EU AI Act
Compliance Guide
The world's first comprehensive AI regulation is now in phased enforcement. Here is what applies now, and what applies from December 2, 2027.
What is the EU AI Act?
The EU AI Act (Regulation (EU) 2024/1689) is the European Union's landmark legislation governing artificial intelligence. Formally adopted in 2024, it is the first legally binding AI framework of its scope anywhere in the world. The regulation applies a risk-based approach: the higher the potential harm an AI system can cause, the stricter the obligations placed on those who build and deploy it.
Enforcement is phased. The prohibitions applied from February 2025, and the Article 50 transparency obligations from August 2, 2026. Regulation (EU) 2026/1744, in force since July 27, 2026, moved the high-risk obligations: stand-alone high-risk systems from December 2, 2027, and AI embedded in regulated products from August 2, 2028. Non-compliance carries substantial financial penalties.
Updated September 30, 2026: this guide now reflects Regulation (EU) 2026/1744. An earlier version gave August 2, 2026 as the date for full compliance.
The Act covers the entire AI lifecycle — from design and development through deployment and ongoing monitoring. It introduces new accountability structures, mandatory documentation requirements, and transparency obligations that affect not just AI developers, but any organization that deploys AI tools to serve EU users.
Who Does It Affect?
The EU AI Act has extraterritorial reach. If your organization deploys AI systems in the EU or provides AI-powered services to EU users, the regulation applies to you — regardless of where your company is incorporated. A US-based company serving European customers through an AI-powered platform must comply.
The regulation classifies AI systems into four risk tiers, each with different compliance obligations:
Prohibited outright. Examples: social scoring, real-time remote biometric identification in publicly accessible spaces for law enforcement purposes (with narrow exceptions), subliminal manipulation.
Strict requirements apply. Covers AI in critical infrastructure, education, employment, essential services, law enforcement, and border control.
Transparency obligations. Chatbots and systems generating synthetic content must disclose their AI nature to users.
Largely unregulated. Spam filters, AI-enabled video games, and similar applications with minimal potential for harm.
Key Requirements
For high-risk AI systems — and partially for limited-risk systems — the EU AI Act imposes four categories of obligations that organizations must satisfy before deployment and maintain throughout the system's operational life.
Transparency
Users must be informed when they are interacting with AI. AI-generated content must be labeled. Systems that interact with humans must disclose their AI nature.
Documentation
High-risk AI systems require technical documentation covering system architecture, training data, testing procedures, and risk management measures.
Human Oversight
High-risk AI systems must be designed to allow human intervention. Users must be able to override, correct, or halt automated decisions.
Accuracy
AI systems must be accurate, robust, and cybersecure. Performance must be consistent and verifiable, with mechanisms to detect and address errors.
Penalties
The EU AI Act carries among the steepest regulatory penalties in the technology sector — comparable to GDPR enforcement, which has already resulted in billion-euro fines for major organizations.
For most companies, the higher of the fixed amount and the percentage of turnover applies. For SMEs, including start-ups, the lower of the two applies (Article 99(6)), and Regulation (EU) 2026/1744 extended comparable caps to small mid-cap companies.
How Faultline Helps
Faultline by NXTG.ai produces evidence toward several of the high-risk requirements. It is not a compliance guarantee. Here is how each requirement relates to a Faultline capability.
For a full technical walkthrough of the verification process, read How Claim Verification Works.
Enforcement Timeline
The EU AI Act does not come into force all at once. Phased enforcement gives organizations time to prepare. For high-risk systems, the next date is December 2, 2027.
Enforcement begins for AI systems classified as posing unacceptable risk. Bans take effect on practices such as social scoring and biometric categorization that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation.
General-purpose AI model obligations and governance requirements become enforceable. Providers of GPAI models must maintain technical documentation.
Article 50 transparency obligations apply: AI-interaction disclosure, marking of synthetic content, and deepfake disclosure. Regulation (EU) 2026/1744 moved the high-risk dates below.
Obligations apply to stand-alone high-risk systems listed in Annex III: risk management, documentation, human oversight, accuracy, and information to deployers.
Obligations apply to high-risk AI embedded in products regulated under Annex I, such as machinery and medical devices.
Related Guides
Start your compliance journey
Faultline generates audit trails and reports you can use as evidence toward EU AI Act obligations.
Get Started with Faultline