What is the EU AI Act and what does it actually require

The Core Structure: Risk-Based Categories

The EU AI Act’s core approach categorizes AI systems by risk level — from prohibited practices at one end, through high-risk applications requiring significant compliance obligations, down to lower-risk uses with lighter or no specific requirements — rather than applying one uniform rule to every AI system regardless of what it actually does.

What’s Already Been in Effect

Certain prohibited practices under the Act, such as using AI for emotion recognition in the workplace or exploiting vulnerable groups, have already been in effect since February 2025 — these are outright bans, not obligations that require compliance work, and predate the more recent phases of the law’s rollout.

What Started in August 2026

Enforcement of transparency obligations for general-purpose AI models, along with the regulator’s actual penalty powers, began in August 2026 — meaning this is the point where meaningful financial consequences for certain kinds of non-compliance genuinely became active, not just a future deadline on paper.

Why the Timeline Has Shifted Since the Law Passed

A 2026 agreement, referred to as the Digital Omnibus, pushed back some of the specific high-risk AI system obligations under the law to December 2027 — meaning the practical compliance timeline for businesses has shifted since the Act was originally passed, and staying current on the specific, updated dates matters more than relying on the law’s original announced schedule.

Bottom Line

The EU AI Act regulates AI based on risk level, with some prohibitions already active since early 2025, transparency and penalty enforcement for general-purpose models beginning in August 2026, and certain high-risk obligations pushed to December 2027 under a later revision — the practical compliance picture has genuinely evolved since the law’s original passage.

Go deeper

• How do different countries define what counts as a high risk ai system?