, you can become a provider and take on the full set of obligations.
No, they stack. GDPR still governs personal data processing while the AI Act adds duties about the AI system itself. One use case can breach both independently.
With streaming, the output is audited in real time rather than masked. The detection is recorded for evidence and alerting even though the text already reached the user. Document that limitation in your risk assessment.
This guide is informational and is not legal advice. For specific compliance decisions, consult your legal counsel.
Start by knowing where you stand: the risk assessment gives you a picture in minutes.
Request a demo