When do the main requirements take effect?

Prohibited practices and AI literacy: February 2025 (in force). GPAI: August 2025. High-risk and deployer obligations: August 2, 2026. Certain product obligations: August 2027.

What are the maximum penalties?

EUR 35M or 7% turnover for prohibited practices. EUR 15M or 3% for high-risk violations. EUR 7.5M or 1% for incorrect information. SMEs get proportionately lower caps.

Who enforces the EU AI Act?

European AI Office for GPAI and cross-border issues. National competent authorities for high-risk system market surveillance within their jurisdiction.

Quick answer

This guide covers deployer responsibilities, providing detailed analysis for navigating the EU AI Act. With the August 2, 2026 deadline approaching, understanding requirements and practical compliance steps is essential for all organisations deploying or providing AI systems in the EU.

Updated June 2026 · MmowW AI Compliance

EU AI Act Deployer Obligations: Complete Guide

Regulatory Context

Comprehensive guide to all obligations for organisations using AI systems under the EU AI Act. The EU AI Act (Regulation (EU) 2024/1689) establishes the world's first comprehensive legal framework for artificial intelligence. Its risk-based approach imposes obligations proportionate to potential harm.

Prohibited practices (Article 5) have been in force since February 2, 2025. AI literacy (Article 4) also applies from this date. GPAI obligations took effect August 2, 2025. High-risk requirements take effect August 2, 2026.

Detailed Requirements

Provider obligations (Articles 16-25) cover responsibilities for organisations developing or placing AI on the market. Deployer obligations (Articles 26-27) cover organisations using AI. Additional provisions address importers, distributors, and the value chain.

For high-risk AI, core technical requirements in Articles 8-15 cover risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy/robustness/cybersecurity. All are mandatory before EU market placement.

Implementation Guidance

Start with scoping: determine which systems fall within Article 3(1)'s AI definition, classify by risk level, and identify applicable obligations based on your role. Gap analysis between current practices and requirements identifies where new processes are needed.

Many organisations find they already partially meet requirements through existing quality management, data governance, or product safety practices. The delta analysis focuses effort where it matters most.

Timeline and Enforcement

August 2, 2026 brings high-risk requirements, deployer obligations, and most provisions into force. Some Annex I Section A product obligations have a later August 2027 deadline.

The European AI Office and national competent authorities will enforce the Act. Early signals suggest active enforcement from August 2026, particularly for prohibited practices and high-visibility high-risk applications. Maximum penalties reach EUR 35 million or 7% of global turnover.

Check your AI compliance readiness — free.

Take the Readiness Check 3 minutes · 10 questions · no signup required

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.