What You Need to Know About the EU AI Act from Eur - Lex

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• The EU AI Act (Regulation 2024/1689) applies to any AI system or general - purpose AI model placed on the EU market, regardless of the provider’s location.
• AI systems are classified into four risk levels; high - risk systems require a risk - management system, technical documentation, CE - marking, and post - market monitoring.
• Prohibited practices include social - scoring, real - time biometric identification in public spaces, and generation of non - consensual intimate material.
• General - purpose AI models that exceed 10²⁵ FLOPs are deemed systemic - risk and trigger extra obligations.
• The high - risk compliance deadline was postponed by a 2026 "Digital Omnibus" amendment to 2 Dec 2027 (2 Aug 2028 for AI embedded in regulated products); fines can reach €35 million or 7 % of annual turnover for the most serious violations.

What is the official reference for the EU AI Act?

The act is formally known as Regulation (EU) 2024/1689, published in the Official Journal L 2024/1689 on 13 June 2024. All legal citations should reference this document.

Which entities are covered by the EU AI Act?

The regulation applies to any provider that places an AI system or a general - purpose AI (GPAI) model on the Union market or puts it into service, and to any deployer that uses such systems in the EU, regardless of where the provider is established.

How does the EU AI Act define an “AI system”?

An AI system is a machine - based system that can operate with varying autonomy, may adapt after deployment, and generates outputs (predictions, content, recommendations, decisions) that can affect physical or virtual environments. The definition contains seven elements, but not all must be present at all times.

What are the four risk - based classifications and their obligations?

• Unacceptable risk - outright prohibited (e.g., social - scoring, real - time remote biometric identification in public spaces).
• High risk - must undergo conformity assessment, obtain a CE mark, produce technical documentation, and implement post - market monitoring.
• Limited risk - requires transparency information for users.
• Minimal risk - no specific obligations.

Which AI practices are explicitly prohibited?

The act lists nine prohibited practices, including:

1. Manipulation or deception that causes harm.
2. Exploitation of vulnerabilities.
3. Social - scoring of individuals.
4. Biometric categorisation for protected characteristics.
5. Real - time remote biometric identification for law - enforcement in public spaces.
6. Emotion - recognition in workplaces or education.
7. Untargeted scraping for facial - recognition databases.
8. Generation of non - consensual intimate material.
9. Generation of child - sexual - abuse material.

What obligations do high - risk AI providers face?

High - risk providers must:

• Implement a risk - management system (Art. 9).
• Ensure data - governance (Art. 10).
• Compile technical documentation covering at least 14 elements (Annex IV).
• Conduct conformity assessment and issue an EU Declaration of Conformity (Art. 47).
• Affix the CE mark.
• Set up post - market monitoring (Art. 72 - 73).

What must be included in the technical documentation?

Technical documentation must contain, at minimum:

1. System description and intended purpose.
2. Design and development details.
3. Data - set information and governance.
4. Risk - management records.
5. Testing and validation results.
6. Cybersecurity measures.
7. Bias and accuracy monitoring.
8. User instructions.
9. Post - market monitoring plan.
10. List of harmonised standards. (plus four additional required elements).

How are general - purpose AI models regulated?

Providers of GPAI models must supply a general description (tasks, architecture, parameters, modality, licence) and detailed development information (training methodology, data provenance, computational resources, energy consumption). Downstream providers must also receive this information.

When does a GPAI model become a systemic - risk candidate?

Any model that required ≥ 10²⁵ floating - point operations (FLOPs) to train is presumed systemic - risk. Providers must notify the European Commission, perform additional risk - assessment, conduct adversarial testing, and report incidents.

What are the key implementation timelines?

• 1 Aug 2024 - Act entered into force.
• 2 Feb 2025 - Prohibited practices and AI - literacy obligations apply.
• 2 Aug 2025 - Governance rules for GPAI start.
• 2 Aug 2026 - Originally the date full high - risk obligations were due to start; a 2026 "Digital Omnibus" amendment (in force since 27 July 2026) postponed this.
• 2 Dec 2027 - High - risk obligations now apply to stand - alone (Annex III) high - risk AI systems.
• 2 Aug 2028 - High - risk obligations apply to AI embedded in regulated products (Annex I).

What penalties can be imposed for non - compliance?

Article 99 sets three tiers: up to €35 million or 7 % of global annual turnover for violating the Article 5 list of prohibited practices (whichever is higher); up to €15 million or 3 % for most other high - risk - system non - compliance; and up to €7.5 million or 1 % for supplying misleading information to authorities. SMEs and start - ups pay whichever figure in each tier is lower, not higher.

Which bodies enforce the EU AI Act?

• AI Office (European Commission) - central coordinator, regulator for GPAI, can request documentation and issue corrective measures.
• National competent authorities - conduct market surveillance and enforce at the Member - State level.
• AI Board - advisory panel of experts.

When do transparency obligations for interacting AI systems start?

Providers must inform users that they are interacting with AI (Art. 50) from 2 Aug 2026. Systems placed before that date have a grace period until 2 Dec 2026.

How should a provider set up post - market monitoring?

Providers must establish a monitoring system that collects performance data from deployers, reports serious incidents to the AI Office, and feeds the results back into the risk - management process.

What data - governance steps are required?

Providers must ensure data quality, relevance, and representativeness, and document all data - management procedures, including bias mitigation strategies.

All facts are drawn from Regulation 2024/1689 and the EU’s official implementation guides hosted on Eur - Lex and the European Commission AI Act Service Desk.