EU AI Act Guide 2026: Risk Classes, GPAI, Deadlines, Fines

1. What is the EU AI Act?

The Regulation (EU) 2024/1689 on Artificial Intelligence (AI Act) is the world's first comprehensive horizontal regulation of artificial intelligence. It entered into force on 01.08.2024, applies in stages and is fully effective from 02.08.2027.

The AI Act follows a risk-based approach: the higher the risk of an AI application to safety, health or fundamental rights, the stricter the obligations. Unlike the GDPR, the AI Act doesn't primarily regulate data processing but products and applications along the value chain from development to deployment.

Core concepts:

• AI System (Art. 3 No. 1): a machine-based system that operates with varying degrees of autonomy, may exhibit adaptiveness, and from received inputs infers outputs (predictions, content, recommendations, decisions) that can influence physical or virtual environments.
• GPAI model (Art. 3 No. 63): an AI model trained with broad data enabling general-purpose use — e.g. large language models (LLMs), image generators.
• Placing on the market (Art. 3 No. 9): first making available in the Union — threshold for provider obligations.
• Putting into service (Art. 3 No. 11): supply for first use to the deployer or own use.

2. The 4 risk classes

2.1 Prohibited practices (Art. 5)

Certain AI applications are completely prohibited in the EU. Violations cost up to €35M / 7% turnover:

• Subliminal manipulation / manipulative techniques causing harm
• Exploitation of vulnerabilities (age, disability, social status)
• Social scoring by public authorities
• Predictive policing based solely on profiling
• Real-time biometric identification in public spaces (with exceptions for law enforcement)
• Emotion recognition in workplaces and educational institutions
• Biometric categorisation by sensitive characteristics
• Untargeted scraping of facial images for databases

2.2 High-risk AI (Art. 6 + Annexes I, III)

Two paths lead to high-risk classification:

• Annex I path: AI systems as safety components in regulated products (machinery, lifts, medical devices, toys, etc.) — conformity assessment via sectoral product regulations.
• Annex III path (relevant for SMBs): 8 use-case categories:
  1. Biometrics (identification, categorisation, emotion)
  2. Critical infrastructure (water, gas, electricity, transport)
  3. Education + vocational training (admissions, assessment, behaviour)
  4. Employment + workforce management (recruiting, promotion, dismissal, task allocation)
  5. Access to essential services (credit, insurance, public benefits, emergency services)
  6. Law enforcement
  7. Migration, asylum, border control
  8. Justice + democratic processes

2.3 Limited risk (Art. 50 transparency)

Specific transparency obligations without further conformity assessment:

• Chatbots: must identify themselves as AI
• Deepfakes: must be labelled as artificially generated
• Emotion recognition / biometric categorisation (outside prohibited practices): inform affected persons
• AI-generated text on matters of public interest: labelling required

2.4 Minimal risk

Everything not falling into the above three classes — e.g. spam filters, AI recommendations in e-commerce, text-creation assistants. No specific AI Act obligations, but GDPR and sectoral regulations still apply.

3. Provider vs. Deployer

The AI Act distinguishes two central roles with different obligations:

3.1 Provider (Art. 3 No. 3)

Anyone who develops or has developed an AI system and places it on the market in the Union under their own name — whether paid or free of charge. Even internal in-house developments for own use fall under this if the system "leaves" the provider's premises.

Obligations for high-risk AI (Art. 16 et seq.): conformity assessment, technical documentation Annex IV, risk management system Art. 9, data quality Art. 10, logging Art. 12, transparency Art. 13, human oversight Art. 14, accuracy/robustness/cybersecurity Art. 15, quality management Art. 17, EU database registration Art. 49, post-market monitoring Art. 72.

3.2 Deployer (Art. 3 No. 4)

Anyone who uses an AI system under their own responsibility, excluding purely private activity. Anyone purchasing and operating an existing high-risk AI system (e.g. recruiting tool, credit scoring software, education platform) is a deployer.

Obligations for high-risk AI (Art. 26): use according to provider instructions, ensure human oversight, log for at least 6 months, monitor input data quality, inform staff + affected persons, FRIA Art. 27 (for public bodies + specific sectors), report incidents to provider and where relevant the market surveillance authority.

3.3 Watch out: Art. 25 — role switches

A deployer becomes a provider with all obligations if they:

• Market the system under their own name or brand (e.g. white-label rebranding of a purchased AI tool)
• Substantially change the intended purpose of a high-risk AI system
• Make a substantial modification to a high-risk AI system

Practical implication: Anyone fine-tuning a generic LLM (e.g. via API) and integrating it into proprietary customer applications can become a provider depending on the use-case — with full conformity responsibility.

4. High-risk AI: provider obligations Art. 9–15

The 7 central obligations for providers of high-risk AI systems:

1. Risk management system (Art. 9): continuous iterative process across the lifecycle — identify risks, assess, mitigate, communicate residual risks.
2. Data governance (Art. 10): training, validation, test data must be representative, error-free and complete. Bias detection mandatory.
3. Technical documentation (Art. 11, Annex IV): 47-field catalogue — system description, training data, architecture, performance metrics, risks, maintenance.
4. Record-keeping / logging (Art. 12): automatic logs across lifecycle, at minimum inputs + outputs + confidence levels.
5. Transparency + information (Art. 13): instructions for deployers — capabilities, limitations, accuracy, maintenance, cybersecurity.
6. Human oversight (Art. 14): design AI systems for effective human oversight (e.g. override functions, anomaly detection).
7. Accuracy, robustness, cybersecurity (Art. 15): establish performance levels, robustness against drift and adversarial attacks, cybersecurity measures.

Additionally: conformity assessment (Art. 43, internal or by notified body), CE marking, EU database registration (Art. 49), post-market monitoring (Art. 72), notification of serious incidents (Art. 73).

5. GPAI Art. 53–55 — General Purpose AI Models

GPAI models (e.g. GPT-5, Gemini Pro, Claude, LLaMA) have their own obligation layer:

5.1 Standard GPAI (Art. 53)

• Technical documentation of the model (Annex XI)
• Downstream information for downstream providers (Annex XII)
• Copyright compliance via DSM Directive 2019/790 Art. 4(3)
• Publicly available training data summary ("sufficiently detailed summary")
• Code of Practice (May 2025, published by EU AI Office)

5.2 GPAI with systemic risk (Art. 55)

Additionally for models with compute > 10²⁵ FLOPS at training:

• Model evaluations (standard benchmarks + state-of-the-art tests)
• Adversarial testing (red teaming)
• Cybersecurity protection against theft / leakage of model weights
• Incident reporting to the EU AI Office for serious incidents

6. Deadlines 2024–2027

7. Fines

Art. 99(6): SMBs + start-ups receive proportionate reduction — but not zero. Supervision is carried out by national authorities + EU AI Office.

8. 10-step roadmap for SMBs

1. AI inventory (week 1): Which AI systems do we use? What have we developed? Where deployed?
2. Role clarification (week 2): Are we provider, deployer or both per system?
3. Risk classification (weeks 2-3): Which systems are prohibited, high-risk, limited, minimal?
4. AI literacy plan (weeks 3-4): Training concept for all AI users — fulfil Art. 4.
5. Transparency notices (week 4): Mark chatbots, deepfakes, emotion recognition — Art. 50 for limited risk.
6. Risk management system (weeks 5-8, only provider high-risk): Set up Art. 9 process.
7. Technical documentation (weeks 6-10, provider): Fill in Annex IV catalogue.
8. Logging + human oversight (weeks 8-12): Art. 12, 14 — automatic logs, override mechanisms.
9. FRIA for deployer obligations (week 10): Art. 27 if public body or specific sectors.
10. Post-market monitoring (week 12+): continuous effectiveness assessment, incident notifications.

9. Sector practice: EU AI Act in common use-cases

9.1 Recruiting + HR (high-risk, Annex III No. 4)

HR software with AI evaluation (resume screening, video interview analysis, skill matching) is high-risk under Annex III No. 4. Specifics:

• Double legal framework: EU AI Act + GDPR Art. 22 (automated individual decision) + AGG § 22 (burden of proof reversal)
• Provider obligations: when HR tools are own developments or substantially modified (Art. 25)
• Deployer obligations: FRIA not mandatory, but staff information required (Art. 26(7))
• Bias audit: regularly check training data + output for discrimination patterns — interlinked with Pay Transparency 2026
• Deadline: 02.08.2026 full high-risk obligations

9.2 Education + vocational training (high-risk, Annex III No. 3)

AI-supported student assessment, automated grading, plagiarism detection, language-learning AI. Specifics:

• High-risk classification also for SMB edutech (online language schools, coaching tools)
• Transparency to learners (Art. 26(11)) — information about AI use
• Data governance Art. 10 — bias in training data (e.g. dialects, accents in speech AI)
• Conformity assessment potentially by notified body

9.3 Creditworthiness + insurance (high-risk, Annex III No. 5)

AI for credit decisions, insurance premiums, risk scoring. Annex III No. 5b. Specifics:

• FRIA mandatory (Art. 27(1)(c)): for life/health insurance risk assessment + creditworthiness
• Existing supervision (BaFin, FINMA, FMA) supplements EU AI Act
• Explainability (Art. 86): affected persons have right to explanation of high-risk decisions
• Synchronise GDPR Art. 22 + AI Act — joint documentation

9.4 Mechanical engineering + embedded AI (high-risk, Annex I)

AI as safety component in regulated products (Machinery Regulation, MDR, lifts, toys). Annex I covers this. Specifics:

• Deadline postponed to 02.08.2027 by Digital Omnibus 2025 (transition period)
• Conformity integrated with existing product directives (CE marking)
• Sectoral supervision: market surveillance via product directive authorities
• Cyber Resilience Act (CRA, 2024/2847) supplements for connected products

9.5 Chatbots + customer service AI (limited risk, Art. 50)

Standard chatbots, FAQ bots, conversational AI in customer service. Specifics:

• Transparency obligation Art. 50(1): "You are talking to an AI system" must be clear at the start
• No conformity assessment, but data protection compliance (GDPR Art. 22, Art. 13/14)
• For AI-assisted complaint handling with human escalation: no high-risk classification

10. Anonymised case studies

10b. Implementation status DACH (as of Q2 2026)

Status of national supervision and concretisation in DACH:

• Germany: AI supervision bundle — Federal Network Agency as central market surveillance authority under § 23 KIGV draft, BSI for cybersecurity, BfDI for data protection interfaces, BaFin for financial AI. Consolidation via federal-state agreement in preparation.
• Austria: AI service centre at RTR (broadcasting and telecom regulator) operational since August 2025. First advisory tickets already being handled.
• Switzerland: No direct AI Act equivalent, but sectoral regulation (FINMA, Swissmedic, IPI). Swiss providers in the EU market are directly EU AI Act-bound.
• EU AI Office (Brussels): central GPAI supervision since August 2025, Code of Practice for GPAI published May 2025. ~140 staff, expanding to 300 by 2027.

10c. Open interpretation questions 2026

Six points where legal practice remains unclear:

• "Substantial modification" (Art. 25): when does fine-tuning a GPAI become a "substantial change"? EDPB guidelines expected 2026.
• FRIA depth: how detailed must the impact assessment be? Example templates from the EU Commission still pending.
• Open-source exemptions Art. 2(12): which models (e.g. LLaMA, Mistral) fall when under GPAI obligations?
• Interface with GDPR Art. 22: when is automated decision simultaneously high-risk AI? Both regimes overlap but differ in protection logic.
• Application to legacy systems: AI systems placed on the market before 02.08.2026 — Art. 111 provides transitional rules but application questions remain.
• Liability chain in API integration: who is liable for damages — the GPAI provider (OpenAI), the API integrator, or the end customer?

10d. First-measures checklist for AI providers and deployers

1. ✅ AI inventory (all systems + model type + use-case + role provider/deployer)
2. ✅ Risk classification per system (Art. 5 / Art. 6+Annex III / Art. 50 / minimal)
3. ✅ AI Literacy training plan documented (Art. 4, since 02.02.2025)
4. ✅ Transparency notices for chatbots / deepfakes implemented (Art. 50)
5. ✅ For high-risk AI: provider pack Art. 9–15 created or in preparation
6. ✅ Annex IV technical documentation in progress (47-field catalogue)
7. ✅ Conformity assessment Art. 43 planned (internal or notified body)
8. ✅ FRIA conducted if deployer obligation applies (Art. 27)
9. ✅ Post-market monitoring concept (Art. 72)
10. ✅ Incident reporting process (Art. 73)

10e. 6 real EU AI Act cases 2024–2026

Supervisory authorities, data protection authorities and national market surveillance bodies have already initiated a series of proceedings in the first 24 months after the AI Act entered into force. Six formative cases from 2024–2026 illustrate where the sharpest conflicts arise — and how the interpretation of Art. 5, Art. 6, Art. 27 and Art. 50 is taking shape in regulatory practice.

10f. Statistical market data EU AI Act 2026

The EU AI Act creates a measurable compliance market with clear growth signals. Current data from industry-association studies and supervisory authority reports paint a picture of an industry in transition:

• €500M annual FRIA and compliance market volume in DACH by end of 2026 (Bitkom forecast May 2026) — law firms, NCG consultancies, AI auditors, technical documentation providers and specialised SaaS tools.
• 73% of all German SMBs with AI use have started or completed an AI inventory by early 2026 (Bitkom: AI in the German Economy 2026, n=1,054). Two years earlier the figure was 12%.
• 38% of high-risk AI deployers have not yet provided a documented risk assessment under Art. 9 or Art. 27 — the largest compliance gap three months before the 02.08.2026 deadline.
• Only 12% of GPAI providers in the EU have established a complete Art. 53 compliance plan (Annex XI technical documentation, Annex XII downstream information, training data summary, copyright compliance). Main gap: publicly accessible training data summary ("sufficiently detailed summary") in line with the EU AI Office template.
• Average 8 weeks for internal CE conformity assessment under Art. 43 — for external assessment by notified bodies 14–22 weeks. Bottleneck: currently only 7 EU-accredited notified bodies for AI conformity assessment (as of May 2026; 2027 target: 25).
• 62% of companies with more than 250 employees have appointed one or more AI Compliance Officers / AI Officers — among SMBs under 50 employees only 18%.
• Average first-measure costs for a high-risk AI system: €35,000–85,000 (internal conformity assessment), €80,000–180,000 (external assessment by notified body), plus ongoing post-market monitoring costs of approximately €15,000–40,000 per year (Bitkom + ZEW survey 2026).
• Fine statistics: by May 2026, 7 EU-wide proceedings with fine-relevance had been initiated under the AI Act, 3 of them under Art. 5 (prohibited practices), 4 under Art. 99(4) (high-risk violations). Total volume of fines imposed to date: €38M (predominantly GDPR share under double sanctions).

10g. 5 EU AI Act myths

The debate around the AI Act is characterised by half-truths and false simplifications. Five persistent myths deserve a factual clarification based on the regulation text:

10h. EU AI Act vs. national AI strategies — where does friction arise?

The AI Act is a fully harmonising regulation (Art. 1(1)) but explicitly leaves national implementation room in several areas — choice of supervisory authorities (Art. 70), accreditation of notified bodies (Art. 31), sectoral concretisations and the interface with criminal law. Five national initiatives illustrate where gold-plating, sectoral deviations and double regulation are emerging:

• Italy — Regolamento Mappatura (Disegno di Legge AI, 2025): Italy was the first member state to table a comprehensive AI accompanying bill that goes beyond the AI Act minimum — mandatory AI registration for all public applications regardless of risk class, sectoral tightening for healthcare AI and prohibition of foreign GPAI providers in critical infrastructures without local establishment. Friction: potential gold-plating; the European Commission is examining the notification procedure.
• Spain — Real Decreto + Agencia Española de Supervisión de IA (AESIA): Spain was the first country to establish a dedicated AI supervisor (AESIA in A Coruña), with its own competence for high-risk conformity assessment and sandboxing programmes. Real Decreto 817/2023 specifies bias test requirements for HR AI more strictly than the AI Act — for example, mandatory gender impact analysis every 6 months. Friction with Art. 1(1) is possible.
• Netherlands — Toetsingskader Algoritmes (CBS/Autoriteit Persoonsgegevens): The Dutch algorithm assessment framework has been mandatory for all public bodies since 2024 and goes considerably deeper than the FRIA — requiring inter alia public disclosure of all high-risk algorithms in the Algorithm Register, code audit by external auditors and automatic explainability per individual decision. Friction: the AI Act allows FRIA confidentiality; Dutch law mandates transparency.
• Germany — KI-Verordnung Begleitgesetz draft (KIGV, June 2025): The German accompanying bill draft consolidates supervision at the Federal Network Agency (§ 23 KIGV-E), regulates the relationship to GDPR and sectoral supervision (BaFin, BSI, BfDI) and introduces additional criminal provisions under Art. 99(7). Friction: the federal-state competence for educational AI is contested; Bavaria and Baden-Württemberg insist on their own state competence for edutech.
• Austria — AI Strategy 2030 + AI service centre at RTR: Austria has bundled AI supervision at the Broadcasting and Telecom Regulator (RTR) — pragmatic, but with interface friction to the Data Protection Authority (DSB) and FMA. The AI Strategy 2030 promotes sandboxes for SMBs with reduced compliance requirements for 24 months. Friction with Art. 57 AI Act (regulatory sandbox specifications).

The European Commission has announced a first consolidation report on national implementations for Q4 2026, identifying possible infringement proceedings in cases of gold-plating. For SMBs with cross-border business, the most important consequence remains: examine the respective national concretisation in the market country, not only the AI Act regulation text.