Who is in scope of the EU AI Act?

The Act applies to providers placing AI systems on the EU market, deployers using AI in the EU, importers and distributors, and providers of general-purpose AI models — regardless of whether they are established in the EU. Output produced by an AI system used in the EU also triggers extraterritorial application.

What are the EU AI Act timeline milestones?

The Act entered into force on 1 August 2024. Bans on prohibited practices apply from 2 February 2025; GPAI obligations from 2 August 2025; the bulk of provisions, including high-risk-system duties, from 2 August 2026; and high-risk AI embedded in Annex II product-safety legislation from 2 August 2027.

Which AI systems are considered 'high-risk'?

High-risk AI systems are listed in Annex III and cover eight areas: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and administration of justice and democratic processes. AI systems acting as safety components of products covered by Annex II legislation are also high-risk.

What practices are banned under Article 5?

Article 5 prohibits subliminal or manipulative AI causing harm, exploitation of vulnerabilities, social scoring by public or private actors, untargeted facial-image scraping, emotion recognition at work or in education, biometric categorisation inferring sensitive attributes, and most real-time remote biometric identification in publicly accessible spaces.

What obligations apply to general-purpose AI models?

GPAI providers must keep technical documentation, publish a sufficiently detailed summary of training data, comply with EU copyright law, and cooperate with the AI Office. Models with systemic risk (cumulative training compute above 10^25 FLOPs) face additional duties: model evaluation, adversarial testing, serious-incident reporting and cybersecurity protection.

What are the maximum AI Act fines?

Article 99 sets three tiers: up to €35 million or 7% of total worldwide annual turnover for prohibited-practice breaches; up to €15 million or 3% for breaches of most other obligations; up to €7.5 million or 1% for supplying incorrect or misleading information to authorities. SMEs and start-ups benefit from proportionally lower caps.

EU Compliance Platform — v.2026

The European platform for measurable compliance posture.

LEXNOMIA turns the static letter of EU regulation — GDPR, NIS2, DORA, EU AI Act, ISO 27001, CRA, DSA — into auditor-grade readiness assessments mid-market organisations can act on in minutes.

Frameworks covered

GDPR — General Data Protection Regulation
NIS2 — Network & Information Security Directive
DORA — Digital Operational Resilience Act
EU AI Act — Regulation (EU) 2024/1689
ISO/IEC 27001:2022 — Information Security Management
Cyber Resilience Act
Digital Services Act

Pricing

Free trial · Starter €99/mo · Professional €299/mo · Enterprise €499/mo