The EU AI Act, Explained: Risk Tiers, Obligations, and the Current Timeline

The European Union's Artificial Intelligence Act is the first broad, horizontal law written specifically to govern AI. It entered into force on 1 August 2024 as Regulation (EU) 2024/1689, and its obligations phase in over several years. For anyone building an AI governance program, it is the single most consequential piece of regulation in the field, and its influence extends well past Europe's borders.

This guide explains what the Act does, how its risk tiers work, which obligations fall on whom, when each part applies after the 2025 Digital Omnibus amendments, and how the Act sits alongside the NIST AI Risk Management Framework and ISO/IEC 42001.

A risk-based law, not a technology law

The Act does not try to define or restrict AI by how it is built. It regulates AI by what it is used for and how much harm it could cause. That single design choice explains almost everything about how the law is structured. The same underlying model can sit in a minimal-risk product in one deployment and a high-risk system in another. The obligations follow the use case and its potential impact on people, not the algorithm.

The four risk tiers

• Unacceptable risk (prohibited). A short list of practices banned outright under Article 5, including social scoring by public authorities, certain manipulative or exploitative systems, untargeted scraping of facial images, and most real-time remote biometric identification in public spaces.
• High risk. The core of the Act. Annex III lists stand-alone use cases such as AI used in employment, education, access to credit and essential services, law enforcement, migration, and the administration of justice. Annex I covers AI used as a safety component of products already regulated under EU law. High-risk systems carry the heaviest obligations.
• Limited risk (transparency). Systems such as chatbots, emotion-recognition tools, and generators of synthetic media must tell people they are interacting with AI or that content is AI-generated, under Article 50.
• Minimal risk. Everything else, the large majority of AI, carries no new legal obligations under the Act.

The application timeline after the Digital Omnibus

The Act applies in stages. By late 2025 the original schedule was running ahead of the standards, guidance, and national authorities needed to support it, so the Commission proposed the Digital Omnibus on AI. The resulting instrument, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the heaviest high-risk deadlines back, while leaving the transparency duties and the prohibitions on their original timeline.

Who the Act applies to

The Act reaches organizations far outside the EU, an effect often called the Brussels effect. Its two most important roles are:

• Providers develop an AI system or a GPAI model and place it on the EU market or put it into service under their own name, wherever they are established. Providers of high-risk systems carry the bulk of the obligations: a risk-management system, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, a quality management system, and conformity assessment before the system goes to market.
• Deployers use an AI system in a professional capacity. A deployer outside the EU is still covered where the output of the system is used in the EU. Deployer duties are lighter but real: use the system according to instructions, ensure human oversight, monitor operation, and in some cases run a fundamental-rights impact assessment.

General-purpose AI models

The Act sets a separate track for general-purpose AI, the large foundation models that power many downstream products. All GPAI providers owe transparency and documentation duties. Models judged to carry systemic risk face additional obligations around evaluation, risk mitigation, incident reporting, and cybersecurity. The GPAI Code of Practice gives providers a route to demonstrate compliance.

Penalties

Enforcement has teeth, and the Digital Omnibus did not soften it. Breaching the prohibitions can bring fines up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Most other breaches carry a lower tier of up to 15 million euros or 3 percent of turnover. Supplying incorrect information to authorities carries its own penalty band.

How the Act fits with NIST and ISO/IEC 42001

The EU AI Act is law: it sets binding obligations tied to role and risk classification. It does not tell you, step by step, how to build the program that produces compliance. That is where the voluntary frameworks come in. The NIST AI Risk Management Framework gives you a risk vocabulary and process. ISO/IEC 42001 gives you a certifiable management system whose controls generate much of the evidence the Act expects. A program anchored in those frameworks will satisfy a large share of what the Act asks for, with the marginal work per obligation becoming documentation, notices, and conformity assessment rather than a rebuild. For the mapping in detail, see how the EU AI Act maps to NIST AI RMF and how ISO/IEC 42001 maps to the law.

None of the dates or figures above should be treated as legal advice. The Act is complex, guidance continues to evolve, and classification often turns on the specific use case. Confirm your obligations with qualified counsel for the jurisdictions you operate in.