EU AI Act · Regulation (EU) 2024/1689
Status 6 October 2026 · incl. Digital Omnibus
EU AI Act: overview, obligations and deadlines
The AI Act governs who may develop, offer and use AI in the EU – and under which conditions. Here you will find roles, risk classes, every obligation with its article and date, and a quick check that shows what applies to your company.
- Every obligation with article and date
- Deadlines after the Digital Omnibus
- Quick check with matching resources
- Sources on EUR-Lex
AI Act status
Regulation (EU) 2024/1689
- Prohibitions & AI literacy2 Feb 2025applies
- GPAI models & penalties2 Aug 2025applies
- Transparency (Art. 50)2 Aug 2026applies
- New bans, marking legacy2 Dec 2026upcoming
- High-risk AI (Annex III)2 Dec 2027upcoming
- High-risk AI (Annex I)2 Aug 2028upcoming
Deadlines under Reg. (EU) 2026/1744
In short
What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is the EU law on artificial intelligence. It has been in force since 1 August 2024 and sorts AI systems by risk: some practices are banned, high-risk AI faces strict obligations, chatbots and AI content must be recognisable. Obligations phase in until 2028; every company using AI must already take AI literacy measures.
- entry into force
- 1 Aug 2024
- entry into force
- risk classes plus rules for general-purpose AI
- 4 + GPAI
- risk classes plus rules for general-purpose AI
- high-risk AI under Annex III
- 2 Dec 2027
- high-risk AI under Annex III
- or 7% – top fine for prohibited practices
- €35M
- or 7% – top fine for prohibited practices
Basics
The EU AI Act in five sentences
A regulation, not a directive: the AI Act applies directly in every member state, without national transposition. National law mainly covers which authorities are responsible and how penalties are enforced.
The AI Act has two aims: to create a single market for trustworthy AI and to protect health, safety and fundamental rights from the risks of certain AI applications. It therefore does not regulate “AI” as a technology but specific purposes. A language model writing marketing copy is assessed differently from the same model pre-sorting job applications.
Under Article 3(1), an AI system is a machine-based system that operates with some degree of autonomy and infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions. That covers not just models you build yourself but also purchased tools and AI features inside standard software – from the chat assistant in your office suite to lead scoring in your CRM.
Obligations depend on two questions: what is your role towards the system (mainly provider or deployer)? And which risk class does the specific use fall into? For most mid-sized companies the answer is “deployer” and “minimal or limited risk” – which leaves AI literacy, checking the prohibitions and, where relevant, transparency obligations. Anyone using AI in HR, credit decisions or products with safety functions carries considerably more.
With the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) the EU adjusted the timeline: high-risk obligations under Annex III apply only from 2 December 2027, those under Annex I from 2 August 2028. At the same time, two new prohibitions were added that apply from 2 December 2026, and Article 4 was reworded.
Structure of the regulation
- Chapter I
- Subject matter, scope, definitions (Art. 1–3), AI literacy (Art. 4)
- Chapter II
- Prohibited practices (Art. 5)
- Chapter III
- High-risk AI: classification, requirements, operator obligations, conformity (Art. 6–49)
- Chapter IV
- Transparency obligations for certain AI systems (Art. 50)
- Chapter V
- General-purpose AI models – GPAI (Art. 51–56)
- Chapters VI–IX
- Innovation support, governance, EU database, post-market monitoring and market surveillance
- Chapters XII–XIII
- Penalties (Art. 99–101), final provisions and dates of application (Art. 111–113)
- Annexes
- incl. Annex I (product legislation), III (high-risk areas), IV (technical documentation)
Who is affected
Your role determines your obligations
The AI Act spreads obligations along the value chain. One company can hold different roles for different systems – provider for its own product, deployer for the HR tool it bought.
Provider
Art. 3(3)Develops an AI system or model (or has it developed) and places it on the market or puts it into service under its own name – whether for payment or free of charge.
Main burden for high-risk AI: risk management, documentation, conformity assessment, post-market monitoring; Art. 50(1) and (2).
Deployer
Art. 3(4)Uses an AI system under its own authority, except in a purely personal, non-professional activity. This is the typical role of companies buying AI tools.
AI literacy, Art. 26 for high-risk AI, Art. 27 where applicable; Art. 50(3) and (4).
Importer and distributor
Art. 23 · Art. 24Importers place a third-country provider’s AI on the EU market; distributors make it available without being provider or importer.
Verify that conformity assessment, marking and documents are in place; do not place on the market if in doubt.
Authorised representative
Art. 22Providers of high-risk AI without an establishment in the EU appoint an authorised representative in the Union by written mandate.
Keeps documents available for authorities and cooperates with them.
Product manufacturer
Art. 25(3)Anyone placing a product under Annex I (e.g. machinery, medical device) on the market under its own name with a high-risk AI system as a safety component is considered the provider of that AI system.
Provider obligations for the AI system in the product.
GPAI provider
Art. 53 · Art. 55Develops a general-purpose AI model (such as a large language model) and places it on the EU market.
Documentation, information for downstream providers, copyright policy, summary of training content.
Watch the role switch: when deployers become providers
Under Article 25(1), a deployer, distributor or importer takes on the full provider obligations for a high-risk AI system if it
- puts its name or trademark on a high-risk AI system,
- makes a substantial modification so that it remains high-risk, or
- changes the intended purpose of a system that was not high-risk so that it becomes high-risk – for example using a general chat assistant specifically to pre-select job applications.
Scope and exemptions
Where the company is based is not decisive. What matters is whether AI is placed on the market or used in the EU.
- Art. 2(1)
- Providers outside the EU too. Covers third-country providers placing AI on the EU market, and providers and deployers in third countries where the system’s output is used in the Union.
- Art. 2(3)
- Military and national security. AI systems used exclusively for military, defence or national security purposes are excluded.
- Art. 2(6)
- Scientific research. Excluded are systems and models specifically developed and put into service for the sole purpose of scientific research and development.
- Art. 2(10)
- Purely personal use. Natural persons using AI in a purely personal, non-professional activity are not deployers under the regulation.
- Art. 2(12)
- Free and open-source licences. Largely excluded – but not if the system is placed on the market as high-risk AI or as a system under Article 5 or 50. For GPAI models, Article 53(2) applies.
Risk classes
Four risk classes and separate rules for general-purpose AI
The higher the risk a use poses to health, safety and fundamental rights, the stricter the rules. Classification is per use, not per product.
1Unacceptable risk – prohibited
Art. 5Practices the EU considers incompatible with its values. Banned since 2 February 2025 with no transition period; two further prohibitions apply from 2 December 2026.
Risk classification in detailSocial scoring, manipulative techniques, exploiting vulnerabilities, emotion recognition at work and in education, untargeted scraping of facial images, biometric categorisation by sensitive traits.
2High risk
Art. 6 · Annex I · Annex IIIAI as a safety component of regulated products (Annex I) or in eight sensitive areas (Annex III). Extensive obligations for providers and deployers, from 2 December 2027 and 2 August 2028 respectively.
All Annex III areasRecruitment and performance evaluation, creditworthiness, risk and pricing in life and health insurance, access to education, critical infrastructure, biometrics.
3Transparency risk
Art. 50People should be able to tell when they are interacting with AI or looking at AI content. Applies since 2 August 2026.
Labelling under Article 50Chatbots, AI-generated images, audio and video, deepfakes, AI text on matters of public interest, emotion recognition.
4Minimal risk
Art. 95 (voluntary)No specific AI Act obligations. Voluntary codes of conduct are possible; AI literacy under Article 4 still applies.
Document the classificationSpam filters, translation aids, text suggestions, search features, AI in video games, stock forecasts.
5General-purpose AI models
Art. 51–55Separate obligations for providers of large models, across the risk classes. Since 2 August 2025; models placed on the market before then have until 2 August 2027.
GPAI obligationsLarge language, image and multimodal models. Stricter rules for systemic risk, presumed above 10^25 FLOPs of training compute (Art. 51(2)).
One system can fall into several categories at once: a chatbot that pre-sorts applications is high-risk and must also be recognisable as AI.
Obligations overview
Every EU AI Act obligation: article, addressee, date
The table sums up the key obligations, grouped by topic. Dates reflect the Digital Omnibus. For high-risk AI: 2 December 2027 for Annex III, 2 August 2028 for Annex I.
Scroll the table sideways →
| Obligation | Article | Who | From | Resource |
|---|---|---|---|---|
| For all companies | ||||
| Take measures to support the AI literacy of staff and persons acting on your behalf | Art. 4 | Providers, deployers | 2 Feb 2025 (reworded 27 Jul 2026) | Training record |
| Refrain from prohibited practices | Art. 5(1) | all operators | 2 Feb 2025 | Risk classes |
| New prohibitions: non-consensual intimate deepfakes of identifiable persons, child sexual abuse material | Art. 5 (Omnibus) | all operators | 2 Dec 2026 | Digital Omnibus |
| Overview of the AI systems in use (no express obligation, but a prerequisite for any classification) | Recommendation | all companies | recommended now | AI register |
| Transparency | ||||
| Inform people that they are interacting with an AI system (e.g. chatbot) | Art. 50(1) | Provider | 2 Aug 2026 | Article 50 |
| Mark synthetic content in a machine-readable format | Art. 50(2) | Provider | 2 Aug 2026; systems before 2 Aug 2026: by 2 Dec 2026 | Article 50 |
| Inform people about emotion recognition or biometric categorisation | Art. 50(3) | Deployer | 2 Aug 2026 | Article 50 |
| Disclose deepfakes and AI text on matters of public interest | Art. 50(4) | Deployer | 2 Aug 2026 | Article 50 |
| High-risk AI: providers | ||||
| Check classification; for the Art. 6(3) exception document the assessment and register | Art. 6 · Art. 49(2) | Provider | with Annex III obligations | Annex III |
| Risk management system across the entire lifecycle | Art. 9 | Provider | 2 Dec 2027 / 2 Aug 2028 | Checklist |
| Data and data governance (training, validation, test data) | Art. 10 | Provider | 2 Dec 2027 / 2 Aug 2028 | Checklist |
| Technical documentation under Annex IV | Art. 11 | Provider | 2 Dec 2027 / 2 Aug 2028 | Documentation |
| Enable automatic logging | Art. 12 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Transparency and instructions for use for deployers | Art. 13 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Design for human oversight | Art. 14 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Accuracy, robustness and cybersecurity | Art. 15 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Quality management system (proportionate for SMEs) | Art. 17 | Provider | 2 Dec 2027 / 2 Aug 2028 | Governance |
| Keep documentation for 10 years | Art. 18 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Conformity assessment, EU declaration of conformity, CE marking | Art. 43 · 47 · 48 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Registration in the EU database | Art. 49 · Art. 71 | Provider (Annex III, except point 2) | 2 Dec 2027 | – |
| Post-market monitoring | Art. 72 | Provider | 2 Dec 2027 / 2 Aug 2028 | – |
| Report serious incidents, at the latest 15 days after becoming aware (shorter in severe cases) | Art. 73 | Provider | 2 Dec 2027 / 2 Aug 2028 | Incidents |
| High-risk AI: deployers | ||||
| Use according to the instructions; oversight by competent, trained people | Art. 26(1)–(2) | Deployer | 2 Dec 2027 / 2 Aug 2028 | Checklist |
| Check input data against the intended purpose, monitor operation, report risks and incidents | Art. 26(4)–(5) | Deployer | 2 Dec 2027 / 2 Aug 2028 | – |
| Keep automatically generated logs for at least 6 months | Art. 26(6) | Deployer | 2 Dec 2027 / 2 Aug 2028 | – |
| Inform workers’ representatives and staff before use at the workplace | Art. 26(7) | Deployer (employer) | 2 Dec 2027 / 2 Aug 2028 | – |
| Data protection impact assessment using the provider’s information | Art. 26(9) | Deployer | 2 Dec 2027 / 2 Aug 2028 | – |
| Inform people when Annex III systems make or assist decisions about them | Art. 26(11) | Deployer | 2 Dec 2027 | – |
| Fundamental rights impact assessment | Art. 27 | public bodies, private providers of public services, Annex III point 5(b)/(c) | 2 Dec 2027 | – |
| On request, explain the AI system’s role in a decision | Art. 86 | Deployer | with Annex III obligations | – |
| Own brand, substantial modification or new purpose: full provider obligations | Art. 25 | Deployers, distributors, importers | 2 Dec 2027 / 2 Aug 2028 | – |
| General-purpose AI models | ||||
| Technical documentation, information for downstream providers, copyright policy, summary of training content | Art. 53 | GPAI provider | 2 Aug 2025; legacy models by 2 Aug 2027 | – |
| Additionally for systemic risk: model evaluation, risk mitigation, incident reporting, cybersecurity | Art. 55 | GPAI provider with systemic risk | 2 Aug 2025; legacy models by 2 Aug 2027 | – |
“2 Dec 2027 / 2 Aug 2028”: Annex III and Annex I respectively. High-risk AI intended for public authorities and placed on the market earlier has until 2 August 2030 (Art. 111(2)). Simplified; the text of the regulation prevails.
Quick check
What applies to my company?
Six questions, one list: the quick check shows which AI Act obligations most likely apply to your company, since or from when – and where to find the matching template or guide. No sign-up, nothing stored.
Your result
EU AI Act · VO (EU) 2024/1689
Answer the questions on the left – your list of obligations appears here.
Simplified guidance, not legal advice. Classification depends on the specific use and has to be checked per AI system.
Deadlines
The EU AI Act timeline after the Digital Omnibus
The regulation has been in force since 1 August 2024 and its obligations apply in stages. Since 2 August 2026 it applies in principle in full – with the postponed exceptions for high-risk AI.
- Applies
Entry into force
The regulation enters into force and the transition periods begin.
- Applies
Prohibitions and AI literacy
Prohibited practices under Art. 5 and AI literacy under Art. 4 apply.
- Applies
GPAI, governance, penalties
Obligations for providers of general-purpose models, authority structures and the penalty framework.
- Applies
Digital Omnibus in force
New deadlines for high-risk AI, Art. 4 reworded, relief for SMEs.
- Applies
General application and Art. 50
Transparency obligations apply; the Commission can impose GPAI fines.
- Upcoming
New bans, marking for legacy systems
Two new prohibitions; systems placed before 2 Aug 2026 must mark content under Art. 50(2).
- Upcoming
Legacy GPAI, sandboxes
Deadline for models placed on the market before 2 Aug 2025; national AI regulatory sandboxes.
- Upcoming
High-risk AI under Annex III
Obligations for providers and deployers in the eight Annex III areas.
- Upcoming
High-risk AI under Annex I
AI as a safety component of regulated products such as machinery or medical devices.
High-risk AI
High-risk AI: what providers and deployers must deliver
A system is high-risk if it is a safety component of a product under Annex I or falls into one of the eight Annex III areas. For Annex III systems there is an exception under Article 6(3) – for example for narrow procedural tasks or purely preparatory work. It never applies where the system profiles natural persons.
Providers
- Risk managementArt. 9
- An ongoing process that identifies, evaluates and mitigates risks – not a one-off document.
- Data governanceArt. 10
- Training, validation and test data must be fit for purpose, as error-free and representative as possible; possible biases are examined.
- Technical documentationArt. 11 · Annex IV
- Describes system, development, data, performance, limits and oversight. After the Omnibus, SMEs and small mid-caps may use a simplified form.
- LoggingArt. 12 · Art. 19
- The system records events automatically; providers keep the logs under their control.
- Transparency and oversightArt. 13 · Art. 14
- Instructions for use for deployers; a design that allows effective human oversight – including intervening and stopping.
- Accuracy and robustnessArt. 15
- An appropriate level of accuracy, robustness and cybersecurity across the lifecycle.
- Quality managementArt. 17
- Documented procedures for development, testing, changes and incidents – proportionate to company size.
- Conformity and registrationArt. 43 · 47 · 48 · 49
- For Annex III points 2–8 internal control under Annex VI, for point 1 possibly a notified body. Then declaration of conformity, CE marking and entry in the EU database.
- After placing on the marketArt. 72 · Art. 73
- Monitor performance on the market, report serious incidents to market surveillance.
Deployers
- Use as intendedArt. 26(1)
- Technical and organisational measures so the system is used in line with its instructions for use.
- Human oversightArt. 26(2)
- Assign oversight to people with the necessary competence, training and authority, and support them.
- Input data and monitoringArt. 26(4)–(5)
- Where input data is under your control, check it against the purpose; monitor operation and inform the provider or authorities of risks or incidents.
- LogsArt. 26(6)
- Keep automatically generated logs, where under your control, for at least six months.
- Inform staffArt. 26(7)
- Before putting into service at the workplace, inform workers’ representatives and affected workers.
- DPIA and affected peopleArt. 26(9) · (11)
- Use provider information for the data protection impact assessment; inform people about whom the system makes or prepares decisions.
- Fundamental rights impact assessmentArt. 27
- For public bodies, private providers of public services and deployers under Annex III point 5(b) and (c) (credit, life and health insurance).
- Explanation of decisionsArt. 86
- Affected people can request a clear and meaningful explanation of the AI system’s role in decisions with significant effects.
In practice for deployers: before buying a high-risk tool, clarify which documents the provider supplies (instructions for use, declaration of conformity, information for the DPIA) – a procurement recommendation, not a separate obligation.
GPAI
General-purpose AI: obligations for model providers – and what they mean for users
General-purpose AI (GPAI) models perform a wide range of tasks and can be built into many downstream systems – typically large language models.
The Chapter V obligations fall on model providers, not on companies using a model via an API or a finished tool. Since 2 August 2025, providers must keep technical documentation, give downstream providers the information they need for their own obligations, put in place a policy to comply with EU copyright law and publish a summary of the training content using a template from the AI Office (Art. 53(1)).
Models with systemic risk – presumed when training required more than 10^25 floating-point operations – are additionally subject to Article 55: model evaluation including adversarial testing, assessing and mitigating systemic risks, reporting serious incidents and adequate cybersecurity. Free open-source models benefit from relief under Article 53(2), but not where there is systemic risk.
Supervision of GPAI providers lies with the European Commission’s AI Office. Since 2 August 2026 the Commission can impose fines on GPAI providers (Art. 101). Models placed on the market before 2 August 2025 must comply by 2 August 2027.
What this means for companies using GPAI
- No GPAI provider obligations as long as you only use the model or integrate it into your own applications.
- Your system built on top follows the normal rules: role, risk class, Article 50.
- The provider information under Article 53 helps with your own documentation – ask for it.
- AI literacy under Article 4 also applies to using chat assistants.
Digital Omnibus
What the Digital Omnibus changed
Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The key changes compared:
Scroll the table sideways →
| Topic | Before | Since the Omnibus |
|---|---|---|
| High-risk AI under Annex III | from 2 Aug 2026 | from 2 Dec 2027 |
| High-risk AI under Annex I | from 2 Aug 2027 | from 2 Aug 2028 |
| AI literacy (Art. 4) | ensure a “sufficient level”, to their best extent | take measures to support it |
| Marking AI-generated content (Art. 50(2)) | from 2 Aug 2026 for all systems | systems before 2 Aug 2026: by 2 Dec 2026 |
| Prohibited practices (Art. 5) | eight prohibitions | plus: non-consensual intimate deepfakes, child sexual abuse material – from 2 Dec 2026 |
| Registration for the Art. 6(3) exception | registration in the EU database | still required, simplified procedure |
| SMEs and small mid-caps | relief for SMEs | extended: simplified technical documentation, proportionate QMS |
| National AI regulatory sandboxes | by 2 Aug 2026 | by 2 Aug 2027 |
Unchanged: prohibitions since 2 Feb 2025, GPAI obligations since 2 Aug 2025, Art. 50 from 2 Aug 2026, fines under Art. 99.
Digital Omnibus in detailPenalties
Fines under Article 99
The AI Act tiers fines by severity. The higher amount applies in each case – except for SMEs and start-ups, for which the lower amount applies (Art. 99(6)). Since the Digital Omnibus, this also applies to small mid-caps (Art. 3(14b)), but only for fines under paragraphs 4 and 5 (Art. 99(6a)).
Percentages refer to total worldwide annual turnover of the preceding financial year. When setting a fine, authorities consider among other things the nature, gravity and duration of the infringement, intent or negligence, measures to mitigate damage and cooperation with the supervisor.
Article 4 (AI literacy) has no fine tier of its own in Article 99. Missing training can still weigh in with other infringements – and in practice it is often why infringements happen at all. Companies that document the measures they took are in a much better position with supervisors.
Member states set the procedures and designate the market surveillance authorities. The Commission is responsible for GPAI providers; since 2 August 2026 it can impose its own fines (Art. 101).
- prohibited practices under Art. 5
- €35M / 7%
- prohibited practices under Art. 5
- incl. Art. 16, 22–26, 31, 33, 34 and 50
- €15M / 3%
- incl. Art. 16, 22–26, 31, 33, 34 and 50
- incorrect or misleading information to authorities
- €7.5M / 1%
- incorrect or misleading information to authorities
AI Act and GDPR
AI Act and GDPR work together
The AI Act does not replace the GDPR. As soon as an AI system processes personal data both apply – with different focuses: the GDPR protects data, the AI Act regulates the product and its use.
DPIA and fundamental rights impact assessment
Deployers of high-risk AI use the provider’s information for their data protection impact assessment under Article 35 GDPR (Art. 26(9)). The fundamental rights impact assessment under Article 27 can refer to an existing DPIA.
Automated decisions
Article 22 GDPR limits solely automated decisions with legal effect. The AI Act adds human oversight (Art. 14, Art. 26) and the right to an explanation (Art. 86).
Records and register
The record of processing activities under Article 30 GDPR and the AI register can be linked: every AI processing of personal data belongs in both – with different mandatory fields.
Processing on behalf
External AI services that process personal data on your behalf usually need a contract under Article 28 GDPR; for providers outside the EU, Article 44 et seq. apply as well.
Implementation
Implementing the AI Act in six steps
The order that has proven itself in practice. It is a recommendation – the regulation does not prescribe a procedure.
- 01
Record your AI systems
Collect all AI systems you use or build in one register, with purpose, vendor, department, owner and data concerned – including AI features in standard software.
AI register template (Excel) - 02
Determine role and risk class
For each system, record whether you are provider or deployer and document the risk class with reasons. Expressly rule out the Article 5 prohibitions.
Risk classification - 03
AI literacy and policy
Introduce an AI policy for employees and plan role-based training – with a record of who completed what and when.
AI policy (Word template) - 04
Implement transparency
Review chatbots, generated content and deepfakes and build in notices and marking. The deadlines are already running.
Article 50 decision tree - 05
Anchor governance
Set responsibilities, an approval workflow for new AI tools and review intervals so the register stays current.
AI governance framework - 06
Prepare high-risk obligations
For high-risk systems, build documentation, oversight, logs and conformity by 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
High-risk checklist
Time needed varies widely. From a pilot project: six AI systems, one of them high-risk, were recorded and assessed in around four hours.
Resources
Every guide, template and tool on the EU AI Act
Each page goes deeper into one topic of this overview – with tables, downloadable templates and interactive tools.
Deadlines and classification
Implementing obligations
- Labelling (Article 50)Decision tree and copyable wording templates.
- AI literacy (Article 4)Training matrix and certificate of attendance.
- Fundamental rights impact assessment (Article 27)Who needs one, contents (a) to (f) and a template outline.
- Fines (Article 99)Three tiers, the SME rule and the criteria for setting fines.
- High-risk checklistProvider and deployer obligations to tick off.
- Deployer obligations (Article 26)Every duty of high-risk AI deployers, paragraph by paragraph.
- AI in HR and recruitingCV screening and performance evaluation under Annex III point 4.
- Prohibited AI practices (Article 5)Every prohibition explained, with application date and fines.
- Technical documentationAnnex IV as a Word template.
Organisation
With SimpleAct
How SimpleAct supports implementation
Every obligation hangs off the same record: the captured AI system. That keeps classification, documentation and evidence consistent.
Basis for every obligation
Know which AI is in use
Without a complete overview you can neither determine the risk class nor show which obligations apply. Purchased tools and AI features in standard software count too.
In SimpleAct
AI inventoryAI Discovery from Professional
Every AI system in one place: vendor, purpose, affected areas and responsible person per system. Find shadow AI with AI Discovery.
Go to AI inventoryArt. 5 · Art. 6 · Annex III
Determine the risk class
Every system belongs to a risk class. That decides which obligations apply at all.
In SimpleAct
Risk classification
Rule-based classification through a structured questionnaire – with a reasoned result and the requirements that follow from it.
Go to risk classificationArt. 11 · Art. 26 · Art. 27
Maintain documentation
Providers document under Annex IV, deployers their Article 26 obligations and, where applicable, the fundamental rights impact assessment.
In SimpleAct
Documentation & checklists
Annex IV documentation or deployer obligations, plus compliance checklists per risk class, right on the captured system.
Go to documentationArt. 14 · Art. 26 · Art. 17
Accountability and approvals
Responsibilities, oversight and traceable decisions are the core of any AI Act organisation.
In SimpleAct
GovernanceProfessional and up
Governance workflows and audit readiness score: owners, reviews and approvals per system.
Go to AI governanceEvidence for supervisors
Evidence for review and audit
Reviewers want to see what was decided, by whom and when – not just the current state.
In SimpleAct
Audit log & export
Changes logged with user and timestamp, evidence exportable for reviews.
Go to audit & exportArt. 4
Support AI literacy
Providers and deployers take measures on their staff’s AI literacy.
In SimpleAct
AcademyEnterprise
Training and e-learning on AI literacy across the team.
Go to the Academy
PDF guides and templates
Free PDF downloads – orientation, checklists and templates on the EU AI Act.
FAQ
Frequently asked questions about the EU AI Act
More questions? We're happy to help. Send email · Get started
Sources and status
Last checked on · SimpleAct editorial team
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- AI Act, readable version by article
- European Commission: AI Office
- General Data Protection Regulation (GDPR), full text
This page is for guidance only and is not legal advice. Tables and the quick check simplify; the text of the regulation in its current version prevails.
Changes to this page
- 10 October 2026 – Art. 4 in the Omnibus wording, entry into force on 1 Aug 2024 and staged application clarified.
- 6 October 2026 – Rebuilt and merged with the former “EU AI Act Compliance” page: obligations table with article and date, “What applies to my company?” quick check, roles and scope, GPAI, Omnibus comparison, 14 FAQs.
- 27 July 2026 – Deadlines updated for the Digital Omnibus (Annex III from 2 Dec 2027, Annex I from 2 Aug 2028, Art. 4 reworded).
Open-Source Framework
simpleact-ai-act-compliance-guide
Open-source EU AI Act compliance guide: obligations per risk class, deadlines, article mapping, and implementation guidance.
From overview to a maintained AI register
SimpleAct records your AI systems, assigns roles, risk classes and obligations and links them to your GDPR documentation – in one system, hosted in Germany.