If you publish “AI news” long enough, you start noticing a pattern: most people don’t fear AI… they fear surprise compliance.

That’s basically the EU AI Act in one line: the EU doesn’t want to ban AI; it wants AI systems to be predictable, documented, and safe—especially in high-stakes areas.

This guide is written for the person who’s thinking:

• “Do I need to worry if my AI tool is just a feature?”
• “What’s the difference between prohibited vs high-risk?”
• “What do we actually have to DO… and by WHEN?”
• “Are the fines real, or just headline bait?”

Let’s break it down in practical terms.

What is the EU AI Act?

The EU AI Act is the European Union’s cross-industry law for regulating AI based on risk level. Instead of one-size-fits-all, it sorts AI into buckets (risk tiers) and assigns obligations accordingly.

The Act entered into force on August 1, 2024, and it becomes fully applicable on August 2, 2026, with phased deadlines depending on the topic/system type. (Digital Strategy)

EU AI Act Timeline (the dates people keep getting wrong)

Here are the key milestones you should know (and save):

• Aug 1, 2024 — AI Act entered into force (Digital Strategy)
• Feb 2, 2025 — Prohibited AI practices + AI literacy obligations start applying (Digital Strategy)
• Aug 2, 2025 — Governance rules + obligations for General-Purpose AI (GPAI) models apply (Digital Strategy)
• Aug 2, 2026 — The Act is fully applicable (big compliance moment for many orgs) (Digital Strategy)
• Aug 2, 2027 — Extra transition time for high-risk AI embedded in regulated products (Digital Strategy)

Why this matters: a lot of teams are mistakenly planning everything around “2026,” but some rules already applied in 2025, and GPAI obligations kicked in Aug 2025. (Digital Strategy)

The EU AI Act Risk Tiers (simple version)

1) Prohibited (Unacceptable Risk)

These are AI practices the EU basically says: Nope, not in Europe.

If you’re anywhere near this category, you don’t “mitigate”—you stop.

2) High-Risk

This is the category that creates the most work: documentation, risk management, data governance, human oversight, monitoring, and in some cases conformity assessments/registration.

High-risk usually means: it can materially affect someone’s life outcomes (job, education, credit, healthcare, essential services, safety).

If you’re building HR tools, this matters a lot—especially if you’re doing AI screening/interviewing. (Related: if you’re experimenting with hiring workflows, you’ll probably also care about whether mock interview AI plugs into recruiting systems—here’s a deep dive: https://aitribune.net/2026/02/22/can-you-integrate-mock-interview-ai-with-ats-recruitment-systems/)

3) Limited Risk (Transparency Requirements)

Think: chatbots, synthetic media labeling, “you are interacting with AI” type disclosures.

4) Minimal Risk

Most normal AI features (recommendations, spam filters, game AI, etc.) fall here—few obligations.

The part everyone asks about: EU AI Act fines (yes, they’re serious)

Penalty ranges depend on what you violate:

• Up to €35 million or 7% of global annual turnover for the most severe violations (often tied to prohibited practices) (ibm.com)
• Up to €15 million or 3% of global annual turnover for many other violations, including high-risk requirements (ibm.com)

For GPAI providers, the EU Commission can issue fines up to €15 million or 3% of global turnover in certain cases. (ai-act-service-desk.ec.europa.eu)

One important nuance: member states set enforcement details, but the Act sets these upper limits and structure. (artificialintelligenceact.eu)

General-Purpose AI (GPAI) rules (the “foundation model” section)

If you provide a general-purpose AI model, you may have obligations like:

• Keeping technical documentation
• Sharing info/docs with downstream providers so they can comply
• Cooperating with oversight requests (Digital Strategy)

There’s also the idea of “systemic risk” models. The EU notes a presumption that GPAI models may be systemic-risk if trained above a compute threshold (commonly discussed as 10^25 FLOP), and that threshold has been under review. (Digital Strategy)

In real life: even if you’re “just” an app company, if you fine-tune, wrap, or distribute powerful models—someone on your team should understand where your responsibilities begin and end.

Practical: “Am I impacted?” (a fast self-check)

You’re likely impacted if you do any of these in the EU market:

• Build AI systems or models (provider)
• Deploy/use AI internally or for customers (deployer)
• Import/distribute AI into the EU (importer/distributor)
• Offer AI features for: hiring, education, credit, healthcare, biometrics, safety, essential services

Even if you’re outside Europe, if your product is used in the EU, this can still matter.

What companies are saying (real-world “reviews” and reactions)

This isn’t just policy theory—companies have been pushing back publicly.

• Reuters reported that the European Commission said there would be no “stop the clock” on implementation, despite calls from major firms and lobbying groups to pause or delay parts of the rollout. (Reuters)
• Concerns often center on compliance burden, unclear guidance, and innovation slowdowns, especially for fast-moving AI product cycles. (Reuters)

If you’ve ever tried to ship a feature while legal asks for “one more review,” you already understand the emotional truth here. My own take: the hard part isn’t the rules—it’s building a repeatable process so every launch doesn’t feel like a brand-new audit.

(If you’re trying to operationalize that process, you’ll like this ISO-style compliance angle too: https://aitribune.net/2026/02/22/how-to-use-ai-to-support-integrated-iso-audits/)

EU AI Act Compliance Checklist (practical, not fluffy)

Here’s a workable checklist you can adapt—whether you’re a startup or a big org.

1) Inventory every AI system (yes, even “small” ones)

Make a list of:

• Features that use ML/LLMs
• Vendor tools with AI baked in
• Internal automations (support, HR, finance, risk)

Output: one spreadsheet that answers: What is it? Who owns it? What data? What decisions does it influence?

2) Classify by risk tier (Prohibited / High-Risk / Limited / Minimal)

If you’re not sure, classify conservatively and document your reasoning.

3) For high-risk: build your compliance “packet”

Expect to need structured work around:

• Risk management approach
• Data governance
• Human oversight
• Logging/monitoring
• Documentation for regulators and customers

4) For transparency-risk tools: label clearly

If users interact with AI, consider:

• Disclosure (“you’re interacting with AI”)
• Synthetic content labeling (where applicable)
• Clear limitations (what it can’t do)

5) Vendor management: stop trusting “we’re compliant” slides

Get real answers:

• What model is used?
• Where is data processed?
• What documentation will they share?
• What audit support do they provide?

6) Train your people (AI literacy isn’t optional)

AI literacy obligations started applying Feb 2, 2025. That doesn’t mean everyone needs to be an ML engineer. It means your org should be able to demonstrate competent use and awareness of risks. (Digital Strategy)

7) Put a launch gate in your product process

This is my “learned the hard way” point: if compliance lives only in legal’s inbox, everything becomes a fire drill.

Instead, add a lightweight gate:

• AI feature? → classification done?
• High-risk? → packet updated?
• Transparency? → disclosures added?

This is the same mindset as mature safety programs in industrial settings—if you’re curious how “industrial AI” differs from typical AI and why governance looks different there, this is a useful read: https://aitribune.net/2026/02/22/how-does-industrial-ai-differ-from-traditional-ai/

Common EU AI Act Mistakes I’m seeing in 2026

1. Thinking “we’re too small”
   SMEs may get proportional treatment in some contexts, but the rules can still apply. Penalties also scale by turnover in many cases. (artificialintelligenceact.eu)
2. Assuming your vendor carries all responsibility
   Sometimes yes, often no. Deployers have duties too (especially in high-impact contexts).
3. Waiting until 2026 to start
   Prohibitions and literacy started in 2025, GPAI obligations in 2025. (Digital Strategy)

FAQ: EU AI Act

Is the EU AI Act already in effect?
It entered into force Aug 1, 2024, and some rules started applying in Feb 2025 and Aug 2025. (Digital Strategy)

When is it fully applicable?
Aug 2, 2026 (with some longer transitions for certain regulated-product high-risk systems). (Digital Strategy)

What are the maximum fines?
Up to €35M or 7% for the most serious violations; up to €15M or 3% for many others. (ibm.com)

Do GPAI/foundation models have special rules?
Yes—technical documentation and downstream support obligations, with additional requirements for systemic-risk models. (Digital Strategy)