EU AI Act Compliance,
End to End

The EU AI Act came into force on 1 August 2024. Obligations apply on staggered dates: Article 5 prohibitions and Article 4 AI literacy from 2 February 2025; Chapter V general-purpose AI model-provider obligations from 2 August 2025; general application on 2 August 2026. The 7 May 2026 AI Omnibus provisional agreement would shift Annex III high-risk obligations to 2 December 2027 and Annex I product-integrated high-risk obligations to 2 August 2028, pending formal adoption and OJ publication.

Yes. The AI Act has been legally in force since 1 August 2024. Already applicable: Article 5 prohibitions and Article 4 AI literacy from February 2025; Chapter V general-purpose AI model-provider obligations from August 2025. Under the 7 May 2026 AI Omnibus provisional agreement (pending formal adoption and OJ publication), Annex III high-risk obligations would apply from 2 December 2027 and Annex I product-integrated high-risk obligations from 2 August 2028.

A regulation. It applies directly and uniformly across all 27 EU member states from the moment it enters into force, without requiring national implementing legislation. This is the same legal instrument as the GDPR. Member states cannot soften or vary its core obligations through domestic law.

It bans a small set of AI practices outright; requires high-risk AI systems to undergo conformity assessment and CE marking before being placed on the market; imposes transparency obligations on AI systems that interact with people or generate synthetic content; and sets model-level obligations for general-purpose AI providers, including documentation and copyright-related disclosures.

Article 5 prohibits social scoring of natural persons that meets the conditions in Article 5(1)(c); manipulative or exploitative AI that causes harm; real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions); biometric categorisation based on sensitive characteristics; emotion recognition in workplaces and education; predictive policing based solely on profiling; and untargeted facial-image scraping for facial recognition databases.

Two routes under Article 6. Annex I: AI systems that are safety components of products covered by listed Union harmonisation legislation (medical devices, machinery, vehicles, radio equipment, toys, and others), where Article 6(1)(b) requires the product to undergo a third-party conformity assessment. Annex III: stand-alone AI systems in eight domains, namely biometrics, critical infrastructure, education, employment, essential public and private services, law enforcement, migration and border control, and the administration of justice and democratic processes.

Article 2 sets the scope: providers placing AI systems on the EU market (regardless of where the provider is established); deployers established or located in the Union; importers and distributors of AI systems in the EU; product manufacturers placing AI systems on the EU market; authorised representatives of non-EU providers; and providers and deployers in third countries when the AI system outputs are used in the Union.

Yes, if the UK company places an AI system on the EU market or its AI system outputs are used in the EU. The Act applies based on who is affected, not where the provider is headquartered. The UK’s post-Brexit status does not exempt UK companies from EU AI Act obligations when EU users or markets are involved.

Yes. A US company selling an AI system into the EU market, or whose AI system outputs are used by EU customers, is in scope. A US provider placing a high-risk AI system on the EU market must appoint an authorised representative established in the EU under Article 22. Non-EU providers of general-purpose AI models have a separate authorised-representative rule under Article 54.

Inventory your AI systems; classify each against the four independent gates (prohibited, high-risk, transparency, GPAI); confirm your role under Articles 3 and 25 (provider, deployer, importer, distributor). If you are a provider of a high-risk AI system, the Article 16 stack applies: run a conformity assessment under Article 43, build the Article 11 technical file, draw up the EU Declaration of Conformity, affix the CE mark under Article 48, and operate a quality management system under Article 17 (typically through ISO/IEC 42001); register the system under Article 49 where required (mainly Annex III, including systems self-exempted from high-risk classification under Article 6(3) — the AI Omnibus provisional agreement would preserve registration for those). Deployers operate under Article 26 instead, with a narrower set of duties unless Article 25 reclassifies them as providers.

Up to €35 million or 7% of global annual turnover for prohibited-practice violations, whichever is higher. Up to €15 million or 3% for most other obligations. Up to €7.5 million or 1% for supplying incorrect, incomplete, or misleading information to authorities. Small and medium enterprises and start-ups face proportionally lower caps under Article 99(6). National market surveillance authorities enforce most penalties; Article 101 fines on GPAI model providers are imposed by the European Commission directly.

ISO/IEC 42001 is the international management system standard for AI. AI Act Article 17 requires high-risk AI providers to implement a quality management system. Holding ISO 42001 certification is one of the strongest practical signals of meeting Article 17, though not formally a substitute. Most mature AI Act compliance programs operate inside an ISO 42001 management system.

NIST AI RMF is voluntary US guidance for AI risk management. The EU AI Act is binding EU regulation with legal obligations and penalties. Implementing NIST AI RMF builds the risk-management practices the Act expects, particularly Article 9 risk management for high-risk providers, but it does not substitute for the Act’s specific compliance and conformity-assessment requirements.

Not legally yet. On 7 May 2026, Council and Parliament reached a provisional AI Omnibus agreement that would shift Annex III stand-alone high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I product-integrated high-risk obligations from 2 August 2027 to 2 August 2028. The deal would also add a new Article 5 prohibition on non-consensual intimate content and CSAM, compress the Article 50 watermarking grace period to 3 months (deadline 2 December 2026), and postpone national regulatory sandboxes to 2 August 2027. Pending formal adoption and OJ publication; treat the agreed dates as the operative planning baseline.

Modulos automates the compliance workflow for high-risk AI systems: AI system inventory, classification across the four gates, Article 9 risk management, Article 10 data governance, Article 11 technical documentation, Article 13 transparency, Article 17 quality management, and ongoing monitoring. The platform holds CertX product conformity certificate 213-001/24 against ISO/IEC 42001:2023, the standard most relevant to demonstrating Article 17 QMS requirements.