The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the first comprehensive AI law in the world, and its reach extends well beyond Europe. If your organization builds, buys or deploys AI systems whose outputs are used in the EU, some of it applies to you. Here is what matters at the leadership level.
It applies to you even if you are not in Europe
The Act is extraterritorial. It covers providers that place AI systems on the EU market and deployers that use AI within the EU, and it also covers providers and deployers located outside the EU when the output of their system is used in the EU. For most multinationals, that means the question is not whether the Act applies, but which obligations apply to which systems.
Obligations scale with risk
The Act sorts AI systems into tiers. A small set of practices is prohibited outright, including manipulative systems and untargeted facial-image scraping. High-risk systems, such as AI used in hiring, credit decisions, critical infrastructure and essential services, carry the heaviest obligations. Limited-risk systems carry transparency duties, such as telling people they are interacting with AI or labelling synthetic content. Minimal-risk systems, which is most everyday business AI, carry no new obligations beyond existing law.
The key dates have passed
The Act entered into force in August 2024 and has been phasing in since. Prohibited practices and the AI literacy requirement took effect on 2 February 2025. Obligations for general-purpose AI models followed on 2 August 2025. The high-risk obligations, which are the ones with real operational weight for enterprises, became enforceable on 2 August 2026. The compliance clock is no longer counting down; it is running.
What high-risk obligations actually require
For providers, the obligations span risk management, data governance and data quality, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity, plus conformity assessment and registration in the EU database. For deployers, the duties are more operational but still significant: use the system in accordance with the provider’s instructions, assign competent human oversight, retain automatically generated logs for at least six months, and inform people affected by decisions the system makes.
AI literacy is a legal requirement, not a nice-to-have
Article 4 requires providers and deployers to ensure that staff working with AI systems have a sufficient level of AI literacy, taking into account their role and the context of use. This has applied since February 2025 and covers every organization using AI in scope, regardless of risk tier. It is also simply good practice: teams that understand what AI can and cannot do make better decisions and fewer mistakes.
The penalties are material
Fines are tiered by severity. Prohibited practices carry penalties of up to €35 million or 7% of global annual turnover, whichever is higher. Non-compliance with most other obligations, including the high-risk requirements, carries up to €15 million or 3% of global turnover. Supplying incorrect information to authorities carries up to €7.5 million or 1%. For a large enterprise, the percentage figures are the ones that matter.
What to do now
Inventory the AI you use and classify each system by risk tier. Determine whether you are a provider or a deployer for each one, because the obligations differ. Put governance in place that produces evidence: documentation, oversight assignments, logs and training records. The organizations that find enforcement uneventful are the ones whose documentation already exists.
This article summarizes the Regulation as published and is not legal advice. Confirm obligations for your specific systems with counsel.
Sources: Regulation (EU) 2024/1689 (EUR-Lex); EU Artificial Intelligence Act explorer.
Need a hand getting governance in place? Our AI Governance & Risk team takes organizations from exposure to evidence.
Connect With Us