Editorial update - October 11, 2026: Timeline reviewed October 11, 2026 against Regulation (EU) 2026/1744, Article 1(40). Chapter III Sections 1-3 apply to Annex III high-risk systems from December 2, 2027 and Annex I high-risk products from August 2, 2028. Article 50 transparency duties generally apply from August 2, 2026. Obligations depend on operator role, system classification, and transitional provisions. Signed evidence supports assessment; it does not establish legal conformity. The earlier blanket deadline and compliance assurances below are superseded. The cited Stanford startup-planning statistic has not been verified and should not be relied upon.
The March 2026 version of this article described August 2, 2026 as a blanket enforcement deadline. That framing is superseded. As reviewed on October 11, 2026, the Act applies in phases: Article 50 transparency duties generally apply from August 2, 2026, while the amended dates for Chapter III Sections 1-3 are December 2, 2027 for Annex III high-risk systems and August 2, 2028 for Annex I high-risk products. Assess the relevant role, classification, exemptions, and transitional provisions before choosing a deadline.
The March version cited an unverified Stanford HAI statistic about startup readiness. That statistic is withdrawn from the article's recommendations. Teams can begin with an inventory of their AI systems and a review of which obligations actually apply.
What is the EU AI Act?
Think of it as GDPR, but for artificial intelligence.
The General Data Protection Regulation (GDPR) reshaped how every tech company handles personal data. The EU AI Act does the same thing for AI systems. It establishes rules for how AI can be built, deployed, and monitored - with significant penalties for companies that do not comply.
The regulation entered into force in August 2024, with a phased rollout. The first wave of prohibitions on certain AI practices took effect in February 2025. The original article's claim that all high-risk requirements began on August 2, 2026 is superseded by the amended dates in the editorial update.
This is not a draft. It is not a proposal. It is law.
Who does it affect?
EU use alone does not establish every obligation. Article 2 defines territorial scope and exclusions; obligations also depend on the organization's role and the system's intended purpose.
The Act can apply to organizations outside the EU, including specified cases where system outputs are used in the EU. These examples are screening prompts, not final legal classifications:
- A US-based SaaS company serving European businesses should assess its operator role and Article 2 scope.
- An Indian fintech offering creditworthiness assessment should review Annex III, the intended purpose, and applicable exclusions.
- A Canadian hiring platform screening resumes should assess the employment-related Annex III provisions and Article 6 classification rules.
- A chatbot provider should assess Article 50 transparency duties and their exceptions.
The key step is an applicability assessment, rather than assuming that every feature has identical duties.
The four risk tiers
The EU AI Act does not treat all AI the same. It classifies AI systems into four risk tiers, and your obligations depend on which tier your system falls into.
Unacceptable risk (banned outright)
These AI applications are prohibited entirely within the EU:
- Social scoring by governments or private companies (ranking citizens based on behavior)
- Manipulative AI that exploits vulnerabilities of specific groups (children, elderly, disabled individuals)
- Real-time biometric surveillance in public spaces (with narrow exceptions for law enforcement)
- Emotion recognition in workplaces and educational institutions
These summaries are not complete legal tests. Review the precise Article 5 conditions and exceptions before determining whether a practice is prohibited.
High risk (strict obligations)
This is where most of the regulatory weight falls. High-risk AI systems include:
- Hiring and recruitment tools that screen, rank, or evaluate candidates
- Credit scoring and financial risk assessment
- Medical diagnosis and clinical decision support
- Educational assessment and student evaluation
- Immigration and border control systems
- Law enforcement prediction and profiling tools
- Critical infrastructure management
If your AI system falls into this category, you must meet extensive documentation, testing, monitoring, and transparency requirements before you can deploy it in the EU.
Limited risk (disclosure required)
These systems have lighter obligations, primarily around transparency:
- Chatbots and conversational AI - users must be told they are interacting with AI
- Content generation tools - AI-generated content must be labeled
- Deepfake detection and generation - clear disclosure is required
The main requirement here is honesty. Users need to know when they are dealing with AI.
Minimal risk (no specific obligations)
The vast majority of AI systems fall here:
- Spam filters
- Recommendation engines for content or products
- AI-powered search
- Video game AI
These examples are not automatic exemptions. Their intended use, operator role, and other provisions such as AI literacy or transparency can still matter.
What are the fines?
The penalties are designed to hurt. They follow the same model as GDPR but with higher ceilings.
| Violation | Maximum Fine |
|---|---|
| Prohibited AI practices | EUR 35 million or 7% of global annual revenue |
| Specified operator and Article 50 violations | EUR 15 million or 3% of global annual turnover |
| Providing incorrect information | EUR 7.5 million or 1% of global annual revenue |
These are Article 99 ceilings, not automatic fines or minimum penalties. For undertakings other than SMEs, the higher applicable fixed or turnover-based ceiling applies. For SMEs, including startups, Article 99(6) uses the lower applicable ceiling. Actual penalties depend on the violation and assessment factors. Other enforcement provisions and exclusions must also be considered. See Regulation (EU) 2024/1689, Article 99.
These are not theoretical numbers. EU regulators have shown with GDPR that they are willing to enforce aggressively, and the newly established AI Office in Brussels is already staffing up.
Preparation checklist - review against your applicable dates
Whether your AI system is high-risk or limited-risk, here is a practical checklist to start preparing.
1. Classify your AI systems
Go through every AI-powered feature in your product. Map each one to the risk tiers described above. Be honest about where your systems land. A customer support chatbot is limited risk. A loan approval algorithm is high risk. Misclassification will not protect you.
2. Document your training data
High-risk systems require detailed documentation of the data used to train and validate your models. This includes data sources, preprocessing steps, known biases, and the measures you took to address them. If you cannot explain where your training data came from, you have a problem.
3. Document your model decisions
Regulators want to understand how your AI system makes decisions. This does not mean you need to open-source your models. It means you need clear technical documentation that describes what your system does, how it was tested, its known limitations, and its intended use cases.
4. Implement human oversight
High-risk AI systems must have meaningful human oversight. This means a real person can intervene, override, or shut down the AI system when needed. "A human reviewed the output" is not sufficient. You need documented processes, clear escalation paths, and evidence that the oversight actually works.
5. Create an auditable compliance record
Applicable documentation and recordkeeping obligations need evidence that can be reviewed. A signed record can show integrity and key control; it does not prove that the underlying system meets every legal requirement.
6. Set up post-market monitoring
Compliance is not a one-time event. You must monitor your AI system after deployment, track incidents, and report serious issues to regulators. This means logging, alerting, and regular reassessment of your risk classification.
The compliance tooling gap
Here is the uncomfortable truth: most existing compliance tools were not built for the EU AI Act.
Governance platforms offer different combinations of risk assessment, policy management, evidence collection, and reporting. The March article's blanket description of competitor output was not supported by a verified product comparison and should not be treated as one.
The EU AI Act requires something different. Article 11 mandates technical documentation that is "drawn up in such a way as to demonstrate" compliance. Article 12 requires automatic logging that enables post-market monitoring. Article 49 requires registration in an EU-wide database with structured data.
The March article's assertion that regulators will reject PDFs is withdrawn. These provisions do not impose Attestix credentials or a universal cryptographic evidence format. Structured records can assist review alongside the documentation and processes required for a particular system.
This creates a gap between what current tools produce and what regulators will actually need.
How Attestix fills the gap
Attestix is open-source attestation infrastructure for signed identity claims and evidence records. A verifier can check a supported signature profile; acceptance by a regulator or auditor depends on the evidence and applicable process.
Here is what that looks like in practice:
Risk screening - Attestix provides structured prompts for an applicability review. Its output is not a final legal classification.
Machine-readable evidence - Attestix creates structured, signed claims that can accompany documentation. Signature verification does not establish the truth of a claim, the issuer's real-world identity, or legal conformity.
Signature verification - Supported records can be checked for integrity and binding to an issuer key. Establishing an organization's identity and authority requires a separate trust process.
Tamper-evident records - Hash-linked records can help detect modifications within the verified chain. Retention, completeness, trusted checkpoints, and the truth of the recorded events need separate controls. The March article's promise that this proves legal compliance on a particular date is withdrawn.
Open source and free to start - Attestix is available on PyPI, works with any AI agent framework, and costs nothing to get started. There is no vendor lock-in and no black box.
Start with an applicability assessment
The original March 2026 countdown is historical and no longer describes the applicable high-risk dates.
GDPR taught us that companies that waited until the last minute faced the highest risk of fines and the most expensive scramble to comply. The organizations that started early had smoother transitions, lower costs, and fewer enforcement actions.
Begin reviewing your system inventory, intended purposes, operator roles, and relevant evidence needs. Set a preparation schedule against the obligations and dates that apply to your organization.
The compliance checker is a screening demonstration. Use its prompts to start a review, rather than treating its result as a legal determination.
For a deeper dive into building compliance into your AI pipeline, check out the getting started guide.
This article retains its March 9, 2026 publication date. The dated October 11 update and inline corrections identify the superseded claims; consult the cited legislation for current requirements.