EU AI Act

This content was generated with the assistance of AI and should be verified against the official documentation of each tool and framework before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

Written on 2026-10-01 against Regulation (EU) 2024/1689 (the AI Act) and the European Commission’s AI Act implementation timeline; see the version baseline.

This page is not legal advice. It is an engineer’s orientation to a regulation, written by a non-lawyer, and it can be wrong or out of date. Whether and how the Act applies to a given system depends on facts, role and jurisdiction; ask qualified counsel.

Risk tiers

The Act regulates by use case and risk, not by technology.

Tier Meaning Example relevance

Prohibited practices

Banned uses such as manipulative techniques causing harm, social scoring or untargeted facial-image scraping.

Applies since 2025-02-02.

High risk

Systems used in listed areas (Annex III, for example employment, education, essential services) or as safety components of regulated products (Annex I). They need risk management, data governance, documentation, logging, human oversight, accuracy and robustness, and conformity assessment.

A documentation assistant is usually not high risk unless it is used to make decisions in such an area.

Transparency risk

Article 50: people must be told they are interacting with an AI system, and synthetic content must be marked in a machine-readable way, among other duties.

A chat assistant such as the DocsAssistant falls here.

Minimal risk

Everything else; voluntary codes of conduct.

Many internal tools.

Roles: provider and deployer

The Act assigns duties by role. A provider develops an AI system or model and places it on the market; a deployer uses a system under its own authority. Most teams building on a third-party model are deployers of the model and providers of their own application, and can be both at once. If you substantially change a system or put your name on it you may take on provider duties.

Providers of general-purpose AI (GPAI) models have had obligations since 2025-08-02: technical documentation, information for downstream providers, a copyright policy and a summary of training content, with further duties for models with systemic risk. As a downstream application developer, the practical effect is that you should be able to obtain model documentation from your provider, and your own supply-chain records (Supply Chain Security) should show which model and version you used.

Article 50 transparency

For a conversational assistant the obligations in Article 50 amount to four practical items:

  • tell users they are talking to an AI system, unless it is obvious from the context;

  • where the system generates synthetic audio, image, video or text, mark outputs in a machine-readable format and make them detectable as artificially generated (provider duty);

  • disclose deep fakes (deployer duty);

  • disclose AI-generated text published to inform the public on matters of public interest, unless it was human-reviewed.

This site’s own disclaimer is one example of disclosure, and the labelling approach is discussed with Misinformation and Hallucination Risk.

Timeline

The dates below were read on 2026-10-01 from the Commission’s implementation timeline page and from the Official Journal record of the Digital Omnibus on AI, Regulation (EU) 2026/1744.

Date Milestone Status of this fact

2025-02-02

Prohibited practices and AI literacy obligations apply.

Official timeline

2025-08-02

GPAI model obligations and governance provisions apply.

Official timeline

August 2026

Article 50 transparency obligations apply, per the Commission timeline.

Official timeline page

2026-12-02

Article 50(2) machine-readable marking applies from this date for systems already on the market.

Regulation (EU) 2026/1744

December 2026

New prohibition on non-consensual intimate content.

Official timeline page

2027-12-02

Annex III high-risk obligations, as postponed by the Digital Omnibus on AI.

Timeline page; Regulation (EU) 2026/1744

2028-08-02

Annex I (product-embedded) high-risk obligations.

Timeline page; Regulation (EU) 2026/1744

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026, the first amendment to the AI Act. It was published in the Official Journal on 2026-07-24 and entered into force on 2026-07-27. The Official Journal text is the authoritative source for every date in the table above.

What a developer team typically documents

  • A system description: purpose, users, model and version, data sources, deployment setting.

  • The tier assessment and the reasoning, reviewed when the use changes.

  • Data governance records for indexed content and evaluation sets.

  • Evaluation and red-team results (AI Red Teaming) and monitoring evidence (LLMSecOps).

  • Logging with retention aligned to the privacy rules of the sensitive information page.

  • Human-oversight design and escalation paths.

  • AI-literacy training for the people operating the system.

The same artefacts feed the voluntary NIST AI RMF mapping.

Where to go next

References