Practical guides to help you navigate EU AI Act compliance.
The Digital Omnibus is in force as of July 27, which makes the December 2, 2027 high-risk deadline final law. August 2 settles Article 50 transparency for most companies. For anyone high-risk, it's the starting line for a 16-month build, not a break. Here's the roadmap.
Read articleAugust 2 is nearly here and plenty of companies haven't started. Here's the reassuring part: the minimum is smaller than the panic suggests. Most of what people are scrambling over isn't even due until 2027. This is the genuine bare minimum for August 2.
August 2 switches on enforcement, but not evenly. Some countries are ready with designated authorities and published guidance; many aren't. Enforcement will be a patchwork, and where your users are decides who can come knocking.
If you build on Claude, GPT, Gemini, or any foundation model, the GPAI Code of Practice shapes what your provider owes you — and what you inherit. Three chapters, two audiences, and enforcement that starts August 2. Here's the plain version.
Sentiment analysis, emotion detection, biometric categorisation. The same tech is banned in some settings, high-risk in others, and merely disclosure-obligated elsewhere. Which one applies to you depends entirely on where you point it. Here's the map.
If you deploy someone else's AI, their compliance failures can quietly become your problem. Your contract is the lever. Here's what to require from AI vendors, plus the EU's own model clauses that almost nobody uses.
On June 29 the Council gave final approval to the Digital Omnibus. It's no longer a proposal — it's law entering into force. The high-risk deadline moved, AI literacy softened, new prohibitions landed. But the August 2 transparency deadline didn't budge.
Everyone frames August 2 as a transparency deadline. That undersells it. It's the day GPAI penalty powers activate and national authorities get the power to investigate, demand documentation, and sanction. One month out, here's what actually goes live.
The AI Office extended the deadline to July 27, 2026. To make the published list of initial Code of Practice signatories, and lock in a presumption of Article 50 compliance, you have to submit by then. Here's what signing gets you and how to decide.
The Digital Omnibus rewrites Article 4 from 'ensure' AI literacy to the gentler 'take measures to support' it. But it isn't law yet, and the current obligation is still binding. Two opposite ways to misread this, both risky.
Most industries have to argue about whether Annex III covers them. Insurance doesn't. The regulation names life and health risk assessment and pricing directly. Here's what's in scope, what isn't, and what it means for insurers.
By August 2, 2026 every EU member state has to run an AI regulatory sandbox, and SMEs get in free with priority access. If you're building high-risk AI, it's the cheapest legal certainty you'll ever get. Here's how it works.
The Commission published the final Code of Practice on marking and labelling AI-generated content on June 10. It's voluntary, it's two sections, and signing it is the cleanest way to show Article 50 compliance. Here's what it asks for.
Yes, there's a grace period until December 2, 2026. No, it doesn't mean what most people think. It covers one narrow technical requirement — and the disclosures everyone actually notices still hit on August 2.
Article 13 requires high-risk AI providers to ship 'instructions for use' with their systems. Most teams treat this as a user manual. It's not. Here's what auditors will actually look for.
Everyone's focused on the August 2026 deadline. But Article 4 has been in force since February 2025. If your team uses AI and nobody's had training, you're already non-compliant.
Everyone's building AI agents. Nobody's asking where they fall under the EU AI Act. An agent that makes decisions about people might be high-risk — and autonomy makes compliance harder, not easier.
If you use ChatGPT, Claude, or any AI tool and serve EU customers, the regulation probably applies to you. Here's how to tell.
The fines, the enforcement timeline, and the real risk that isn't about money. Here's what missing August 2 actually looks like.
Article 50 says users must know they're talking to AI. But what does that actually look like in your product? Copy-paste examples for chatbots, support tools, and content features.
August 2, 2026 is when Article 50 kicks in. Most companies haven't started. Here's what actually changes, what you need to do, and why the panic hasn't started yet.
The Commission's draft guidelines clarify what 'clearly labelled' actually means for AI-generated content. It's not just a disclaimer — you need metadata, watermarks, and fingerprinting working together.
Most startups using AI wonder whether EU AI Act compliance applies at their stage. Here's when obligations kick in, what you can defer, and what you should do now regardless of size.
Article 13 requires high-risk AI systems to be transparent and produce automatic logs. Here's what that means for your product — user-facing design, technical logging, and documentation.
Article 62 requires providers and deployers of high-risk AI to report serious incidents to authorities. Here's what counts as an incident, the timeline, and how to build a reporting process.
The EU AI Act is real — but most of the panic is overblown. Here's an honest breakdown of what doesn't apply to most businesses, and where the actual obligations are.
Article 10 sets strict rules for training, validation, and testing data used in high-risk AI systems. Here's what data governance means in practice and how to comply.
Article 17 requires high-risk AI providers to operate a documented quality management system. Here's what it must cover, how it connects to ISO standards, and how to build one.
Education AI for admissions, assessment, and learning analytics is high-risk under Annex III. Here's exactly which systems are in scope and what schools, edtech companies, and universities must do.
Open-source AI models get limited exemptions under the EU AI Act — but far less than most developers think. Here's what's actually exempt, what's not, and what open-source providers still need to do.
Biometric AI faces the strictest rules under the EU AI Act — some uses are outright prohibited, others are high-risk. Here's the complete breakdown of what's allowed and what's not.
A practical guide to building internal AI governance — the policies, roles, processes, and tools you need to manage AI compliance across your organisation.
Healthcare AI faces some of the strictest EU AI Act obligations — and overlaps with the Medical Devices Regulation. Here's which systems are in scope and what to do.
Article 14 requires product features that let humans monitor, interpret, and override AI decisions. Here's what to build — confidence scores, override mechanisms, and monitoring dashboards.
Article 49 requires high-risk AI systems to be registered in the EU database before market placement. Here's the timeline, what you need, and the step-by-step process.
A practical week-by-week plan for meeting the August 2, 2026 transparency deadline. Classification, disclosures, content labeling, and testing — all scoped to 8 weeks.
A realistic cost breakdown: consultants, DIY, and tooling compared. What SMBs and mid-market companies should actually budget.
Article 50 requires AI-generated content to be labeled. Here's what counts, which standards to use, and where the exceptions are.
Already GDPR-compliant? You have a head start — but it's not enough. Here's what overlaps, what's genuinely new, and where the two regulations diverge.
The Digital Omnibus created a dual-deadline reality. Transparency hits August 2026, high-risk lands December 2027. Here's how to prioritize your compliance work.
The one Article 50 guide you need before August 2. What each transparency obligation requires, what the published Code of Practice says, where the watermarking grace period applies, and a checklist to get it done. The Digital Omnibus did not move this deadline.
Article 9 requires high-risk AI providers to maintain a continuous risk management system — not a one-time audit. Here's what that means in practice and how to build one.
Most EU AI Act coverage focuses on providers building AI. But if you deploy a third-party AI tool in your business, you have your own binding obligations. Here's what they are.
Financial services AI sits squarely in the EU AI Act's high-risk category. Here's exactly which fintech tools trigger Annex III obligations and what you need to do before the deadline.
If your company uses AI tools for hiring, screening, or performance management, you have EU AI Act obligations — even though you didn't build the software.
The Digital Omnibus deal is confirmed. Annex III high-risk obligations are pushed to December 2, 2027. Here's what changed, what stays the same, and what to do now.
Legal AI tools face some of the most complex obligations under the EU AI Act. Here's exactly which products are high-risk, what the gray areas are, and what you need to do.
What does enforcement actually look like after the deadlines pass — and what happens to companies that aren't ready?
Most companies still haven't started their EU AI Act compliance. Here's how long it actually takes, why procrastinating is dangerous, and what to do today.
A practical breakdown of what the EU AI Act means for small and mid-size businesses, what you need to do, and how to get started.
Learn how the EU AI Act's four-tier risk classification works, where your AI system falls, and what obligations apply to each level.
A section-by-section breakdown of what Annex IV requires for high-risk AI systems and how to produce compliant technical documentation.
HR software using AI for hiring, screening, or performance management is classified as high-risk under the EU AI Act. Here's exactly what that means for your product.
If your SaaS product uses AI features and serves EU customers, the EU AI Act likely applies — even if you're not based in Europe. Here's the practical guide for product teams.
A breakdown of EU AI Act fine tiers, who enforces them, and what violations actually trigger penalties — with real numbers for SMBs.
A practical checklist for businesses with high-risk AI systems — covering every obligation you need to meet before the December 2, 2027 deadline.
If your product has a chatbot, virtual assistant, or any AI that talks to users, Article 50 applies. Here's exactly what you need to disclose and how to do it.
Building on a foundation model? The EU AI Act has specific rules for GPAI model providers and the developers who integrate them. Here's what applies to you.
Your company is based in the US, but some of your users are in Europe. Does the EU AI Act apply to you? The short answer is yes — here's exactly why and what to do about it.
The EU AI Act treats AI providers and deployers very differently. Which one are you — and what obligations does that create? Here's the clearest explanation available.
Some AI practices are banned outright in the EU — no exceptions, no workarounds. Here's the complete list of what Article 5 prohibits and why each practice is banned.
High-risk AI systems must undergo a conformity assessment before going to market. Here's who needs one, what it involves, and whether you need a third party to do it.