Last updated: April 2026
The EU AI Act is here. Here’s what it means for your company and how to get ahead of it.
If your product uses AI or machine learning, you have new compliance obligations under the EU AI Act, and these interact with your existing GDPR requirements in ways that most companies haven’t fully mapped out yet.
Key takeaways
- The EU AI Act entered into force August 2024 with obligations phased in through 2027 (some high-risk system obligations extend beyond August 2026)
- Common tech company AI use cases range from “high risk” (employment, healthcare, credit scoring) to “limited risk” (certain chatbots, generative AI) to “minimal risk” (internal analytics, basic automation)
- AI compliance integrates with your existing GDPR DPIAs and privacy governance
- Your DPO has led AI compliance programs across 100+ organizations including companies at the forefront of AI development
- Engage Compliance covers the AI Act and GDPR together, since the same model and the same training data sit under both.
EU AI Act risk levels
Unacceptable risk (banned): AI that manipulates behavior to cause harm, social scoring by governments, real-time biometric identification in public spaces for law enforcement (with limited exceptions). These prohibitions took effect February 2025.
High risk: AI used in employment (recruitment, performance evaluation), education, credit scoring, healthcare diagnostics, law enforcement, and critical infrastructure. These require conformity assessments, risk management systems, transparency, human oversight, and documentation. Transparency obligations (Article 50) apply from 2 August 2026. High-risk AI system obligations were revised by the adopted Digital Omnibus: stand-alone systems apply from 2 December 2027, systems embedded in regulated products from 2 August 2028.
Limited risk: AI systems that interact with users (chatbots), generate synthetic content (deepfakes, AI-generated text/images), or present as human when they are not. These primarily require transparency obligations (telling users they’re interacting with AI or that content is AI-generated). Transparency obligations under Article 50 apply from 2 August 2026.
Minimal risk: Most other AI applications. No specific obligations, but good practice to follow AI governance principles.
EU AI Act Status as of mid-2026
Under the adopted Digital Omnibus (formally endorsed by the European Parliament on 16 June 2026 and given final Council approval on 29 June 2026), the high-risk deadline moves to 2 December 2027 (stand-alone systems) and 2 August 2028 (embedded systems). These are now the deadlines set in law.
Prudent compliance planning should work to these adopted dates. Obligations already in effect since August 2, 2025 include the General Purpose AI model requirements covering transparency, copyright compliance, technical documentation, and downstream provider support. Providers of GPAI models placed on the market before August 2, 2025 must achieve full compliance by August 2, 2027.
Penalties: up to €35 million or 7 percent of global annual turnover for prohibited AI practices, up to €15 million or 3 percent for high-risk system violations.
How to determine your risk level
The classification depends on what your AI does, not how it works technically. Key questions:
- Does your AI make decisions about employment, credit, education, or healthcare? → Likely high risk
- Does your AI interact with users directly (chatbot, virtual assistant)? → Likely limited risk
- Does your AI generate synthetic content? → Likely limited risk
- Does your AI power internal analytics without directly affecting individuals? → Likely minimal risk
Most tech companies have AI that falls into multiple categories. A SaaS company might have a minimal-risk internal analytics tool AND a limited-risk customer-facing chatbot AND a high-risk AI feature used in HR decisions. Each gets classified separately.
What we do for AI compliance
- AI risk classification: determining where your AI systems fall in the framework
- AI risk assessments: evaluating the risks of your AI processing activities
- AI governance frameworks: policies, procedures, and accountability structures
- Documentation: technical documentation required for high-risk AI systems
- Transparency implementation: user-facing disclosures and explanations
- Data quality and bias assessments
- Human oversight mechanisms
- Integration with existing GDPR DPIAs (AI processing often triggers DPIA requirements)
EU AI Act timeline
- 1 August 2024: AI Act entered into force
- 2 February 2025: Prohibited practices and AI literacy obligations apply
- 2 August 2025: General-purpose AI (GPAI) obligations and governance rules apply
- 2 August 2026: Transparency obligations (Article 50) apply; high-risk deadlines revised by the adopted Digital Omnibus to 2 December 2027 (stand-alone) and 2 August 2028 (embedded).
- 2 December 2027: High-risk AI systems that are standalone (Annex III) must comply
- 2 August 2028: High-risk AI embedded in regulated products (Annex I) must comply