The AI Act explained

Timeline

1. 1 August 2024

   The Regulation entered into force.

2. 2 February 2025

   The general provisions and the prohibited AI practices apply (Art. 5), including the AI literacy obligation (Art. 4).

3. 2 August 2025

   The rules for general-purpose AI (GPAI) models and the obligations for providers of those models apply, together with EU-level governance. Member States had to designate national competent authorities and adopt penalty rules.

4. 2 August 2026

   Most rules apply and enforcement starts, including the transparency rules in Art. 50. Providers of AI systems already on the market before this date have until 2 December 2026 to meet the marking and detection duty in Art. 50(2). From 2 December 2026 a new prohibition also applies to systems that generate non-consensual sexual deepfakes and child sexual abuse material.

5. 2 December 2027

   The rules for high-risk systems in the Annex III areas, such as biometrics, critical infrastructure, education and employment, apply. This date was moved by the digital omnibus on AI.

6. 2 August 2028

   The rules for high-risk AI embedded in products under Annex I apply. This date was moved by the digital omnibus on AI.

Who is covered, and the roles

The Regulation gives each role its own obligations. A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether paid or free (Art. 3(3)). A deployer uses an AI system under its own authority. Purely personal, non-professional use does not count (Art. 3(4)). There are also importers, distributors and authorised representatives. An authorised representative is a person established in the EU who has received a written mandate from a provider to carry out that provider's obligations (Art. 3(5) to (7)).

The Regulation covers providers that place AI systems or GPAI models on the EU market, including those established in a third country. It also covers deployers established or located in the EU, and providers and deployers in a third country where the system's output is used in the EU (Art. 2(1), points (a) to (c)). A vendor outside the EU is therefore not outside its scope.

A deployer can itself become a provider. This happens, among other cases, if you put your own name or trademark on a high-risk system that is already on the market, substantially modify such a system, or change the intended purpose of a non-high-risk system, including a GPAI system, so that it becomes high-risk (Art. 25(1)).

The heaviest obligations apply to high-risk systems. The Commission names areas such as biometrics, critical infrastructure, education, employment, migration, asylum and border control. Prohibited practices (Art. 5) can be fined up to EUR 35 million or 7 % of worldwide annual turnover; most other operator obligations up to EUR 15 million or 3 %, whichever is higher in each case (Art. 99(3) and (4)). For SMEs, including start-ups, the lower of the two amounts applies (Art. 99(6)).

• Provider: develops the system or model and places it on the market under its own name or trademark.
• Deployer: uses the system under its own authority, for example your organisation as a customer of an AI service.
• Authorised representative: established in the EU, acts for a provider from a third country (Art. 22 for high-risk systems, Art. 54 for GPAI models).
• Importer and distributor: bring systems from elsewhere onto the EU market or make them available.

What you must do as a deployer

The obligations in Art. 26 apply only to high-risk systems. For the Annex III areas they apply from 2 December 2027. The provider decides in the first place whether a system is high-risk, but you still have to organise its use properly. The main duties follow, as the Commission's AI Act Service Desk presents the text.

AI literacy (Art. 4) is broader than high-risk. Providers and deployers must take measures to support the AI literacy of their staff and of others who operate AI systems on their behalf. The obligation does not require guaranteeing a specific level of literacy for any individual. Art. 4 was amended by the digital omnibus on AI.

• Use the system according to the provider's instructions for use, with appropriate technical and organisational measures (Art. 26(1)).
• Human oversight: assign it to people with the necessary competence, training, authority and support (Art. 26(2)).
• Input data: where you control it, make sure it is relevant and sufficiently representative for the intended purpose (Art. 26(4)).
• Monitoring and reporting: monitor operation, inform the provider and, for a risk or serious incident, also the distributor and the authority; if there is a risk you suspend use (Art. 26(5)).
• Keep logs under your control for at least six months, or longer if the purpose or other law requires it (Art. 26(6)).
• Inform workers' representatives and affected workers before using a high-risk system at work (Art. 26(7)).
• Public authorities and EU bodies: do not use a system that is not in the EU database (Art. 26(8)).
• Use the provider's information for a data protection impact assessment under the GDPR (Art. 26(9)).
• Inform natural persons about whom an Annex III system takes or supports decisions (Art. 26(11)).
• Public bodies, private entities providing public services and deployers of certain Annex III systems assess the impact on fundamental rights beforehand (Art. 27(1)). An existing DPIA may be cross-referenced (Art. 27(4)).
• Deployers of emotion recognition or biometric categorisation inform the people exposed (Art. 50(3)). Deployers of deepfakes and of AI-generated text on matters of public interest disclose that the content is artificial (Art. 50(4)).

What providers and model providers must do

For transparency (Art. 50), the following has applied since 2 August 2026. Providers of systems that interact directly with people design them so that people know they are dealing with AI, unless that is obvious to a reasonably well-informed person (Art. 50(1)). Providers of systems, including GPAI systems, that generate synthetic audio, image, video or text make sure the output is marked in a machine-readable format and detectable as artificial (Art. 50(2)). For systems on the market before 2 August 2026, the transition period for Art. 50(2) runs until 2 December 2026.

Providers of GPAI models must draw up technical documentation, provide information to providers who integrate the model into their systems, maintain a copyright policy and publish a summary of the training content (Art. 53(1)). For models under a free and open-source licence with publicly available parameters, architecture and usage information, the documentation and information duties fall away, but not the copyright policy and the summary. That exception does not apply to models with systemic risk (Art. 53(2)).

The GPAI Code of Practice was published on 10 July 2025. The Commission describes it as a voluntary tool prepared by independent experts, and states that it and the AI Board confirmed it as an adequate voluntary tool to demonstrate compliance. The Transparency and Copyright chapters are for all GPAI providers, the Safety and Security chapter for models with systemic risk. The AI Office's powers to enforce the GPAI rules apply from 2 August 2026.

A provider established in a third country must appoint, by written mandate, an authorised representative established in the EU before placing a system or model on the market: for high-risk systems (Art. 22(1)) and for GPAI models (Art. 54(1)). The representative verifies, among other things, that technical documentation exists, keeps it available for ten years and cooperates with authorities (Art. 22(3), Art. 54(3)). Open-source GPAI models without systemic risk are exempt from Art. 54 (Art. 54(6)).

What you can ask an AI vendor

Use the points below in tenders, questionnaires and contracts. An answer shows what the vendor says about its role and service; it is not a conformity assessment.

• Role and classification: is the vendor a provider, importer or distributor, and what is your organisation's role? Is the system prohibited, high-risk, subject to Art. 50, or none of these? On what basis? (Art. 3, Art. 5, Art. 25).
• Instructions and documentation: which instructions for use, technical documentation and deployer information does the vendor supply (Art. 26(1), Art. 27 and Art. 26(9) rely on them)?
• Data and training: are your inputs and outputs used to train or improve models, by the vendor or by the model provider? If so, can you switch that off?
• Hosting and location: where are inputs, outputs and logs processed and stored, and by which subprocessors? How long does the vendor keep logs, and can you view and export them yourself (Art. 26(6))?
• Model provider: which underlying GPAI model does the service use, from which provider, and can the vendor point to the Art. 53 documentation and the training content summary? Has the model provider signed the GPAI Code of Practice?
• EU establishment: where is the vendor established? If the provider is outside the EU, who is the authorised representative (Art. 22, Art. 54) and who is the point of contact?
• Transparency: does the system mark generated content in a machine-readable way (Art. 50(2)) and tell users they are interacting with AI (Art. 50(1))?
• Human oversight and incidents: what oversight functions exist, and how will you be told about incidents or risks (Art. 26(2), Art. 26(5))?

The AI Act, the GDPR and the CLOUD Act

The AI Act and the GDPR (Regulation (EU) 2016/679) apply side by side. The AI Act refers to it in several places: the provider's information for a DPIA (Art. 26(9)), the option to use an existing DPIA in the fundamental rights assessment (Art. 27(4)), and the requirement that deployers of emotion recognition and biometric categorisation process personal data in accordance with the GDPR (Art. 50(3)). Whether your processing is lawful remains a GDPR question.

The CLOUD Act is US legislation (Pub. L. 115-141, 23 March 2018). It requires providers of electronic communication or remote computing services to preserve or disclose data in their possession, custody or control, regardless of whether it is located inside or outside the United States (18 U.S.C. § 2713). The AI Act does not regulate this. An authorised representative established in the EU (Art. 22, Art. 54) is a separate matter from which law applies to the vendor and its parent company.

For your procurement this means the AI Act raises questions about role, documentation and transparency, while questions about ownership, hosting location and access by foreign authorities remain separate. See also the explainers on NIS2, DORA and the CRA on this site.

How this relates to digital sovereignty and the score

The score is not an assessment of compliance with the AI Act. It looks at five dimensions, and the AI Act touches each in a different way.

JES (jurisdiction): the AI Act requires providers from a third country to appoint an EU representative, but says nothing about the parent company. An EU representative does not change where the vendor and its owner are established. DRS (data residency): the articles on this page do not prescribe where data is hosted; hosting location remains a separate question. CKS (key sovereignty): the articles discussed do not regulate key management. PLS (lock-in and portability): logs under your control for at least six months (Art. 26(6)) and the provider's documentation help you assess or leave a service later. SRS (source and runtime): an open-source licence gives only a partial exemption for GPAI providers (Art. 53(2), Art. 54(6)); self-hosting a model does not automatically change your role under the Regulation.

Frequently asked questions

Sources

• European Commission, AI Act Service Desk: implementation timeline
• European Commission, AI Act Service Desk: article texts (e.g. Art. 26)
• European Commission: AI Act policy page
• European Commission: GPAI Code of Practice
• European Commission, AI Act Service Desk: frequently asked questions
• 18 U.S.C. § 2713, text via govinfo.gov (US government)