EU AI Act

Updated 4 August 2026: The Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026, deferring high-risk obligations to 2 December 2027 for standalone Annex III systems and 2 August 2028 for product-embedded Annex I systems. See our EU AI Act preparedness guide for the full timeline.

Term: EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive AI regulation, in force since 1 August 2024 and applying in phases. It classifies AI systems into four risk tiers and imposes binding obligations on the organisations that build and deploy them.

Why it matters

The Act applies extraterritorially. UK organisations placing AI on the EU market or affecting EU citizens fall in scope regardless of Brexit. For NHS trusts, local authorities and professional services firms with European reach, the December 2027 deadline for high-risk obligations sets a fixed horizon for compliance work.

The four tiers run from unacceptable through high, limited and minimal risk. Each tier carries its own treatment, from outright prohibition to light transparency duties. Knowing which tier each system occupies is the first step in scoping the work ahead.

How it works in practice

High-risk systems cover biometric identification, critical infrastructure, employment, essential services, law enforcement, migration, justice and product safety components. These must meet conformity assessment, documentation, transparency and human oversight requirements, with most standalone obligations applying from 2 December 2027 and product-embedded obligations from 2 August 2028.

Our AI Act Preparedness service scopes your systems against this deadline. The EU AI Act Scope Checker shows in about two minutes whether the Act reaches your organisation at all.

Related terms: AI Governance and AI risk assessment.