EU AI Act

EU AI Act

• Record: data-ai-ml-reg-001 — EU AI Act (Regulation (EU) 2024/1689)
• Issuing body / enforcer: EU legislature; enforcement by national competent authorities and market-surveillance authorities, coordinated with the EU AI Office (Commission)
• Jurisdiction: EU/EEA, with extraterritorial reach — applies where an AI system is placed on the EU market or its output is used in the EU, regardless of provider location
• Record type / importance: regulation / flagship
• Last verified: 2026-09-30

What it is

The world's first comprehensive horizontal AI law: a risk-tiered framework (unacceptable risk = banned; high risk = regulated; limited risk = transparency duties; minimal risk = largely unregulated). For ML/AI engineers it is the compliance backbone for any AI system touching the EU — classification of the system determines almost everything downstream.

Scope: who it applies to, triggers, thresholds

• Roles: providers (develop and place on market), deployers (use professionally), importers, distributors.
• Prohibited practices (Art. 5): social scoring, manipulative AI, real-time remote biometric identification in public spaces by law enforcement (narrow exceptions), emotion inference at work/school — enforceable since February 2, 2025.
• High-risk (Annex III): AI in employment/recruitment, education, access to essential services (credit, benefits), law enforcement, migration, administration of justice, and critical-infrastructure safety components. Annex I: AI as a safety component in products already regulated (medical devices, machinery, lifts, radio equipment).
• General-purpose AI (GPAI): obligations on providers of GPAI models since August 2, 2025 (transparency, copyright policy, systemic-risk evaluation for high-impact models); GPAI with systemic risk carries extra duties (adversarial testing, incident reporting, cybersecurity).
• Transparency (Art. 50): anyone deploying AI that interacts with people or generates synthetic content must disclose AI involvement — in force since August 2, 2026 (see timeline below).

Key requirements and compliance obligations

• High-risk providers: risk-management system (Art. 9), data governance for training/validation/test sets (Art. 10 — representative, relevant, error-free to the extent possible), technical documentation (Art. 11), record-keeping/logging (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15), QMS (Art. 17), conformity assessment with a notified body for most Annex III cases (Art. 43), EU database registration (Art. 49/71).
• Deployers of high-risk systems: human oversight, monitoring, and — for certain public-sector and Annex III deployers — a Fundamental Rights Impact Assessment (FRIA, Art. 27).
• GPAI providers: technical documentation to downstream providers, training-data summary, copyright-compliance policy; systemic-risk models add evaluation, red-teaming, and serious-incident reporting to the AI Office.
• Art. 50 transparency (live now): chatbots/assistants must disclose AI identity at first interaction; generated/manipulated content (including deepfakes) must carry machine-readable marking. This reaches ordinary chatbots and agents — it is not gated on risk classification.
• Penalties (Arts. 99, 101 — operative since Aug 2, 2026): up to €35M or 7% of worldwide turnover for prohibited practices; up to €15M or 3% for most operator-obligation breaches.

Version/edition status and LIVE changes (verified 2026-09-30)

• The Digital Omnibus on AI deferred the high-risk deadlines. Regulation (EU) 2026/1744 (published July 24, 2026, in force July 27, 2026):
  • Annex III (stand-alone high-risk) obligations: moved from Aug 2, 2026 → December 2, 2027 (16-month deferral).
  • Annex I (embedded high-risk) obligations: moved from Aug 2, 2027 → August 2, 2028.
  • Regulatory-sandbox establishment requirement: moved to August 2, 2027.
  • The final regulation rejected the conditional "standards-readiness" mechanism the Commission originally proposed — Dec 2027 is a fixed date; do not plan on further slippage.
• What did NOT move (live today): Art. 50 transparency duties (from Aug 2, 2026), penalty provisions (Arts. 99/101, from Aug 2, 2026), prohibited practices (Feb 2025), GPAI obligations (Aug 2025). Commission investigations reportedly opened June 2026 into hiring/credit-scoring/student-monitoring AI.
• Standards: harmonised standards are the compliance machinery — CEN-CENELEC published EN 18286:2026 (July 2026), the first harmonised standard, covering the Art. 17 QMS obligation. Risk-management, data-governance, and bias standards are still in progress — the reason for the deferral.
• Practitioner takeaway: the deferral is an enforcement-infrastructure delay, not a softening. Classification work, QMS build-out, and documentation should be underway now, because customers and notified bodies are already asking for the evidence trail.

Related certifications (Data/AI/ML flagship/license)

• AWS Certified Machine Learning Engineer – Associate (data-ai-ml-cert-001), Google Cloud Professional ML Engineer (data-ai-ml-cert-006), Azure AI App and Agent Developer Associate (data-ai-ml-cert-009), Databricks Certified ML Professional (data-ai-ml-cert-012): test responsible-AI, model governance, and deployment-practice content where EU AI Act obligations increasingly appear. The Act itself has no dedicated engineer-level certification in the catalogue.

Honest flags

• The Digital Omnibus timeline is corroborated by multiple 2026 sources (Regulation (EU) 2026/1744, OJ publication July 24, 2026, in force July 27). Treat exact OJ details as well-sourced but confirm on EUR-Lex for contract-grade reliance.
• The "June 2026 Commission investigations" item comes from a law-firm blog — plausible but thinly sourced; flagged as unverified.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.