Regulation (EU) 2024/1689, the Artificial Intelligence Act, is the first comprehensive horizontal legal framework for artificial intelligence adopted by any major jurisdiction. It entered into force on 1 August 2024 and is being applied in stages. Several of its obligations already bind organisations today, and its penalty regime exceeds even that of the GDPR.
Any organisation that develops, imports, distributes or uses AI systems in the European Union, or whose AI output is used in the Union, should treat the AI Act as a board-level compliance matter rather than a technical footnote.
Why the AI Act matters
- Extraterritorial reach. Like the GDPR, the Act applies to providers and deployers established outside the EU where their AI systems are placed on the EU market or their output is used in the Union.
- Obligations for users, not only vendors. Deployers, meaning organisations that use AI systems in a professional capacity, carry their own duties, including human oversight, monitoring and, in some cases, fundamental rights impact assessments.
- Procurement and market access. Customers, insurers and public buyers increasingly require evidence of AI Act readiness as a condition of contract.
- Trust and reputation. Documented, governed AI is easier to defend to regulators, employees and the public when outcomes are challenged.
The risk-based structure
The Act regulates AI according to the risk a use case presents, not according to the underlying technology.
- Unacceptable risk (prohibited). Practices banned under Article 5, including manipulative techniques that cause significant harm, social scoring, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and educational institutions, subject to narrow exceptions.
- High risk. Systems used in sensitive domains listed in Annex III, such as recruitment and workforce management, education, access to essential services, credit scoring, critical infrastructure, law enforcement and migration, together with AI that forms a safety component of regulated products under Annex I. These carry the heaviest obligations: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, and conformity assessment.
- Transparency obligations. Under Article 50, people must be informed when they interact with an AI system, and AI-generated or manipulated content, including deepfakes, must be identifiable as such.
- Minimal risk. Most AI applications, such as spam filters or inventory forecasting, carry no specific obligations beyond existing law.
General-purpose AI models, the foundation models underlying many generative AI services, are subject to a separate regime covering technical documentation, copyright policy and, for models with systemic risk, evaluation and incident reporting.
The timeline after the Digital Omnibus
The original timeline was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The Omnibus postpones the high-risk obligations but removes no category of obligation. The current schedule is as follows:
| Date | Milestone |
|---|---|
| 2 February 2025 | Prohibited practices under Article 5 apply |
| 2 August 2025 | Obligations for general-purpose AI models and the penalty regime apply |
| 2 August 2026 | Article 50 transparency obligations apply |
| 2 December 2026 | End of transitional period for watermarking by systems already on the market, and for the new prohibitions added by the Omnibus |
| 2 December 2027 | High-risk obligations apply to Annex III systems (employment, education, credit, biometrics and others) |
| 2 August 2028 | High-risk obligations apply to AI embedded in regulated products under Annex I |
The postponement should not be read as a reprieve. The deferral was justified by delays in harmonised standards and in the designation of national authorities, not by any softening of substance. Building a compliant risk management system, documentation set and oversight model for a high-risk system typically takes longer than the time that remains.
The penalty regime: what non-compliance can cost
Article 99 establishes three tiers of administrative fines. For undertakings, the ceiling is the higher of a fixed amount or a percentage of total worldwide annual turnover for the preceding financial year.
| Infringement | Maximum fine |
|---|---|
| Use or placing on the market of a prohibited AI practice (Article 5) | EUR 35 million or 7% of worldwide annual turnover |
| Breach of most other obligations, including those of providers, importers, distributors and deployers, high-risk requirements and Article 50 transparency duties | EUR 15 million or 3% of worldwide annual turnover |
| Supplying incorrect, incomplete or misleading information to notified bodies or national authorities | EUR 7.5 million or 1% of worldwide annual turnover |
For comparison, the maximum fine under the GDPR is EUR 20 million or 4% of worldwide turnover. The top tier of the AI Act is therefore substantially higher.
Further penalty provisions
- Providers of general-purpose AI models may be fined by the European Commission under Article 101 up to EUR 15 million or 3% of worldwide turnover, for example for failing to supply documentation or to comply with requests for information.
- SMEs and start-ups are subject to the lower of the two amounts in each tier rather than the higher. The Digital Omnibus extends comparable treatment to small mid-cap enterprises.
- EU institutions and bodies are subject to a separate fining regime administered by the European Data Protection Supervisor under Article 100.
- Non-monetary measures are available to national authorities, including orders to withdraw or recall a system from the market. Member States may also lay down additional penalties under national law.
An illustrative calculation
Consider a group with worldwide annual turnover of EUR 2 billion that deploys a prohibited emotion-recognition system to monitor employees. Seven per cent of turnover is EUR 140 million, which exceeds the EUR 35 million fixed amount; the ceiling is therefore EUR 140 million. The same group failing to meet its deployer obligations for a high-risk recruitment system would face a ceiling of EUR 60 million (3% of turnover). A small enterprise with EUR 5 million in turnover committing the same high-risk breach would face a ceiling of EUR 150,000, being the lower of the two amounts.
These figures are maxima, not expected outcomes. Under Article 99(7), authorities must consider the nature, gravity and duration of the infringement, the number of persons affected, the size and market share of the operator, any previous infringements, the degree of cooperation, measures taken to mitigate harm, and whether the infringement was intentional or negligent. Demonstrable governance and prompt remediation therefore reduce exposure materially.
Steps to take now
- Build an AI inventory. Identify every AI system in development, procurement and use, including AI features embedded in SaaS products.
- Classify each system. Determine the risk category and the organisation’s role (provider, deployer, importer or distributor) for each use case.
- Eliminate prohibited practices immediately. These have applied since February 2025 and carry the highest fines.
- Implement transparency measures. Chatbots, virtual assistants and generated content must meet Article 50 requirements, which already apply.
- Prepare high-risk systems. Establish risk management, data governance, documentation, logging and human-oversight processes well ahead of December 2027.
- Review supplier contracts. Require vendors to provide the documentation, instructions for use and cooperation that deployers need to meet their own obligations.
- Align with existing frameworks. Integrate AI Act controls with GDPR data protection impact assessments, information security management and sector-specific regulation rather than building a parallel structure.
Conclusion
The AI Act is already in application. Prohibitions, general-purpose AI obligations, transparency duties and the penalty regime are all in force, and high-risk obligations follow in 2027 and 2028. With fines reaching EUR 35 million or 7% of worldwide turnover, the cost of inaction substantially exceeds the cost of structured preparation. Organisations that inventory, classify and govern their AI now will be positioned not only to avoid penalties but to deploy AI with greater confidence.
CloudOptly supports organisations with AI Act readiness assessments, AI inventories and risk classification, and governance frameworks aligned with GDPR and information security requirements.
This article provides general information and does not constitute legal advice.