The EU AI Act explained: risk categories and who it applies to
The EU AI Act sorts AI into risk levels and attaches duties to each. This guide explains the four levels, who is covered, what is banned, what counts as high-risk, what the fines are and what the 2026 amendment changed. Exact dates are on our EU AI Act timeline; related guides are in AI law, copyright and safety.
By the Chelure Enterprises Editorial Team. Last reviewed . How we check our sources.
What the Act is
The AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in stages. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended it and entered into force on 27 July 2026. The Commission describes the Act as the first comprehensive legal framework on AI worldwide, with rules set by risk level.
Who it applies to
Article 2 covers providers placing AI systems or general-purpose AI models on the EU market (wherever the provider is established), deployers located in the EU, providers and deployers in third countries where the output of the system is used in the Union, importers, distributors, product manufacturers that put an AI system on the market under their own name, authorised representatives and affected persons in the EU.
| Not covered (Article 2) | Detail |
|---|---|
| Military, defence and national security | Systems used exclusively for those purposes |
| Scientific research | Systems developed and used solely for scientific research and development |
| Pre-market development and testing | Research and testing before market placement, but not real-world testing |
| Personal non-professional use | Individuals using AI in a purely personal, non-professional activity |
| Free and open-source licences | Excluded unless the system is high-risk or falls under the prohibitions or transparency rules |
The four risk levels
| Level | What it means | Examples (Commission) |
|---|---|---|
| Unacceptable risk | Banned (Article 5) | Harmful manipulation, social scoring, untargeted scraping of faces to build recognition databases, emotion recognition in workplaces and schools |
| High risk | Allowed, but strictly regulated (Annex III areas and products under Annex I) | CV-sorting for recruitment, credit scoring, exam scoring, AI safety components in transport, tools that help prepare court rulings |
| Transparency (limited) risk | Disclosure duties (Article 50) | Chatbots must say they are AI; deepfakes must be labelled |
| Minimal or no risk | No specific obligations | AI-enabled video games, spam filters |
What is banned
Article 5(1) prohibits: subliminal or deliberately manipulative techniques that materially distort behaviour and cause significant harm; exploiting vulnerabilities linked to age, disability or social or economic situation; social scoring leading to unjustified or disproportionate treatment; assessing the risk a person will commit a crime based solely on profiling or personality traits; building facial recognition databases through untargeted scraping of internet or CCTV images; inferring emotions in workplaces and education, except for medical or safety reasons; biometric categorisation that infers race, political opinions, union membership, religion, sex life or sexual orientation; and real-time remote biometric identification in public spaces for law enforcement, except for narrow listed purposes with safeguards. The 2026 amendment adds bans on AI systems that generate sexually explicit realistic material of an identifiable person without consent and on systems that generate child sexual abuse material, from 2 December 2026.
What counts as high-risk
Annex III lists eight areas. A system in one of them is high-risk and must meet the Act's requirements for high-risk systems, which apply from 2 December 2027. AI in products covered by Annex I EU safety legislation follows from 2 August 2028.
| Annex III area | Examples |
|---|---|
| Biometrics (where permitted) | Remote biometric identification, biometric categorisation by sensitive attributes, emotion recognition |
| Critical infrastructure | Safety components in digital infrastructure, road traffic, and water, gas, heating or electricity supply |
| Education and vocational training | Admission, assigning students, evaluating learning outcomes, monitoring prohibited behaviour in tests |
| Employment and workers' management | Recruiting and selecting candidates, decisions on promotion, termination, task allocation and performance monitoring |
| Essential services and benefits | Eligibility for public assistance, credit scoring, life and health insurance pricing, prioritising emergency calls |
| Law enforcement (where permitted) | Risk of victimisation or offending, evidence reliability, profiling in criminal investigations |
| Migration, asylum and border control (where permitted) | Risk assessments, reviewing asylum, visa and residence applications |
| Justice and democratic processes | Assisting judicial authorities; systems intended to influence elections or voting behaviour |
Transparency duties (Article 50)
| Duty | Who | What |
|---|---|---|
| Chatbots, Article 50(1) | Providers | Design systems that interact with people so users are told they are dealing with AI, unless obvious |
| Synthetic content marking, Article 50(2) | Providers | Mark generated audio, image, video or text in a machine-readable format so it is detectable as artificially generated or manipulated |
| Emotion recognition and biometric categorisation, Article 50(3) | Deployers | Inform exposed people how the system operates |
| Codes of practice, Article 50(7) | Commission | Encourages Union-level codes of practice on labelling and detection of AI-generated content and assesses their adequacy; the 2026 amendment removed the power to approve codes by implementing act, while the Commission may still adopt common rules by implementing act if a code is inadequate (per the legal check supplied to our editors) |
| Deepfakes and public-interest text, Article 50(4) | Deployers | Disclose deepfakes; disclose AI-generated text published to inform the public on matters of public interest unless humanly reviewed under editorial responsibility |
If you build content tools, our token counter and AI cost guides cover the technical side; the labelling duties here are legal ones.
General-purpose AI models
According to the Commission, providers of general-purpose AI models must meet transparency and copyright rules, and models that may pose systemic risks must also have those risks assessed and mitigated. The AI Office can request technical documentation, evaluate models, require corrective measures and issue fines. These obligations applied from 2 August 2025. The 2026 amendment gives the AI Office exclusive competence over AI systems built on general-purpose models in specified cases.
Fines (Article 99)
| Infringement | Maximum fine |
|---|---|
| Prohibited practices (Article 5) | EUR 35,000,000 or 7 percent of total worldwide annual turnover, whichever is higher |
| Most other operator obligations, including Article 50 transparency, and (new) breaches of the written-agreement duties of Article 25(2) and (4) on third-party suppliers (Article 99(4)(da)) | EUR 15,000,000 or 3 percent, whichever is higher |
| Incorrect, incomplete or misleading information to authorities or notified bodies | EUR 7,500,000 or 1 percent, whichever is higher |
| Providers of general-purpose AI models, fined by the European Commission (Article 101) | EUR 15,000,000 or 3 percent, whichever is higher; applicable since 2 August 2026 |
For SMEs, including start-ups, each fine is capped at the lower of the percentage or the amount, across all three Article 99 tiers. The 2026 amendment (Article 99(6a)) extends the same lower-of cap to small mid-cap companies for the 15 million and 7.5 million tiers, while small mid-caps remain subject to the higher-of rule for breaches of the Article 5 bans. The three maximum amounts themselves were not changed by Regulation (EU) 2026/1744, according to the legal check supplied to our editors.
What the 2026 amendment changed
- High-risk application dates moved to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- New bans on non-consensual sexual deepfakes, nudification apps and child sexual abuse material from 2 December 2026.
- The AI literacy duty in Article 4 changed: according to recital 8 of the Omnibus, providers and deployers must take measures to support AI literacy, instead of ensuring a sufficient level of it.
- Simplified rules for SMEs were extended to small mid-cap companies, and sandbox access was widened; national sandboxes are now due by 2 August 2027.
- Machinery: Regulation (EU) 2023/1230 moved from Annex I Section A to Section B, so under amended Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply to machinery, and AI-specific requirements are to arrive through delegated acts by 2 August 2028.
- Fines: two operative changes to Article 99, described above (the supplier-agreement tier and the small mid-cap cap).
- Article 50(7): the Commission's power to approve codes of practice by implementing act was removed.
How we checked. Dates and requirements were first cross-checked on the European Commission’s AI Act page, the AI Act Explorer’s text of Article 113, Article 2, Article 5, Article 50, Article 99, Annex III and the recitals of the Digital Omnibus, and the EFTA EEA-Lex record for the amending regulation. On 14 November 2026 a legal check supplied to our editorial team confirmed them against the Official Journal text of Regulation (EU) 2026/1744 (in force 27 July 2026) and its corrigendum of 29 September 2026, which the check reports applies to the German-language version only and changes no dates. We have not ourselves opened EUR-Lex from our systems. The official texts are on EUR-Lex: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744. Confirm any date you rely on legally against the Official Journal. This page is a plain-language summary, not legal advice.
Frequently asked questions
What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689, the European Union's law on artificial intelligence. It sets rules by risk level: some uses are banned, high-risk uses are tightly regulated, some systems must tell people they are AI, and most AI is left unregulated.
Does the EU AI Act apply to companies outside the EU?
It can. Article 2 covers providers that place AI systems or general-purpose AI models on the EU market wherever they are established, and providers and deployers in third countries where the system's output is used in the Union.
What are the fines?
The maximum fines in Article 99 are EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices, EUR 15 million or 3 percent for most other obligations, and EUR 7.5 million or 1 percent for supplying incorrect information, whichever is higher. For SMEs, including start-ups, the lower of the two figures applies, and the 2026 amendment extends that cap to small mid-cap companies for the two lower tiers.
Is a chatbot high-risk?
Usually not. A chatbot is generally a transparency case: Article 50(1) requires that people are told they are interacting with an AI system unless that is obvious. A chatbot used for something listed in Annex III, such as screening job candidates, can be high-risk.
Do I need to label AI-generated content?
Providers of systems that generate synthetic audio, image, video or text must make outputs machine-readable and detectable as artificially generated (Article 50(2)), and deployers must disclose deepfakes and AI-generated text on matters of public interest (Article 50(4)), with exceptions. Generative systems already on the market before 2 August 2026 have until 2 December 2026 for the marking duty.
When do the high-risk rules start?
On 2 December 2027 for Annex III use cases and 2 August 2028 for AI in products covered by Annex I EU safety law, after the 2026 Digital Omnibus delayed them from 2 August 2026 and 2 August 2027.
Sources
- European Commission: AI Act (regulatory framework for AI)
- AI Act Explorer: Article 2, scope
- AI Act Explorer: Article 5, prohibited practices
- AI Act Explorer: Annex III, high-risk areas
- AI Act Explorer: Article 50, transparency obligations
- AI Act Explorer: Article 99, penalties
- AI Act Explorer: Digital Omnibus on AI
- EUR-Lex: Regulation (EU) 2024/1689 (official text)
- EUR-Lex: Regulation (EU) 2026/1744 (official text)
Primary sources opened on November 13, 2026. Prices come from our verified price table (see the methodology).
Cite this page: EU AI Act explained. Createchz AI Tools, verified November 13, 2026. https://createchz.com/ai-law/eu-ai-act-explained/