Does the EU AI Act apply to us?
The Act applies to providers that place AI systems or general-purpose AI models on the EU market, to deployers that use AI systems in the EU, and to providers and deployers outside the EU when their AI system's output is used in the EU. A US company with EU customers or users can be in scope.
Your role matters. Providers, who develop an AI system or have one developed and market it under their own name, carry most of the obligations. Deployers, who use an AI system in their own operations, have a shorter but real list. One company can be both.
How are AI systems classified by risk?
The Act sorts AI systems by the risk they pose, and your obligations follow from the tier. Getting classification right is the most important early step, because it determines everything that comes after.
- Prohibited practices, such as certain manipulative techniques and social scoring, are banned
- High-risk systems, such as AI used in hiring, credit decisions or as safety components of regulated products, face requirements for risk management, data governance, documentation, human oversight and conformity assessment
- Limited-risk systems, such as chatbots and generated content, carry transparency duties
- Minimal-risk systems carry no specific new obligations beyond general duties such as AI literacy
What is the timeline as of October 2026?
The Act entered into force on August 1, 2024 and applies in phases. Prohibited practices and AI literacy obligations have applied since February 2, 2025. Obligations for general-purpose AI models have applied since August 2, 2025. Most remaining provisions, including the main transparency duties, have applied since August 2, 2026.
High-risk obligations moved. Amendments adopted in 2026 as part of the EU's digital omnibus package, in force since July 2026, set December 2, 2027 for stand-alone high-risk systems listed in Annex III and August 2, 2028 for high-risk AI embedded in products covered by Annex I. The delay gives you more time to prepare, not a reason to wait, since documentation and risk management take time to build.
What we do
We inventory your AI systems, determine whether you act as provider, deployer or both, and map each system to its risk tier with reasoning you can defend. We then analyze gaps against your obligations and deliver a prioritized roadmap.
Our work draws on established AI governance frameworks, including the NIST AI Risk Management Framework and ISO/IEC 42001. Classification under the Act can involve legal interpretation, so we coordinate with your counsel throughout.
