# EU AI Act

The EU law on artificial intelligence: who it reaches, how it sorts systems by risk, what applies when, and who enforces it.

Source: https://sted.digital/docs/standards/eu-ai-act · Last reviewed 17 October 2026 · Strand Standards and regulations

The EU AI Act is the European Union's law on artificial intelligence. It applies to anyone who puts an AI system on the EU market, uses one in the EU, or whose system's output is used there, wherever they are based. Duties scale with risk, from banned uses to high-risk systems. Regulators enforce it; there is no certificate.

## What it is and who it applies to

The formal designation is Regulation (EU) 2024/1689, which entered into force on 1 August 2024. It has been amended once: Regulation (EU) 2026/1744 of 8 July 2026, in force on 27 July 2026, moved the high-risk dates, softened the AI literacy duty, added two prohibitions and made room for smaller firms. The current consolidated text on [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727) includes those changes. The [timeline](/docs/standards/eu-ai-act/timeline) lists every date.

An AI system, for the Act, is a machine-based system that works with some autonomy and infers from its inputs how to produce outputs such as predictions, content, recommendations or decisions (EU AI Act Article 3(1)). Rule-based software that only follows instructions a person wrote is outside it; most products built on a machine-learning model are inside.

Who it reaches is set by EU AI Act Article 2(1). The two roles that matter most are:

- **Provider**: you develop an AI system or a general-purpose model, or have one developed, and put it on the market or into service under your own name, free or paid.
- **Deployer**: you use an AI system under your authority, other than for personal non-professional use.

The Act also covers importers, distributors, product manufacturers who ship an AI system inside their own product, and the authorised representative a non-EU provider appoints. Location does not save you: a provider or deployer outside the EU is in scope when the system's output is used in the EU. Roles can move, too. A deployer who rebrands a high-risk system, changes it substantially or turns a general system to a high-risk purpose becomes its provider (EU AI Act Article 25).

Military and defence uses, scientific research before a system is marketed, and purely personal use fall outside the Act.

This is guidance to help you understand the requirement, not legal advice.

## Structure

The Act runs from Article 1 to Article 113 in 13 chapters, with Articles 4a, 60a and 75a inserted in 2026, and has 14 annexes since the 2026 amendment added Annex XIV. You meet it by risk tier, so the table groups the chapters that way. It paraphrases each part.

| Chapter and articles | What it asks for, in plain English | Covered in |
|---|---|---|
| I, Articles 1 to 4 | Purpose, scope, definitions, and AI literacy measures for staff | [AI literacy](/docs/standards/eu-ai-act/ai-literacy) |
| II, Article 5 | Eight uses of AI banned outright, and two more from 2 December 2026 | [Prohibited practices](/docs/standards/eu-ai-act/prohibited-practices) |
| III, Articles 6 and 7 | When a system is high-risk: Annex I products and Annex III uses | [Risk classification](/docs/standards/eu-ai-act/risk-classification) |
| III, Articles 8 to 27 | What a high-risk system must meet and what providers, deployers, importers and distributors must do | [High-risk obligations](/docs/standards/eu-ai-act/high-risk-obligations) |
| III, Articles 28 to 49 | Notified bodies, standards, conformity assessment, declaration, CE marking and registration | [High-risk obligations](/docs/standards/eu-ai-act/high-risk-obligations) |
| IV, Article 50 | Telling people they are dealing with AI, and marking or labelling generated content | [Transparency obligations](/docs/standards/eu-ai-act/transparency-obligations) |
| V, Articles 51 to 56 | Duties of providers of general-purpose AI models, and more for those with systemic risk | [General-purpose AI models](/docs/standards/eu-ai-act/general-purpose-ai-models) |
| VI, Articles 57 to 63 | Regulatory sandboxes, real-world testing and help for smaller firms | This hub |
| VII and VIII, Articles 64 to 71 | The AI Office, the AI Board, national authorities and the EU database | This hub |
| IX, Articles 72 to 94 | Post-market monitoring, serious incident reports and market surveillance | [High-risk obligations](/docs/standards/eu-ai-act/high-risk-obligations) |
| X to XII, Articles 95 to 101 | Voluntary codes of conduct, Commission powers and penalties | This hub |
| XIII, Articles 102 to 113 | Changes to other EU laws, transitional rules and application dates | [Timeline](/docs/standards/eu-ai-act/timeline) |

Three annexes do most of the work for a reader. Annex I lists the EU product laws, such as the medical device and toy safety rules, whose products can make an AI system high-risk. Annex III lists the eight high-risk use areas. Annex IV sets out the technical documentation a high-risk provider keeps.

Most systems land in the bottom tier, minimal risk, where the Act adds nothing beyond AI literacy. A chatbot or a content generator adds the Article 50 transparency duties. Only banned uses and high-risk systems carry the heavy obligations.

## Certification and enforcement

There is no certificate for the AI Act. A high-risk system goes through a conformity assessment before it reaches the market (EU AI Act Article 43). For most Annex III uses the provider assesses itself against the requirements under an internal-control procedure; remote biometric systems can need a notified body. A system inside an Annex I product follows that product's own procedure, so an AI-based medical device is assessed by the notified body that assesses the device under the [EU MDR](/docs/standards/eu-mdr). The provider then signs an EU declaration of conformity, affixes the CE marking and, for Annex III systems, registers in the EU database.

Enforcement is shared. Each Member State designates at least one market surveillance authority and one notifying authority (EU AI Act Article 70). Where the AI sits inside a regulated product, that product's existing market surveillance authority usually acts. The European Commission's AI Office supervises providers of general-purpose AI models, and the European Artificial Intelligence Board of Member State representatives coordinates the authorities and advises the Commission.

What triggers action is mostly what triggers it under other EU product law: a complaint, a serious incident report, a market check, or a system that presents a risk. In practice the tools run from requests for documentation and access, through orders to bring a system into conformity, to restricting, withdrawing or recalling it, and then to fines.

Penalties are set by each Member State within ceilings in the Act. The highest ceiling, for a prohibited practice, is €35 million or 7% of total worldwide annual turnover, whichever is higher (EU AI Act Article 99(3)); for SMEs and start-ups the lower of the two figures applies (EU AI Act Article 99(6)). The Commission fines providers of general-purpose models directly under EU AI Act Article 101, from 2 August 2026.

## How the pieces fit

The Act is a sorting exercise followed by the duties for the box a system lands in. Start by confirming you have an AI system at all and what role you play for it. Then work down the tiers in order, because the first one that fits decides most of your work: is the use banned, is it high-risk by either route, does it interact with people or generate content, or is it minimal risk.

![A decision chain of five boxes: is it an AI system (Article 3), is it a prohibited practice (Article 5), is it high-risk through Annex I or Annex III (Article 6), does it carry transparency duties (Article 50), otherwise minimal risk. A side box notes that AI literacy (Article 4) applies in every tier and general-purpose models follow their own track (Chapter V).](/images/docs/eu-ai-act-loop.svg)

Two duties sit outside the chain. AI literacy applies to every provider and deployer, whatever the tier. General-purpose models run on a separate track: the model's provider has its own documentation and copyright duties, and a downstream provider who builds a high-risk system on that model still goes through the high-risk chain for the system.

The tiers also stack. A high-risk hiring tool that talks to candidates carries the high-risk duties and the Article 50 disclosure. The management work underneath, a risk process, documented lifecycle controls, monitoring and incident handling, is what [ISO 42001](/docs/standards/iso-42001) organises, which is why many organisations run the two together.

## In this section

- [EU AI Act risk classification](/docs/standards/eu-ai-act/risk-classification): is my system high-risk, limited risk or minimal risk, and how do I record the decision?
- [EU AI Act prohibited practices](/docs/standards/eu-ai-act/prohibited-practices): which uses of AI are banned, and since when?
- [EU AI Act obligations for high-risk systems](/docs/standards/eu-ai-act/high-risk-obligations): what must providers and deployers of a high-risk system do?
- [EU AI Act transparency obligations](/docs/standards/eu-ai-act/transparency-obligations): when must you tell people they are dealing with AI, or label what it made?
- [EU AI Act AI literacy](/docs/standards/eu-ai-act/ai-literacy): what does the AI literacy duty ask of your staff, after the 2026 amendment?
- [EU AI Act general-purpose AI models](/docs/standards/eu-ai-act/general-purpose-ai-models): when are you the provider of a general-purpose model, and what do you owe?
- [EU AI Act timeline](/docs/standards/eu-ai-act/timeline): which parts apply from which date?

## How Sted maps it

The EU AI Act is one of the standards, regulations and schemes in Sted's catalogue.

Sted works the Act out per AI system you record. It treats the Act as applying when at least one of your systems is in EU scope and carries obligations: it is a prohibited use, it is high-risk through the product route (it embeds a medical device classed above Class I under the EU MDR) or through an Annex III use you recorded, or it is a generative system under the Article 50 duties. A general-purpose model counts only when you trained it. If every in-scope system is minimal risk, the answer is "applies in part", and a stored high-risk assessment overrides the tier Sted would derive. Those rules work from your recorded answers; the AI model does not decide them.

Sted recommends the standards that apply with its reasons, and you select or remove each one. Administrators and Policy and Process Owners make that choice. Pressing **Update and generate framework** builds the documents for what you chose.

The Act also moves two other standards. When it applies to you, Sted strongly indicates ISO 42001 as the management system for governing your AI. A high-risk system is one of the reasons Sted treats [ISO 27001](/docs/standards/iso-27001) as applying, because the Act's cybersecurity requirement is easiest to show from a security management system.

For the Act, Sted's knowledge base carries the AI governance and transparency policies, the AI System Lifecycle Procedure and its records, including the AI Use Case Definition and Classification Record and the EU AI Act High-Risk Conformity Record. Sted drafts them for your organisation for you to review and approve. Your scope, interested parties and obligations sit in management-system registers drafted from your answers.

Sted does not classify a system for you in law, run a conformity assessment, register a system in the EU database or report to an authority. Those acts stay with the provider or deployer, and the market surveillance authority checks them.

Sted treats the EU AI Act as applying when at least one of your AI systems is in EU scope and carries obligations: it is prohibited, high-risk through the product route (it embeds a medical device under EU MDR classed above Class I) or through an Annex III use you recorded, or it is a generative system under the Article 50 transparency duties; a general-purpose model you trained and that is in EU scope counts only when it carries systemic risk; in-scope systems that are all minimal-risk give applies in part; and a stored high-risk assessment overrides the derived tier.
For the EU AI Act Sted's knowledge base carries five policies and procedures, the Artificial Intelligence Governance Policy (POL-AIG), AI Transparency and Notices Policy (POL-AIT), Acceptable Use Policy (POL-AUP), AI System Lifecycle Procedure (PRC-AISL) and Incident Management Procedure (PRC-IMP), and eight record templates: the AI Use Case Definition and Classification Record (REC-AIUC), EU AI Act High-Risk Conformity Record (REC-AIHC), Model Evaluation Report (REC-AIME), Post-Deployment Monitoring Record (REC-AIPD), Deployment Readiness and Integration Test Record (REC-AIDR), Dataset Record (REC-DSET), AI Transparency Notice Record (REC-ATN) and AI / Algorithmic Incident Record (REC-AII), with eight seeded requirement rows and no control catalogue.

Sted does not decide your legal classification or assess conformity. The provider does, with a notified body where the Act requires one.

## Frequently asked questions

Q: Does the EU AI Act apply to a UK company?
A: Yes, if you place an AI system on the EU market or the output of your system is used in the EU (EU AI Act Article 2(1)). A UK firm whose assistant answers customers in Dublin is in scope even with no EU office. A provider outside the EU that offers a high-risk system there appoints an authorised representative in the EU first (EU AI Act Article 22).

Q: Is my AI system high-risk under the EU AI Act?
A: Only by one of two routes. It is a safety component of, or is, a product under the EU laws in Annex I that needs a third-party conformity assessment, such as a medical device above Class I, or it is used in one of the eight areas in Annex III, such as hiring or credit scoring. A listed use can escape if it poses no significant risk, but you must document that assessment and register the system.

Q: Can you be certified to the EU AI Act?
A: No. A high-risk system goes through a conformity assessment, carries an EU declaration of conformity and the CE marking, and is registered in the EU database, but there is no organisation-wide certificate. ISO 42001 certification is separate and voluntary; it helps you run the work, and it does not show that a system conforms.

Q: Does using a chatbot from another company at work make us a deployer?
A: Yes. Using an AI system under your authority for professional purposes makes you a deployer, even if you did not build it. For most office use your duties are AI literacy and, if you publish deep fakes or AI-written text on matters of public interest, labelling it. You are not the provider of the underlying model.

Q: When do the high-risk rules start?
A: On 2 December 2027 for systems in the Annex III areas and on 2 August 2028 for systems inside Annex I products, since Regulation (EU) 2026/1744 moved both dates. The prohibitions have applied since 2 February 2025 and the general-purpose model rules since 2 August 2025 (EU AI Act Article 113).