Frequently asked questions about the EU AI Act and compliance

The EU AI Act is the regulation that sets a common framework for the development, placing on the market, deployment and use of artificial intelligence systems in the European Union. It takes a risk-based approach and assigns different obligations depending on the system and the role of each organization.

Yes. The Act entered into force in 2024 and applies in stages. Since 2 August 2026, the transparency obligations of Article 50 for certain AI systems apply, among others. The specific obligations have to be reviewed according to the system, the organization’s role and the applicable timeline.

Article 50 requires, with certain exceptions, that people be informed they’re interacting with an AI system when this isn’t obvious from the circumstances and context. This transparency obligation applies from 2 August 2026.

No. The obligations depend on the type of system, its purpose, the level of risk and the role the organization plays, for example as provider or deployer.

They’re certain systems that the EU AI Act classifies as high-risk because of the context and potential impact of their use. They’re subject to additional requirements, and how those apply has to be analyzed case by case.

No. It can also impose obligations on organizations that deploy or use certain AI systems.

No. GDPR regulates the protection of personal data, while the EU AI Act regulates artificial intelligence systems from a broader perspective. The same project can be subject to both frameworks.

In certain cases there are specific documentation and record-keeping obligations. Even when there’s no specific obligation, keeping an inventory and a record of architecture, providers, purposes and controls is good governance practice.

It depends on the system and the risk category. For certain systems, especially high-risk ones, the EU AI Act sets out specific requirements related to human oversight.

Yes. The architecture can build in traceability, permissions, limits, human intervention, transparency and other relevant controls from the start. Determining the specific legal obligations requires specialized legal advice, and we don’t make that assessment.

Yes. The European Commission and the competent authorities publish guidelines, codes and application criteria. That’s why regulatory content should be reviewed regularly rather than treated as static documentation.