Europe’s landmark AI law is reshaping how organizations manage artificial intelligence. Here’s what businesses, professionals, and everyday AI users need to know.
The hiring tool that screens your resume, the chatbot that answers your bank questions, the app that edits your photos: Europe now has rules for all of them. The EU AI Act is the world’s first broad law written just for artificial intelligence, and its reach goes far beyond Europe. If an AI system’s output is used in the EU, its provider or deployer may fall within the Act’s scope, even when based outside the EU.
And the rulebook just changed. In July 2026, an EU amendment took effect that pushed its toughest requirements, the rules for high-risk AI, back by up to 16 months, to December 2027 and August 2028. But that is not a free pass: the bans on harmful AI and the transparency rules are already in force, and two new bans arrive in December 2026.
That makes the Act a GRC topic, not just a legal one. Someone has to find the AI systems, sort them by risk, document them, and prove the right controls exist. That someone is often a GRC professional.
This guide breaks the Act down in plain language: what it is, how it sorts AI by risk, what is already in effect, and what changed in July 2026.
The EU AI Act (Regulation (EU) 2024/1689) is a law that sorts AI systems by how much harm they could cause, then sets rules to match. It entered into force on 1 August 2024 and switches on in stages through 2028.
Think of it like food safety rules. A bakery and a baby formula factory both make food, but the formula factory faces far stricter checks because more can go wrong. The Act treats AI the same way: the rules depend on what the system is used for, not on the technology inside it.
Who it applies to. The Act gives different duties to different roles.
A provider builds an AI system or sells it under its own name, and carries the heaviest load, including technical documentation and conformity assessment. A deployer uses an AI system in its own work and must provide human oversight and watch for misuse. An importer brings a non-EU provider’s system into the EU market and must check that provider’s documentation, while a distributor makes a system available without changing it and confirms the required documents travel with it.
One organization can hold more than one role. A company that takes a vendor’s model and substantially changes it inside its own product can become a provider, not just a deployer.
A simple way to understand the Act is to picture four risk tiers. The law itself is more detailed, but the tier an AI system falls into largely decides its rules. Most everyday business AI falls into the bottom two.
At the top is unacceptable risk: practices banned outright, such as social scoring and real-time facial recognition in public spaces by police (with narrow exceptions). These practices are generally prohibited under the EU AI Act, subject to specific legal exceptions.
Next comes high risk: systems that could seriously affect people’s safety or rights, such as hiring tools, credit scoring, and AI in medical devices. These face the heaviest requirements, including risk management, documentation, human oversight, and conformity assessment.
Limited risk covers systems where people could be misled about what is AI, such as chatbots, deepfakes, and AI-generated content. The main rule here is transparency: people must be told they are dealing with AI or AI-made content.
Everything else is minimal risk, such as spam filters and inventory tools. These generally carry no additional risk-specific requirements.
A key detail: a system in a high-risk area is not automatically high-risk. If it only does a narrow procedural task, polishes work a person already finished, or does preparation work without profiling people, it can fall outside the high-risk tier. Providers relying on this exemption must document their assessment before the system goes to market and register it in the EU database (registration was simplified, but kept, by the 2026 amendment). A system that profiles people cannot use the exemption.
One more twist: the same AI model can power systems subject to different legal requirements, depending on how they are used. A customer-service chatbot may have transparency obligations, while an AI system used to screen job applicants may qualify as high-risk.
The Act also has rules for the big models that power many tools, such as large language models. These general-purpose AI (GPAI) model duties have applied since 2 August 2025.
Providers of these models must maintain required technical documentation and publish a sufficiently detailed summary of their training content. The most capable models, those judged to carry systemic risk, also face extra evaluation duties. The European Commission’s AI Office enforces this part directly, not national regulators.
For most organizations, the practical point is this: if you build on a vendor’s model, ask the vendor for its AI Act documentation. Their gaps can become your gaps.
Here is the full picture. The amending law called the Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026. It pushed most high-risk duties from August 2026 to December 2027. If you read an older explainer, its dates may be wrong.
The Act entered into force on 1 August 2024, but it switches on in stages. On 2 February 2025, the bans on unacceptable practices took effect and the AI literacy provisions began. On 2 August 2025, the rules for general-purpose AI models, the governance structure, and the penalty framework followed.
2 August 2026 was the general application date, when the transparency duties under Article 50 began to apply. On 2 December 2026, two new bans take effect, and the transition period ends for Article 50(2) synthetic-content marking and detection obligations for certain AI systems already on the market.
The high-risk rules come last. Stand-alone high-risk systems listed in Annex III, such as hiring, credit, and education tools, must comply by 2 December 2027. High-risk AI built into regulated products under Annex I, such as medical devices, follows on 2 August 2028. Finally, certain AI systems used by public authorities have until 2 August 2030.
The two new bans. The Omnibus added prohibitions on AI that creates non-consensual intimate images of real people (including “nudifier” apps) and child sexual abuse material. These apply from 2 December 2026.
A delay is not a pause. The bans and transparency duties are already enforceable. The extra time exists partly because the technical standards for proving high-risk compliance were not ready. Teams that use this window to build inventories and documentation will be ahead.
The fines are steep, and the top tier is higher than GDPR’s maximum. For large companies, each cap is whichever is higher: the fixed amount or the share of worldwide annual turnover. For SMEs, it is whichever is lower.
Using a banned AI practice can cost up to €35 million or 7% of global annual turnover. Breaking most other provider and deployer duties can cost up to €15 million or 3%, and giving regulators incorrect or misleading information can cost up to €7.5 million or 1%.
The Omnibus extended tailored penalty caps for certain violations to a new “small mid-cap” category (fewer than 750 staff).
The EU AI Act turns AI governance into evidence work, and evidence work is what GRC does. Here is where to start.
The first step is building an AI inventory: a list of every AI system in use, including tools staff adopted without approval, because you cannot classify what you cannot see. From there, classify each system by checking it against the banned list and then the high-risk areas, and write down why it landed where it did. For each system, decide whether your organization is the provider, the deployer, or both.
Next, map the data each system takes in, produces, and shares with outside vendors, and ask your model and tool vendors for their AI Act documentation. Finally, assign ownership. Legal, security, and the teams that build or buy AI all share this work, so name who owns what.
You do not have to start from zero. Two frameworks give you a ready-made structure.
ISO/IEC 42001 sets up an AI management system, with policies, roles, risk assessment, and controls that can be audited and certified. NIST AI RMF organizes AI risk work into four functions: Govern, Map, Measure, and Manage.
Neither one equals EU AI Act compliance on its own. But an organization running either has much of the inventory, risk assessment, and documentation discipline the Act expects already in place.
The EU AI Act sorts AI by risk, and the deadlines for high-risk systems now sit in December 2027 and August 2028. The bans and transparency rules are already live. The organizations that will be ready are the ones treating the next year as preparation time, not waiting time.
For GRC professionals, this is a real opening. The skills you already use, such as inventories, risk assessment, control mapping, and audit evidence, are exactly what AI governance needs.
Want to build those skills? Explore the UST AI GRC Master Course at grc.unlimitedst.com.
This article is for education and is not legal advice. Dates reflect the Digital Omnibus on AI as in force on 27 July 2026.
