Who this applies to
The AI Act applies to
providers (Article 2(2)),
deployers (Article 2(3)),
importers (Article 2(4)), and
distributors (Article 2(5)) of AI systems, as well as
product manufacturers placing AI systems on the EU market (Article 4(1)). The obligations extend to
public authorities using high-risk AI (Article 3(1)) and
third-party conformity assessment bodies (Article 43).
What is required
- Prohibit AI practices listed in Article 5 (e.g., social scoring, manipulative subliminal techniques, exploitation of vulnerabilities) – effective February 2025 (Article 5(1)).
- Register high-risk AI systems in the EU database (Article 60(1)) before placement on the market or use.
- Conduct conformity assessments for high-risk AI systems (Article 43(1)) and maintain technical documentation (Article 11(1)).
- Implement risk management systems (Article 9) and data governance measures (Article 10) for high-risk AI.
- Report serious incidents to market surveillance authorities (Article 62(1)) within 15 days of detection.
- Comply with transparency obligations for limited-risk AI (e.g., deepfakes, emotion recognition) under Article 52.
Key deadlines
The primary deadline for this obligation is
August 2, 2026, when the AI Act enters into full enforcement.
Enforcement patterns
AI Act enforcement begins August 2, 2026. No precedent currently exists. This page will be updated as enforcement cases emerge.
Cross-border considerations
Data indicates
Austria (AT) and
Spain (ES) have early engagement with AI Act enforcement mechanisms, as evidenced by citations of Article 99 in national guidance. No jurisdiction-specific enforcement patterns are yet verifiable beyond these references.