The EU AI Act is the first comprehensive law regulating artificial intelligence, adopted in 2024 after three years of negotiation, and the one most likely to decide what a product team may ship. It follows the pattern of the Union's data protection law, applying to anyone whose system is used in the Union and setting penalties large enough to reach a global company's attention, which is why its categories have travelled well beyond Europe. Its structure is worth knowing even where a lawyer will make the call, because the tier decides the cost of the feature.
The sections below take the four tiers, the duties on general purpose models, the difference between a provider and a deployer, how a feature is placed, where the timeline stands after the 2026 amendments, what the penalties are, and end with a fifteen minute placement exercise.
The four tiers
Unacceptable risk, prohibited. Social scoring by public authorities, manipulative techniques that cause harm, exploiting vulnerability, untargeted scraping of facial images, and emotion recognition in workplaces and schools, with narrow exceptions. These cannot be done at any level of accuracy or consent.
High risk, permitted with obligations. A defined list, with no judgement call involved, covering AI in employment and worker management, education and exam scoring, credit and essential services, biometrics, critical infrastructure, law enforcement, migration, justice and safety components of regulated products.
The obligations are substantial. A risk management system across the lifecycle, data governance covering quality and bias, technical documentation, logging, transparency to deployers, human oversight designed in, and appropriate accuracy, robustness and cybersecurity. Plus conformity assessment before it goes to market, and for deployers in public bodies and some private sectors an assessment of the impact on fundamental rights before use.
Limited risk, transparency duties. Systems interacting with people, generating synthetic content, or recognising emotion. The core duty is disclosure. People must be told they are dealing with a machine, and generated content must be marked as such in machine readable form.
Minimal risk. Everything else, which is most software. No specific obligations, and the Act encourages voluntary codes.
Duties on general purpose models
Above the tiers, foundation model providers carry their own duties, covering technical documentation, information for downstream developers, a copyright policy and a summary of training data. Models presenting systemic risk carry more, including evaluation, adversarial testing and incident reporting, and a code of practice published in 2025 sets out how providers are expected to meet them.
For most product teams this matters as something to ask a vendor for, and nothing the team produces itself.
Provider or deployer
The distinction that decides which duties are the team's is between two roles. A provider develops a system or has it developed and puts it on the market under their own name. A deployer uses one under their own authority.
The trap is assuming that building on somebody else's model makes a team a deployer. A team that assembles a high risk feature and offers it under its own name is its provider, whoever trained the underlying model.
Working out where a feature sits
Three questions are asked in order. Whether the feature does anything on the prohibited list. Whether it falls in a listed high risk area, which is largely a question about the decision it affects, with the technology secondary. And whether it interacts with people or generates content, which brings the transparency duty whatever else applies.
Most features land in minimal risk with a disclosure obligation. The ones that do not are usually obvious once the list is read, and the answer is worth writing down with the reasoning, because that document is the beginning of the technical documentation the Act would want anyway.
Where the timeline stands
The Act entered into force on 1 August 2024 and applies in stages, and the stages moved in 2026. Prohibited practices have applied since 2 February 2025, and the duties on providers of general purpose models since 2 August 2025.
On 2 August 2026 the Article 50 transparency duties took effect as originally scheduled. They cover telling a person they are dealing with an AI system, marking AI generated output in a machine readable way, and labelling deepfakes. The AI Office's enforcement powers over general purpose model providers became active on the same date.
The high risk regime moved. An amending regulation known as the digital omnibus on AI, Regulation 2026/1744, was published on 24 July 2026 and entered into force three days later, and it deferred most of the high risk obligations. Standalone high risk systems in the Annex III list went from 2 August 2026 to 2 December 2027, and high risk AI embedded in products already covered by EU product safety law, the Annex I route, went to 2 August 2028.
For a product team that reverses the usual assumption about which part arrives first. The transparency duties are live now and are the ones most teams will meet before any other, because a chat interface, a generated image or a synthetic voice attracts them whatever else the product does. The high risk obligations that everybody treated as imminent have moved out by more than a year.
A deferral is no repeal. The risk based structure, the governance bodies and the substantive obligations are all intact, and what changed is when they bite. Anything sitting in a listed high risk area should still be built to those requirements, both because the date arrives anyway and because the work takes longer than the extension gives.
What the penalties are
The ceilings are set as the higher of a fixed sum and a share of worldwide turnover. A prohibited practice carries up to thirty five million euros or seven per cent. Breaching the high risk or transparency obligations carries up to fifteen million or three per cent. Supplying incorrect information to an authority carries up to seven and a half million or one per cent, with lower ceilings for smaller companies. The numbers are set at the scale of the data protection law's, which is the scale at which a board pays attention.
Practise this
The exercise needs one of the team's own features, fifteen minutes, and no lawyer, since the point is to find how far the team gets without one.
Work the three questions in order for a single named feature, answering the second about the decision it affects, because the listed areas describe decisions and say nothing about the technology inside them. Then add the column most teams leave off, which is when each duty the feature lands on actually bites.
Feature ..........................................
Do we put it on the market under our own name, or use
somebody else's under our own authority? provider / deployer
1. Does it do anything on the prohibited list? Y / N
2. Does it fall in a listed high risk area? Y / N which
employment and worker management, education and exam
scoring, credit and essential services, biometrics,
critical infrastructure, law enforcement, migration,
justice, safety components of regulated products
3. Does it interact with a person, generate content
or recognise emotion? Y / N which
Duty this produces Live now / deferred to
............................... ......................
............................... ......................
Most features come out of this carrying a transparency duty and nothing else, which is the reverse of what teams assume on the way in. Write the dates in anyway, because the Article 50 disclosure duties apply now while the standalone high risk regime has moved to December 2027 and the embedded route to August 2028. Look hardest at the provider and deployer line, since a team that assembles a feature on somebody else's model and offers it under its own name is that feature's provider, and those duties are the ones people assume belong to the model vendor.
Working one real feature through the ordering says which duties are live this year, a different question from which tier sounds most serious.