Artificial intelligence
AI Act — Regulation (EU) 2024/1689 on artificial intelligence
The EU regulation governing AI by risk level: prohibited practices, high-risk systems, transparency and AI literacy.
At a glance
- Type
- EU regulation, directly applicable
- In force
- 1 August 2024, gradual application
- Amended by
- Regulation (EU) 2026/1744 (digital omnibus)
- Fines
- Up to €35M or 7% of worldwide turnover for prohibited practices
114 requirements tracked · 76 shared controls
What is AI Act?
Regulation (EU) 2024/1689, in force since 1 August 2024, follows a risk-based approach: some practices are prohibited, high-risk systems are subject to requirements and conformity assessment, some systems carry transparency obligations, and specific rules target general-purpose AI models.
It concerns providers, but also deployers, that is companies using an AI system in a professional context. The timeline is gradual: prohibitions and AI literacy since 2 February 2025, general-purpose models since 2 August 2025, transparency since 2 August 2026. Regulation (EU) 2026/1744 (digital omnibus) postponed the high-risk rules to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Key requirements
- 1
Inventory and qualification
List the AI systems you use or provide, qualify your role and the risk level of each system.
- 2
Prohibited practices (Art. 5)
Check that no system falls under a prohibited practice; the 2026 omnibus adds the generation of non-consensual intimate content or child sexual abuse material.
- 3
AI literacy (Art. 4)
Make sure the people operating or using the systems have a sufficient level of competence.
- 4
Transparency (Art. 50)
Tell people they are interacting with an AI and disclose generated or manipulated content (deepfakes).
- 5
Obligations of deployers of high-risk systems (Art. 26)
Use according to the instructions, competent human oversight, monitoring, log retention, informing workers and affected persons.
- 6
Obligations of providers of high-risk systems
Risk management, data governance, technical documentation, quality management system, conformity assessment and post-market monitoring.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- AI Act requirements, 2026 timeline included, linked to 76 common controls
- List your AI systems in the asset register and track their risks in the shared risk register
- AI usage policy and an AI usage training module with a quiz, for AI literacy (Art. 4)
- AI vendor assessment by questionnaire
- A bridge with ISO 42001 and the GDPR so you never do the same work twice
Related frameworks
With ISO 27001 controls in place, your AI Act starting score is about 14 to 17%.
The controls you put in place for AI Act also count for:
Frequently asked questions about AI Act
My company uses ChatGPT or Copilot: are we concerned?
Yes, as a deployer, at least for the AI literacy obligation and, depending on the use, for transparency. The heavy obligations mainly target high-risk systems; a general assistant used for drafting usually does not qualify, but the use case matters.
When do the high-risk rules apply?
Since the 2026 digital omnibus, on 2 December 2027 for Annex III systems (recruitment, credit, education…) and on 2 August 2028 for systems embedded in regulated products (Annex I). Always check the consolidated version of the text.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment