Regulation (EU) 2024/1689
Risk tiers, the provider and deployer split, the obligations already in force, and the high-risk deadlines the Digital Omnibus moved to 2027 and 2028.
The EU AI Act — Regulation (EU) 2024/1689 — regulates AI systems by risk. A short list of practices is prohibited outright; high-risk systems, listed in Annex III or embedded in products regulated under Annex I, carry obligations on risk management, data governance, documentation, logging, human oversight and robustness; and Article 50 requires transparency wherever people interact with AI or AI-generated content. What you owe depends on your role — provider, deployer, importer or distributor — for each system. The prohibitions have applied since February 2025 and Article 50 since August 2026. The Digital Omnibus on AI moved the high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I.
Key takeaways
Scope
The AI Act reaches anyone in the AI value chain whose system or its output lands in the EU. Your duties follow your role and the system's risk tier.
Requirements
What each tier asks for. High-risk obligations fall mostly on providers; deployers carry their own set.
Art. 5
Manipulative or exploitative techniques, social scoring, predicting crime from profiling alone, untargeted facial image scraping, emotion recognition at work or school, biometric categorisation by sensitive traits, and most real-time remote biometric identification in public spaces for law enforcement.
Art. 50
Telling people they are interacting with an AI system, marking synthetic audio, image, video and text as AI-generated in a machine-readable way, disclosing emotion recognition and biometric categorisation, and labelling deep fakes.
Art. 9–15
A risk management system, data governance, technical documentation, automatic logging, transparency to deployers, human oversight, and appropriate accuracy, robustness and cybersecurity.
Art. 16–17, 43
A quality management system, conformity assessment before placing on the market, CE marking, registration in the EU database, post-market monitoring and serious incident reporting.
Art. 26–27
Using the system according to its instructions, assigning competent human oversight, monitoring operation, keeping logs, informing affected workers and people, and — for public bodies and certain private deployers — a fundamental rights impact assessment.
Art. 53–55
Technical documentation, information for downstream providers, a copyright policy and a training-content summary — plus evaluation, risk mitigation and incident reporting for models with systemic risk.
Timeline
The application dates as they stand after the Digital Omnibus on AI. Deferred obligations are deferred, not removed.
Overlaps
EU AI Act rarely arrives alone. Where it meets the other regimes you probably already run.
Most AI systems in scope also process personal data. The AI Act decides whether a system may be placed on the market and how it must disclose itself; the GDPR decides whether the processing is lawful at all. They stack.
A certifiable AI management system that gives you the governance the Act assumes — inventory, risk and impact assessment, oversight. It is not a harmonised standard and does not by itself give a presumption of conformity.
AI that is a safety component of a product already regulated under Annex I — machinery, medical devices, toys — goes through that product's conformity assessment, with AI Act requirements added.
High-risk systems must be cyber-resilient under Article 15. If the AI system is a product with digital elements, CRA conformity can count toward it.
On Noru
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
The ai-inventory piece reads your repository for model calls, agents, prompts and evaluations, and pushes a manifest from CI. Each push lands as a new version, so the register describes what is actually deployed.
Each system gets a classification and a finding for every claim the Act makes about it — Article 5, Article 50, its role and its risk tier — each carrying its own article and the date it becomes enforceable.
Every classification arrives as a suggestion. A named person accepts, dismisses or reaffirms it, with a rationale and an expiry date, and a re-scan that contradicts an accepted claim opens a finding instead of rewriting the record.
Noru is an AI system you will put in your own register, so its commitments are contractual: your data is never used to train, fine-tune or evaluate a model, and every AI call runs under zero data retention terms.
Only part of it. The Digital Omnibus on AI, given final approval by the Council on 29 June 2026, moved the high-risk obligations to 2 December 2027 for standalone Annex III systems and 2 August 2028 for AI embedded in Annex I products. The Article 5 prohibitions and the general-purpose AI model duties kept their dates, and Article 50 transparency applied from 2 August 2026 as planned, with a grace period to 2 December 2026 for marking output from generative systems already on the market.
Not of the model itself: using a third-party model under your own authority usually makes you its deployer. You become a provider of the feature you build on it if you offer that feature to others under your own name, and of a high-risk system if you substantially modify it. The dividing line is who develops a system, or has it developed, and puts it on the market or into service under their own name.
Check whether it is a safety component of a product covered by Annex I, or whether its intended purpose falls in one of the Annex III areas such as employment, credit scoring or education. An Annex III system can escape the high-risk tier under Article 6(3) if it poses no significant risk — but not if it profiles people — and you must document that assessment.
That people are told they are interacting with an AI system, unless it is obvious from the context. If the chatbot generates synthetic content, the provider must also ensure the output is marked in a machine-readable format as AI-generated.
Up to €35 million or 7% of total worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities — whichever is higher, except for SMEs, where the lower figure applies.
Regulatory references on this page were last checked on .
A 45-minute walkthrough of EU AI Act against your own controls, integrations and evidence.
