It is risk-based, not blanket
The single most useful thing to understand about the Act is that it does not treat all AI the same. Obligations follow the risk of the use case, not the sophistication of the model. Four tiers do the sorting:
- Prohibited. Uses the EU has decided are not acceptable at all — social scoring being the standard example.
- High risk. Where real consequences land on real people: recruitment, lending decisions, critical infrastructure. This tier carries the heavy obligations — documentation, oversight, data quality, monitoring.
- Transparency obligations. Systems that interact with people must say what they are. An AI assistant has to identify itself as one.
- Minimal risk. Spam filters, entertainment features, and most of what a normal business ships. Little to no additional obligation.
Most organisations discover they have a handful of systems in the high-risk tier, a long tail in minimal, and one or two in transparency they had not thought about — usually a customer-facing chatbot.
The timeline is phased
Provisions roll out across 2025–2027 rather than landing at once. In practice, the high-risk requirements and the governance provisions are the ones creating immediate work, because both assume records that take months to assemble.
The deadline that matters is your own
Compliance work is gated by evidence, not by the statute. An inventory started this quarter is worth more than a legal memo written the week before a provision applies.
What to do about it
- Map your AI systems and classify them. Every deployment, with the tier it falls into. Most of the eventual work is scoped by this one document.
- Designate accountability. Stand up a governance owner with the authority to say no. Distributed responsibility reads as no responsibility.
- Build the documentation trail. What the system does, what could go wrong, what controls exist, who reviewed it and when. A risk register is the fastest start.
- Track the deadlines that apply to you. Per provision, per tier — not the headline date the press reported.
If you are not in the EU
The Act still matters in two ways. It applies to organisations outside the EU whose systems affect people inside it, and it is becoming the default reference point for what “reasonable” AI governance looks like — which is how regulators elsewhere, and customers everywhere, will judge you.
Organisations that map their AI use, stand up basic governance, and document their risk now will be miles ahead when enforcement bites.