AI governanceEurope & UK

EU AI ACT 2024

Keep AI governance decisions supported by evidence

Coordinate the policy, risk and oversight work behind your organisation’s applicable AI Act obligations.

Full title
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)
Issued by
European Parliament and Council of the European Union
Current version
In force since 1 August 2024. Amended by Regulation (EU) 2026/1744, in force 27 July 2026.
Applies to
Providers, deployers, importers, distributors and product manufacturers of AI systems placed on the EU market or used in the EU, and providers of general-purpose AI models
Nature
An EU regulation, directly applicable, with obligations that apply in phases between February 2025 and August 2030
Structure
13 chapters and 113 articles with annexes, organised around a risk-based approach

Overview

What the EU AI Act is

The AI Act is the EU’s horizontal law on artificial intelligence. It regulates AI systems according to the risk their use poses to health, safety and fundamental rights. A small number of practices are prohibited. AI systems used in defined high-risk areas, or as safety components of regulated products, must meet requirements before they are placed on the market and while in use. Some systems carry transparency duties, and general-purpose AI models have their own set of obligations.

What an organisation must do depends on its role. Providers, who develop an AI system or have it developed and place it on the market under their own name, carry most of the obligations for high-risk systems: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, a quality management system and conformity assessment. Deployers, who use a system under their own authority, must use it according to its instructions, assign human oversight, monitor it and keep logs. Importers and distributors have checking duties.

The Act applies in phases. Prohibitions and AI literacy have applied since 2 February 2025, and the obligations for general-purpose AI models, governance and penalties since 2 August 2025. Most remaining provisions, including the transparency obligations in Article 50, have applied since 2 August 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, deferred the high-risk obligations: they now apply from 2 December 2027 for the stand-alone areas in Annex III and from 2 August 2028 for AI in products covered by Annex I legislation.

The same amending regulation added two prohibited practices, applying from 2 December 2026, reframed the AI literacy duty in Article 4, extended some simplifications to small mid-cap enterprises and strengthened the AI Office’s enforcement powers. Organisations often use a management system standard such as ISO 42001:2023 or the NIST AI RMF 1.0 to run AI governance, but neither replaces the legal assessment of obligations under the Act.

Who it applies to

The Act applies to actors in the AI value chain that place AI systems or general-purpose AI models on the EU market, put them into service or use them in the EU (Article 2), including:

  • Providers of AI systems and general-purpose AI models, wherever they are established
  • Deployers of AI systems established or located in the EU
  • Providers and deployers outside the EU where the output of the AI system is used in the EU
  • Importers and distributors of AI systems
  • Product manufacturers placing an AI system on the market together with their product under their own name
  • Indian software, IT services and product companies building or supplying AI to EU customers

Out of scope are systems used exclusively for military, defence or national security purposes, AI developed and used solely for scientific research and development, research and testing before a system is placed on the market (other than testing in real-world conditions), and purely personal non-professional use. Most AI systems in common use fall into none of the regulated categories and carry no specific obligations beyond AI literacy.

Structure

How the Act is organised

113 articles in 13 chapters, with annexes. The risk categories are the practical way into the text: prohibited, high-risk, transparency and general-purpose AI. Article numbers below are as amended by Regulation (EU) 2026/1744.

Chapter I

General provisions (Articles 1 to 4)

Subject matter, scope and definitions (Articles 1 to 3)
What the Act covers, who it applies to, and definitions including AI system, provider, deployer, general-purpose AI model and substantial modification.
AI literacy (Article 4)
Providers and deployers take measures to support a sufficient level of AI literacy among staff and others dealing with AI systems on their behalf. The duty was reframed by the 2026 amending regulation.
Bias detection (Article 4a)
Added in 2026. Allows exceptional processing of special category personal data to detect and correct bias, subject to strict safeguards.
Chapter II

Prohibited AI practices (Article 5)

Applying since 2 February 2025, with two further prohibitions from 2 December 2026.

Manipulation and exploitation
Subliminal, manipulative or deceptive techniques, and exploiting vulnerabilities due to age, disability or social or economic situation, that materially distort behaviour and cause significant harm.
Social scoring and predictive policing
Social scoring leading to detrimental or unfavourable treatment, and assessing the risk of a person committing a crime based solely on profiling or personality traits.
Facial image scraping and emotion recognition
Building facial recognition databases through untargeted scraping, and inferring emotions in the workplace or education except for medical or safety reasons.
Biometric categorisation and real-time identification
Categorising people by biometric data to infer sensitive characteristics, and real-time remote biometric identification in public spaces for law enforcement, except in narrowly defined cases.
Added in 2026
AI systems that generate non-consensual intimate or sexually explicit images, video or audio of identifiable people, and AI systems that generate child sexual abuse material.
Chapter III

High-risk AI systems (Articles 6 to 49)

Applying from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Classification (Articles 6 and 7)
A system is high-risk if it is a safety component of, or is itself, a product under the legislation in Annex I that needs third-party conformity assessment, or if it is used in an Annex III area. An Annex III system that does not pose a significant risk can be excluded if the provider documents why.
Annex III areas
Biometrics; critical infrastructure; education and vocational training; employment and workers management; access to essential private and public services, including creditworthiness and life and health insurance pricing; law enforcement; migration, asylum and border control; and administration of justice and democratic processes.
Requirements (Articles 8 to 15)
Risk management system, data and data governance, technical documentation, record-keeping and logging, transparency and instructions for deployers, human oversight, and accuracy, robustness and cybersecurity.
Provider obligations (Articles 16 to 22)
Quality management system, keeping documentation and logs, corrective action and information duties, cooperation with authorities, and authorised representatives for providers outside the EU.
Value chain and deployers (Articles 23 to 27)
Obligations of importers and distributors, when another party becomes a provider, deployer obligations, and the fundamental rights impact assessment required of certain deployers.
Conformity assessment and registration (Articles 28 to 49)
Notified bodies, harmonised standards and common specifications, conformity assessment procedures, certificates, the EU declaration of conformity, CE marking and registration in the EU database.
Chapter IV

Transparency obligations (Article 50)

Applying since 2 August 2026.

Interaction with AI
Providers must design systems that interact with people so that they are informed they are dealing with an AI system, unless obvious.
Synthetic content marking
Providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format. Generative systems placed on the market before 2 August 2026 have until 2 December 2026.
Deployer disclosures
Deployers must inform people exposed to emotion recognition or biometric categorisation, and disclose deep fakes and AI-generated text published to inform the public on matters of public interest, with defined exceptions.
Chapter V

General-purpose AI models (Articles 51 to 56)

Applying since 2 August 2025. Models placed on the market before that date must comply by 2 August 2027.

All general-purpose AI model providers (Article 53)
Technical documentation, information for downstream providers, a policy to comply with EU copyright law, and a public summary of training content.
Models with systemic risk (Articles 51, 52 and 55)
Classification, including a presumption based on training compute, and additional duties: model evaluation and adversarial testing, assessing and mitigating systemic risks, reporting serious incidents and ensuring cybersecurity.
Codes of practice (Article 56)
Codes of practice that providers can rely on to demonstrate compliance until harmonised standards are published.
Chapters VI to VIII

Innovation, governance and the EU database (Articles 57 to 71)

Measures in support of innovation (Articles 57 to 63)
AI regulatory sandboxes, which each Member State must have operational by 2 August 2027, testing in real-world conditions, and measures for SMEs and small mid-caps.
Governance (Articles 64 to 70)
The AI Office, the European Artificial Intelligence Board, the advisory forum, the scientific panel and national competent authorities.
EU database (Article 71)
The public database in which high-risk AI systems are registered.
Chapters IX to XIII

Monitoring, enforcement, penalties and final provisions (Articles 72 to 113)

Post-market monitoring and incidents (Articles 72 and 73)
Providers of high-risk systems monitor performance after placing on the market and report serious incidents to market surveillance authorities.
Market surveillance and remedies (Articles 74 to 94)
Powers of market surveillance authorities and the AI Office, procedures for systems presenting a risk, the right to lodge a complaint and the right to an explanation of certain decisions.
Codes of conduct and guidelines (Articles 95 and 96)
Voluntary codes of conduct for systems that are not high-risk, and Commission guidelines on implementation.
Penalties (Articles 99 to 101)
For prohibited practices, fines up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher; for most other obligations, up to EUR 15 million or 3%; for supplying incorrect or misleading information, up to EUR 7.5 million or 1%. Lower ceilings apply to SMEs and small mid-caps.
Final provisions (Articles 102 to 113)
Amendments to sectoral legislation, evaluation and review, systems already on the market, entry into force and the dates of application.

Implementation roadmap

How to implement it, step by step

A practical sequence for an organisation that develops or uses AI, working to the amended timeline.

  1. 1

    Build an AI inventory

    List the AI systems and models the organisation develops, buys, embeds or uses, with their purpose, owner and where their output is used.

    OutputsAI system inventorySystem owners
  2. 2

    Establish your role for each system

    Decide whether you are provider, deployer, importer, distributor or product manufacturer for each system, and whether changes you make would turn you into a provider.

    OutputsRole assessment
  3. 3

    Classify each system

    Check each system against the prohibited practices, the Annex I and Annex III high-risk categories, the Article 50 transparency cases and the general-purpose AI rules. Document any decision that an Annex III system is not high-risk.

    OutputsRisk classification recordApplicable obligations and dates
  4. 4

    Stop or redesign prohibited uses

    Withdraw or change any use that falls within Article 5, including the two prohibitions that apply from 2 December 2026.

    OutputsProhibited practice review
  5. 5

    Meet literacy and transparency duties now

    Put AI literacy measures in place and implement the Article 50 disclosures and output marking that already apply.

    OutputsAI literacy programmeTransparency notices
  6. 6

    Prepare high-risk systems

    For providers, build the risk management, data governance, documentation, logging, human oversight and quality management needed before conformity assessment. For deployers, prepare oversight, monitoring, log retention and any fundamental rights impact assessment.

    OutputsTechnical documentationQuality management systemFRIA where required
  7. 7

    Assess conformity and register

    Complete the applicable conformity assessment, draw up the EU declaration of conformity, affix CE marking and register in the EU database before placing a high-risk system on the market.

    OutputsDeclaration of conformityDatabase registration
  8. 8

    Monitor and report

    Run post-market monitoring, report serious incidents and keep the classification under review as systems and their uses change.

    OutputsPost-market monitoring planIncident records

Audit and evidence guide

What auditors look for, and the evidence to keep

Compliance is checked by national market surveillance authorities, and for general-purpose AI models by the AI Office. High-risk systems go through conformity assessment before they are placed on the market: most Annex III systems by internal control, some biometric systems with a notified body, and Annex I products within the conformity assessment of their own product legislation.

The high-risk conformity route

  1. Step 1

    Classify and document

    The provider confirms the system is high-risk, meets the requirements in Articles 8 to 15 and prepares the technical documentation.

  2. Step 2

    Conformity assessment

    Internal control, or assessment of the quality management system and technical documentation by a notified body, depending on the category.

  3. Step 3

    Declaration, marking and registration

    The provider signs the EU declaration of conformity, affixes CE marking and registers the system in the EU database.

  4. Step 4

    Post-market monitoring

    The provider monitors the system in use, reports serious incidents and repeats the assessment after a substantial modification.

What reviewers look for

  • A complete inventory of AI systems with a documented role for each
  • Classification decisions, including reasons why an Annex III system is not high-risk
  • Evidence that no prohibited practice is in use
  • AI literacy measures for staff and others operating AI systems
  • Article 50 disclosures and machine-readable marking of synthetic content
  • Risk management and data governance records for high-risk systems
  • Technical documentation and automatically generated logs
  • Human oversight that is assigned, trained and able to intervene
  • Quality management system and conformity assessment records
  • Post-market monitoring and serious incident reporting

Application dates

Entry into force1 August 2024
Prohibitions and AI literacy2 February 2025
General-purpose AI models, governance, penalties2 August 2025
Most other provisions, including Article 502 August 2026
New prohibitions; Article 50(2) for earlier systems2 December 2026
Earlier general-purpose AI models comply2 August 2027
High-risk obligations, Annex III systems2 December 2027
High-risk obligations, Annex I systems2 August 2028
High-risk systems used by public authorities already on the market2 August 2030

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Inventory and classification

  • AI system inventory
  • Role assessments
  • Classification decisions with reasons

Governance

  • AI policy
  • AI literacy programme and records
  • Accountable owners for each system

Risk and data

  • Risk management records
  • Data governance and bias assessments
  • Fundamental rights impact assessments where required

Technical file

  • Technical documentation
  • Instructions for use
  • Logging configuration
  • Accuracy and robustness test results

Oversight and transparency

  • Human oversight procedures
  • User and public disclosures
  • Content marking approach

Conformity and monitoring

  • Quality management system
  • Declaration of conformity
  • Post-market monitoring plan
  • Serious incident reports

Areas that often need attention

  • No inventory, so AI embedded in bought software goes unassessed
  • Role assumed rather than assessed, missing cases where the organisation becomes a provider
  • Annex III exclusions decided informally with no recorded reasoning
  • Human oversight assigned on paper but without training or authority to intervene
  • Transparency notices and output marking not implemented by the dates that already apply
  • Planning only for the deferred high-risk dates while earlier obligations already apply
  • Technical documentation assembled at the end instead of maintained during development

How Netra helps

Where each part of the work lives in Netra

Netra loads the AI Act as requirements, tasks and policies, so the governance work behind each obligation has an owner, a date and evidence.

Obligations owned and dated

Task Engine

Requirements arrive as tasks with owners and due dates, set against the application date that applies to each obligation.

Position against each chapter

Compliance Centre

Status is derived from completed tasks and evidence. Work done for ISO 42001 counts here too where the same control applies.

AI policy and literacy

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

AI risks and their treatment

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as linked tasks, such as oversight and testing, are completed.

AI systems in the inventory

Asset Management

Each AI system can be recorded as an asset and linked to the tasks and controls that govern it.

AI supplied by vendors

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Internal reviews of AI governance

Audit Centre

Run internal audits end to end, with findings and corrective actions, and evidence in a tamper-evident vault.

Reporting to leadership

Dashboard & Reports

A live Posture Score and a one-click board report built from current data.

Netra organises AI governance work and evidence. It does not classify systems under the Act on your behalf, test models, perform conformity assessment, act as a notified body or give legal advice, and it does not report incidents to authorities. Netra AI itself is a co-pilot: it works from your own records and never changes status on its own.

Common questions

More questions about Netra

Related frameworks

View all frameworks
AI governance

ISO 42001:2023

Build an AI management system with clear ownership

AI governance

NIST AI RMF 1.0

Turn responsible AI goals into accountable work

Privacy

GDPR

Make privacy accountability easier to demonstrate

See EU AI ACT 2024 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.