What Is the EU AI Act?

The European Commission proposed the AI Act in April 2021, the European Parliament and the Council agreed on the text in December 2023, and the regulation entered into force on August 1, 2024. Its provisions are carried out in stages from 2025 to 2028. Bans on prohibited practices came first, and obligations for high-risk systems follow later.

According to the EU’s summary of the legislation, the EU AI Act “aims to encourage the development and uptake of safe and trustworthy artificial intelligence systems,” supporting innovation across the EU single market in both private and public sectors. The regulation defines several risk-based rules ranging from banning specific AI practices to transparency and obligations for high-risk AI systems.

The scope of the Act follows the market, not the company’s location or presence in the EU. Under Article 2 of the Act, the rules cover providers that place AI systems on the EU market and importers and distributors that bring them in. They also cover providers and deployers located in a third country when the system’s output is used in the Union.

This reach is often called the Brussels Effect, which has major implications beyond the EU’s borders. An analysis by Brookings described it as the EU setting rules that become global standards through the pull of its consumer market of 450 million people. The same analysis expects the impact to vary by sector and application.

It’s a best practice for international software developers to design for EU compliance from the start. Retrofitting data access governance and human oversight into a live system costs significantly more than integrating them in the initial build. Penalties reach up to €35 million or 7% of worldwide annual turnover, whichever is higher, for the most serious violations. A single architecture that meets EU requirements also simplifies compliance elsewhere.

The EU AI Act applies to providers that develop AI systems, deployers that use them, and importers and distributors that bring them to market. It also covers non-EU companies, including US firms, that sell systems in the EU or whose system output is used there. Coverage follows the EU market regardless of where a company is located.

Provider vs. Deployer Roles and Compliance Workload

A provider develops an AI system or GPAI model and places it on the market under its own name. A deployer uses a system under its own authority in a professional setting. Providers of high-risk systems carry the heavier workload, including conformity assessment, technical documentation, and post-market monitoring.

Deployers follow the instructions for use, assign trained human overseers, and retain logs. A deployer becomes a provider by placing its own name on a high-risk system, substantially modifying it, or changing its intended purpose. Clear contracts between the two parties should assign each duty.

US and Non-EU Companies and When They Fall in Scope

Article 2 covers providers that place systems on the EU market from anywhere in the world. It also covers providers and deployers in third countries when the system’s output is used in the Union.

A US recruiting platform whose scores inform hiring decisions at a European employer falls in scope. The output trigger is broad, so a company without an EU office may still qualify if its results reach people in the EU. The Act exempts military, defense, and purely personal, non-professional uses.

Authorized Representatives and Their Role

Providers of high-risk systems established outside the EU must appoint an authorized representative inside the Union by written mandate before market entry. The representative verifies the conformity declaration and technical documentation, keeps records available for 10 years, and cooperates with authorities on request. GPAI model providers face a similar duty under Article 54.

The EU AI Act categorizes AI systems into four risk tiers. Obligations escalate in parallel with the potential for harm. A system’s tier decides whether it is banned, tightly regulated, subject to disclosure rules, or left alone.

1. Unacceptable Risk

Article 5 bans AI practices that threaten safety and fundamental rights. Banned practices include harmful cognitive manipulation, social scoring, and untargeted scraping of facial images from the internet or CCTV footage.

The Digital Omnibus on AI, a 2026 amendment to the Act, adds a ban on systems that generate non-consensual sexually explicit content, effective December 2, 2026. Providers cannot place these systems on the EU market, and no compliance route exists for them.

2. High-Risk

AI used in biometrics, critical infrastructure, employment, migration, and healthcare faces the strictest rules, but can still be sold in the EU. Providers must complete a conformity assessment before launch and maintain detailed technical documentation.

They must also log system activity and design for effective AI governance and human oversight. These duties continue across the system’s full life cycle, so compliance requires ongoing monitoring after deployment.

3. Limited Risk

Chatbots and content generators carry transparency duties under Article 50. Users must be told when they are interacting with a machine, unless the context makes this obvious.

Synthetic audio, image, video, and text outputs must carry machine-readable marking, such as a watermark. This lets people and software detect AI-generated content, including deepfakes.

4. Minimal or No Risk

Most AI applications fall into this tier, including video games and spam filters. The Act adds no new obligations for them because the risk to people is low. Developers can still follow voluntary codes of conduct. Doing so signals responsible AI practice to customers and regulators.

The Four Tiers of AI Risk Under the EU AI Act

The EU AI Act applies in stages between 2024 and 2028. Each milestone adds a new group of obligations, so security and compliance teams can plan their work by date. The Commission’s official timeline shows a full rollout of the main milestones by August 2, 2028.

• August 2024: The regulation entered into force on August 1, 2024. This date started the clock for every later deadline.
• February 2025: Prohibitions on unacceptable-risk systems took effect. Definitions and AI literacy duties began on the same date.
• August 2025: Obligations for providers of GPAI models began to apply. They cover technical documentation, copyright compliance, and summaries of training content. Member States also had to name national authorities, and EU governance bodies had to be set up.
• August 2026: Transparency requirements under Article 50 began to apply. Governance rules are active, and enforcement starts at the national and EU levels, including Commission oversight of GPAI models.
• December 2026: Generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) marking requirement.
• December 2027: Rules for high-risk use cases in sensitive areas under Annex III apply. These areas include employment, biometrics, and critical infrastructure.
• August 2028: Rules for high-risk systems embedded in regulated products under Annex I apply. Medical devices and machinery are typical examples.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the two high-risk dates. The original dates were August 2026 for Annex III and August 2027 for Annex I. The Official Journal of the European Union confirms the new dates.

High-risk systems face the Act’s most detailed engineering requirements. Articles 8 to 15, which make up Chapter III, Section 2, define the controls for high-risk systems. They cover risk management, data governance, logging, human oversight, and cybersecurity.

Providers must build these controls into the system and prove that they work. AI security and data teams therefore share responsibility for compliance.

Article 9: Continuous Risk Management

Article 9 requires a documented risk management system that runs across the full lifecycle. Providers identify foreseeable risks, test mitigations, and update their analysis with post-market data. A new model version or deployment context should trigger a fresh review. The framework stays active instead of ending at launch.

Article 10: Data Governance

Article 10 requires training, validation, and testing datasets to be relevant and sufficiently representative. Datasets must also be as free of errors and as complete as possible for the intended purpose. Providers examine datasets for possible bias and keep records of data origin and preparation. These records link each dataset to the model version it trained.

Article 12: Automatic Logging

High-risk systems must record events automatically under Article 12. Providers keep these logs for at least six months under Article 19, and deployers have a matching duty under Article 26(6). Good logs show which inputs led to an output and whether human oversight took place. Tamper-resistant storage protects their value as evidence in post-market surveillance.

Article 14: Human Oversight

Article 14 requires systems that people can supervise in practice. Overseers must be able to interpret outputs and spot anomalies. They must also be able to intervene or stop the system. Organizations assign these roles to trained staff with real authority.

Article 15: Accuracy, Robustness, and Cybersecurity

Article 15 requires an appropriate level of accuracy, robustness, and cybersecurity throughout the system’s life cycle. Systems that keep learning after launch must address feedback loops, where biased outputs flow back into future training. Technical measures must also prevent, detect, and respond to data poisoning, model poisoning, adversarial examples, and confidentiality attacks.

Article 4 requires providers and deployers of AI systems to take measures that support AI literacy among their staff and others who operate AI on their behalf. The obligation has applied since February 2, 2025. The Digital Omnibus softened the wording, and the European Commission now states that no specific level of literacy is mandated.

No fixed curriculum exists. Measures should reflect each role’s technical knowledge, the context of use, and the people the system affects. Deployers of high-risk systems must still train staff for human oversight.

A practical starting point is to map who uses which AI tools and assign role-based training. Records of each session show regulators that the organization acted.

A staged plan keeps the workload manageable. The steps below follow the order in which obligations apply, from items already in force to the high-risk deadlines in 2027 and 2028.

1. Build an AI inventory (now). List every AI system built, bought, or embedded in SaaS tools. Capture the owner, purpose, data inputs, affected population, and supplier.
2. Assign roles (now). Mark each system as provider, deployer, importer, or distributor, since duties differ for each role.
3. Screen for prohibited practices (in force since February 2025). Check every use case against Article 5, including the new bans that apply from December 2, 2026, and retire any that match.
4. Document AI literacy measures (now). Record the training delivered by role, as described in the previous section.
5. Meet GPAI duties (in force since August 2025). Providers need technical documentation, a copyright policy, and a training content summary. Models placed on the market before August 2, 2025, have until August 2, 2027.
6. Meet transparency duties (in force since August 2026). Add chatbot disclosures and deepfake labels. Generative systems on the market before August 2, 2026 have until December 2, 2026 for machine-readable marking.
7. Classify against Annex I and Annex III (by early 2027). Early classification sets the scope of the high-risk program.
8. Build high-risk controls (by December 2, 2027 for Annex III and August 2, 2028 for Annex I). Put risk management, data governance, logging, human oversight, and Article 15 testing in place.
9. Update contracts and appoint representatives (before EU launch). Revise vendor agreements to assign provider and deployer duties. Non-EU high-risk providers must name an authorized representative.
10. Monitor changes (ongoing). Track Commission guidance and amendments, since the Digital Omnibus already moved key dates.

A general-purpose AI (GPAI) model is a large foundation model that can competently perform a wide range of distinct tasks. Developers can also integrate it into many downstream systems. Article 3(63) sets this definition, and large generative models are the typical example.

The Commission treats training compute above 10²³ FLOP plus language, image, or video generation as an indicative test. “FLOP” stands for floating-point operations, which are simple math steps a computer performs. The figure counts every step used during training. “10²³” means 1 followed by 23 zeros, which is a very large number of calculations.

Baseline Obligations for GPAI Providers

Every GPAI provider must maintain technical documentation and share key information with downstream developers. Providers must also publish a sufficiently detailed summary of training content and adopt a policy to respect EU copyright law. Generative systems built on these models face separate Article 50 duties to disclose AI-generated content.

The Systemic Risk Threshold

The Act presumes systemic risk when cumulative training compute exceeds 10²⁵ FLOP. The Commission can also designate a model with equivalent impact. These providers must run model evaluations that include documented adversarial red teaming. They must also report serious incidents and ensure adequate cybersecurity protection.

General-Purpose AI (GPAI) Model Obligations

Why Securing Data Flows to GPAI Models Matters

Each connection between corporate systems and a GPAI model creates a new path for data to leave the network. The Zscaler ThreatLabz 2026 AI Security Report found that data transfers to AI/ML applications rose 93% in 2025, totaling 18,033 terabytes. Total enterprise AI transaction volume rose 83% year over year. Securing these connections therefore protects the data that regulators expect organizations to govern.

The EU AI Act sets penalties in three tiers. Each fine is the higher of a fixed amount or a share of total worldwide annual turnover. Article 99 determines the ceilings.

• Penalty tiers: Prohibited practices. Fines of up to €35 million or 7% of global turnover apply to using banned, unacceptable-risk AI.
• Other operator obligations: Fines of up to €15 million or 3% apply to breaches of high-risk system rules and most other duties, including transparency. The Commission can also fine GPAI model providers up to the same ceiling under Article 101.
• Misleading information: Fines of up to €7.5 million or 1% apply to supplying incorrect, incomplete, or misleading information to regulators.

Who Enforces the EU AI Act?

National market surveillance authorities handle most enforcement within their Member States. They investigate non-compliance, request documents, and impose fines under national rules that follow Article 99. The EU AI Office, which sits within the European Commission, directly oversees GPAI model providers. This power to fine GPAI providers has applied since August 2, 2026.

Fines scale with company size, so large global providers face the largest exposure. Strong documentation and accurate regulator communication reduce the risk at every tier.

The EU AI Act requires control over where AI runs, what data it touches, and how teams govern it. The Zscaler Zero Trust Exchange™ platform sits inline between corporate networks and AI systems. Every request to an AI service passes through a single policy enforcement point, which supports the Act’s security, visibility, and data governance requirements.

AI visibility is the top priority. The Zero Trust Exchange provides inline visibility into AI application use across all users and locations. It separates sanctioned tools from unsanctioned ones, so teams can catalog shadow AI risk and block unauthorized use. Then, Zscaler Inline DLP (data loss prevention) inspects outbound prompts and file uploads. It detects and blocks sensitive data, such as credentials, source code, and personal data, before it reaches an unauthorized external model.

Data governance brings everything together. Zscaler Data Security Posture Management (DSPM) discovers and classifies data across cloud, SaaS, and AI environments. It also traces which sensitive data connects to which AI service. This lineage evidence supports the data governance mandates of Article 10.

These controls turn written requirements into policies that run continuously. Legal teams still decide which obligations apply to each system. Security teams gain the visibility and enforcement needed to act on those decisions.

Interested in learning more? Request a custom product demo.