AI compliance
EU AI Act
The world's first comprehensive AI regulation is already in force. We help companies understand their obligations and meet them without bringing their AI operations to a halt.
Compliance isn't governance. This page covers the legal obligations: the EU AI Act and the GDPR. The governance model — which systems you run, who answers for them, and when they get shut down — lives in AI governance, and it produces much of the evidence the law requires.
EU AI Act timeline
The dates that set when each obligation applies
The Regulation enters into force and the transition period begins.
AI systems posing an unacceptable risk are banned: social scoring, subliminal manipulation, exploitation of vulnerabilities, and emotion recognition in the workplace and in education.
Providers of LLMs and other general-purpose AI models must meet requirements on transparency, technical documentation, and copyright.
People must be told when they are interacting with AI, and generated or manipulated content (including deepfakes) must be labeled. For content already on the market, the marking deadline is December 2026.
The Digital Omnibus adds to the Regulation a ban on systems that generate non-consensual intimate or sexual images of real people, as well as AI-generated child sexual abuse material.
Full obligations for stand-alone high-risk AI systems: HR and recruitment, credit scoring, education, critical infrastructure, essential services, migration, and justice. Postponed from August 2026 by the Digital Omnibus.
Obligations for AI embedded in products covered by EU sectoral legislation (medical devices, machinery, toys, and more). Postponed from August 2027.
The Digital Omnibus (2026) has reshaped the timeline
The first reform of the EU AI Act postponed the high-risk rules — but it didn't scrap them, and it left untouched both the prohibitions already in force and the obligations for general-purpose AI (GPAI) models. Getting ready for conformity takes 6 to 18 months: December 2027 is closer than it looks.
How does the EU AI Act affect you?
The impact depends on your role in the AI value chain and the kind of systems you use or build. Most companies think it doesn't affect them — and they're almost always wrong.
Social scoring, subliminal manipulation, emotion recognition at work or in education (with exceptions) and, since the 2026 reform, “nudifiers” and AI-generated child sexual abuse material. Banned since February 2025; the last two, from December 2026.
AI in HR, credit, education, critical infrastructure, healthcare, and insurance. Requires a conformity assessment, technical documentation, registration in the EU database, and human oversight.
Chatbots and content-generating systems. Users must be told they are interacting with AI, and deepfakes must be labeled.
Spam filters, AI-enabled video games, and content recommendations on platforms. No specific regulatory obligations (though the GDPR still applies).
Our compliance service
We map every AI system you use or build, including the ones you don't think of as “AI” (scoring, automations, predictive models).
We classify each system against the EU AI Act criteria, flagging which ones fall into high-risk categories and which may sit in a gray area.
We compare where you are today with the requirements that apply to you, and prioritize by urgency (deadlines) and impact (the cost of non-compliance).
We prepare the required documentation: system technical file, risk assessment, training data records, and oversight procedures.
We train the people responsible for your AI systems on the obligations that apply and on how to stay compliant over time.
Frequently asked questions
What is the EU AI Act?
The EU AI Act is the world's first comprehensive regulation on artificial intelligence. Adopted in 2024, it classifies AI systems by risk level and sets obligations according to that classification. Its goal is to ensure that AI in the EU is safe, transparent, and respectful of fundamental rights.
Does the Digital Omnibus delay the AI Act? Can I relax?
Not entirely. The Digital Omnibus (adopted in 2026, the first reform of the Regulation) postponed full application of the high-risk obligations: to December 2, 2027 for stand-alone systems (Annex III) and to August 2, 2028 for AI embedded in regulated products (Annex I). But it didn't remove anything. Prohibited AI practices have been banned since February 2025, providers of general-purpose AI models have had to comply since August 2025, and the transparency obligations apply from August 2026. Since getting ready for conformity takes 6 to 18 months, you have less time than it seems.
Does my company need to comply with the EU AI Act?
If your company operates in the EU, or its products or services are used in the EU, the Act applies. It covers both providers of AI systems (those who develop them) and deployers (companies that use them in a professional context). Most companies have at least one limited-risk system, such as a chatbot or a content generator.
What are the penalties for non-compliance?
The fines, set out in Article 99 of the Regulation, reach up to €35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (prohibited AI practices); up to €15 million or 3% (obligations of providers, deployers, and other operators, including the transparency obligations); and up to €7.5 million or 1% (supplying incorrect, incomplete, or misleading information to authorities or notified bodies). For SMEs and start-ups, the lower of the two amounts applies. Penalties are proportionate to the size of the company and the seriousness of the infringement.
Does it affect companies that only use third-party AI?
Yes. If you use high-risk AI systems in your operations (for example, HR software that scores candidates), you have obligations as a “deployer” even if you didn't develop the system. You must check that the provider complies, configure the system correctly, and maintain human oversight.