The EU AI Act: A roadmap for trustworthy AI

The European Union's Artificial Intelligence Act (AI Act) establishes a comprehensive legal framework for AI systems sold or used in the EU, including those built by companies based elsewhere. The European Parliament approved the Act on March 13, 2024, the Council of the EU gave its final approval on May 21, 2024, and the legislation entered into force on August 1, 2024. 

‍

The AI Act uses a risk-based approach: The greater the potential harm an AI system poses, the stricter the requirements. It prohibits certain uses of AI deemed unacceptable, establishes transparency requirements for specific AI systems, regulates general-purpose AI models, and imposes comprehensive obligations on high-risk systems. Depending on an organization’s role and the system involved, these obligations can include risk management, data governance, technical documentation, recordkeeping, human oversight, accuracy, robustness, and cybersecurity.

‍

The Act is intended to promote safe and trustworthy AI while protecting fundamental rights, including privacy, non-discrimination, and consumer protection. At the same time, it aims to create a harmonized regulatory environment that gives businesses greater legal clarity and supports AI development and adoption across the EU.

‍

The framework also includes measures designed to support innovation. These include national regulatory sandboxes, opportunities to test AI systems under regulatory supervision, and simplified requirements for certain small and mid-sized businesses. The AI Omnibus, which entered into force on July 27, 2026, expanded access to these programs and introduced plans for an EU-level regulatory sandbox. 

‍

In this blog, we’ll explain what the AI Act is, what it includes, and when its requirements apply.

‍

What is the AI Act and what’s in it?

The AI Act creates a uniform legal framework for the development, placement on the market, deployment, and use of AI systems across the European Union. It is intended to ensure that AI is used in a manner consistent with the EU’s values, including respect for fundamental rights, democracy, the rule of law, and environmental protection. The Act also supports the free movement of AI-based goods and services within the EU’s internal market by limiting fragmented national requirements.

‍

The Act is organized into 13 chapters covering the following areas:

1. General Provisions (Chapter I): Defines the Act’s subject matter, scope, key terms, and provisions related to AI literacy.
2. Prohibited AI Practices (Chapter II): Identifies AI practices that are banned because they pose an unacceptable risk to people’s safety or fundamental rights. The AI Omnibus expanded this chapter to prohibit AI systems that generate certain non-consensual sexually explicit or intimate content and child sexual abuse material.
3. High-Risk AI Systems (Chapter III): Establishes how high-risk AI systems are classified and sets requirements for providers, deployers, importers, distributors, and other operators. It also covers conformity assessments, registration, technical documentation, human oversight, and post-deployment responsibilities.
4. Transparency Obligations (Chapter IV): Establishes disclosure and labeling requirements for certain AI systems and content, including chatbots, deepfakes, emotion-recognition systems, and AI-generated or manipulated content.
5. General-Purpose AI Models (Chapter V): Sets requirements for providers of general-purpose AI models, including documentation, copyright compliance, and information-sharing obligations. Providers of models that pose systemic risk are subject to additional evaluation, risk-management, incident-reporting, and cybersecurity requirements.
6. Measure in Support for Innovation (Chapter VI): Introduces measures such as AI regulatory sandboxes, real-world testing, and support for smaller businesses. The AI Omnibus expanded access to these programs and added an EU-level regulatory sandbox.
7. Governance (Chapter VII): Establishes the EU’s AI governance structure, including the AI Office, European Artificial Intelligence Board, Scientific Panel, and Advisory Forum. The AI Omnibus also strengthened the AI Office’s oversight of certain AI systems and general-purpose AI models.
8. EU Database for High-Risk AI Systems (Chapter VIII): Establishes registration requirements and an EU database intended to increase transparency around certain high-risk AI systems.
9. Post-Market Monitoring, Information Sharing, and Market Surveillance (Chapter IX): Covers ongoing monitoring, serious-incident reporting, enforcement, and cooperation among EU and national authorities.
10. Codes of Conduct and Guidelines (Chapter X): Supports voluntary application of trustworthy AI practices to systems that are not classified as high-risk and provides for Commission guidance on implementing the Act.
11. Delegation of Power and Committee Procedure (Chapter XI): Establishes the procedures through which the European Commission can adopt delegated and implementing acts.
12. Penalties (Chapter XII): Defines the penalties and administrative fines that may apply when organizations violate the Act.
13. Final Provisions (Chapter XIII): Covers amendments to other EU legislation, transitional arrangements, evaluations, reporting, and the Act’s phased application.

‍

Since its original adoption, the AI Act has been amended by the AI Omnibus. The changes do not replace its fundamental risk-based structure, but they do affect when certain requirements apply and how some organizations can comply. In particular, requirements for high-risk systems listed in Annex III now apply from December 2, 2027, while requirements for high-risk systems embedded in regulated products covered by Annex I apply from August 2, 2028.

‍

{{cta_withimage37="/cta-blocks"}} | EU AI Act checklist

‍

Timeline of the EU AI Act implementation

The EU AI Act is being implemented in phases, with different chapters, sections, and articles applying through August 2028. The AI Omnibus, which entered into force in July 2026, extended the deadlines for requirements covering high-risk AI systems while leaving most other milestones unchanged. 

‍

From February 2, 2025

• Chapters I and II: The Act’s foundational provisions apply, including its scope, definitions, AI literacy requirements, and prohibited AI practices.
  
  • Chapter I: General provisions, including subject matter, scope, definitions, and AI literacy
  • Chapter II: Prohibited AI practices, excluding the additional prohibitions introduced by the AI Omnibus that apply from December 2, 2026

‍

From August 2, 2025

• Chapter III, Section 4; Chapter V; Chapter VII; Chapter XII, and Article 78 applied, except for Article 101: Provisions covering notified bodies, general-purpose AI models, EU governance, and penalties apply.
  
  • Chapter III, Section 4: Notifying authorities and notified bodies
  • Chapter V: General-purpose AI models
  • Chapter VII: EU-level AI governance
  • Chapter XII: Penalties, subject to the Act’s transitional provisions

‍

From August 2, 2026

• Most remaining provisions of the AI Act: The Act becomes broadly applicable, and EU and national authorities can begin enforcing the requirements that are in effect.
  
  • Chapter III, Section 5: Standards, conformity assessment, certificates, and registration for high-risk AI systems
  • Chapter IV: Transparency obligations for certain AI systems
  • Chapter VI: Measures supporting innovation, except for the revised deadline for national regulatory sandboxes
  • Chapters VIII–XI and XIII: EU database provisions, post-market monitoring, information sharing, market surveillance, delegated powers, and remaining final provisions
  • Enforcement begins for applicable rules covering prohibited practices, AI literacy, general-purpose AI models, and transparency

‍

From December 2, 2026

• Chapter II and Article 50(2): Additional prohibitions and a transitional transparency deadline apply.
  
  • Chapter II: New prohibitions covering AI-generated or manipulated non-consensual intimate content and child sexual abuse material
  • Article 50(2): Deadline for certain providers of AI systems placed on the market before August 2, 2026 to comply with machine-readable marking requirements for AI-generated content

‍

From August 2, 2027

• Chapter VI, Article 57: Each EU Member State should have at least one AI regulatory sandbox operational.
• Chapter V: General-purpose AI models placed on the market before August 2, 2025 must comply with the applicable requirements.

‍

From December 2, 2027

• Chapter III, Sections 1–3 apply to Article 6(2)/Annex III high-risk systems from December 2, 2027, except for Article 6(5): Requirements for standalone high-risk AI systems apply.
  
  • Section 1: Classification of high-risk AI systems
  • Section 2: Requirements for high-risk AI systems
  • Section 3: Obligations of providers, deployers, and other operators
  • Covered Annex III use cases include certain AI systems used in employment, education, essential services, law enforcement, migration, and the administration of justice.

‍

From August 2, 2028

• Chapter III, Sections 1–3, except Article 6(5), apply to high-risk systems covered by Article 6(1) and Annex I from 2 August 2028: Requirements apply to high-risk AI systems embedded in regulated products covered by Annex I.
  
  • These include certain AI systems used as safety components in products such as medical devices, machinery, toys, lifts, and other products governed by EU product-safety legislation.

‍

From August 2, 2030

• Article 111(2): Legacy high-risk AI systems used by public authorities must comply.
  
  • Providers and deployers of high-risk AI systems that were placed on the market or put into service before the relevant high-risk application dates are generally in scope only if those systems undergo significant design changes. High-risk systems intended to be used by public authorities are an exception: they must be brought into compliance by this date regardless.

‍

From December 31, 2030

• Annex X: High-risk AI components of large-scale EU IT systems must comply.
  
  • AI systems that are components of the large-scale IT systems listed in Annex X and that were placed on the market or put into service before August 2, 2027 must be brought into compliance by the end of 2030.

‍

{{cta_webinar7="/cta-blocks"}} | EU AI Act webinar

‍

Why this timeline?

The revised schedule gives organizations more time to comply with the requirements for high-risk AI systems, but many foundational, transparency, governance, and general-purpose AI obligations are already applicable.

‍

The EU AI Act’s phased rollout gives organizations time to prepare, but waiting until every requirement takes effect could create unnecessary risk. By identifying where AI is already used, understanding which systems and roles fall within the Act’s scope, and building governance into existing risk and compliance programs now, businesses can adapt as requirements evolve. A proactive approach will help organizations prepare for compliance while enabling AI adoption that is responsible, sustainable, and worthy of trust.

‍

{{cta_simple31="/cta-blocks"}} | EU AI Act landing