2021.AI
GRACE AI platform whose governance module registers AI systems, runs risk assessments, maps controls to the EU AI Act and ISO 42001, and monitors compliance.
EU AI ActISO/IEC 42001GDPR
Jurisdictions · European Union · reviewed 2026-09-21
🇪🇺 AI regulation in European Union
The EU AI Act (Regulation (EU) 2024/1689) applies to providers and deployers of AI systems in the EU, and to providers and deployers elsewhere when their systems or outputs are used in the EU. It works by risk: a short list of prohibited practices, heavy duties for high-risk systems, transparency duties for AI that talks to people or generates content, and an AI-literacy duty for everyone who provides or deploys AI.
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) deferred the high-risk obligations to 2 December 2027 and 2 August 2028 and softened the literacy duty. It did not defer Article 50, which has applied since 2 August 2026.
Next date: Machine-readable marking of generative AI output, 2 Dec 2026 (in 58 days, upcoming).
European Union: obligations
| Date | Obligation | Status | Who | What and evidence |
|---|---|---|---|---|
| 2 February 2025 610 days ago | AI literacy duty, Article 4 EU · EU AI Act (Reg. 2024/1689) | In force | Providers and deployers of AI systems | Take measures to support the development of AI literacy of staff and others who operate or use AI on your behalf. The Digital Omnibus (July 2026) replaced the earlier duty to ensure, to your best extent, a sufficient level: no specific level has to be guaranteed and no certificate is required. The duty itself was kept, and national authorities supervise it. Evidence: An internal record of trainings and other measures (training register), the training programme and written AI usage rules; a short check of learning is good practice. |
| 2 February 2025 610 days ago | Prohibited AI practices, Article 5 EU · EU AI Act (Reg. 2024/1689) | In force | Providers and deployers of AI systems | Eight practices are banned: harmful manipulation and deception, exploiting vulnerabilities, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work and in education (except for medical or safety reasons), biometric categorisation that infers sensitive characteristics, and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions. Fines up to 35 million euro or 7% of worldwide annual turnover. The Commission's guidelines include recruitment in the workplace emotion ban. Evidence: Classification record showing that no system falls under Article 5; acceptable use policy that forbids the banned uses; vendors' written confirmation for tools with emotion or biometric features. Source: EU AI Act explorer, Article 5 |
| 2 August 2025 429 days ago | General-purpose AI model obligations EU · EU AI Act (Reg. 2024/1689) | In force | Providers of general-purpose AI models only | Technical documentation, copyright policy and a training-data summary for model providers, with extra duties for models with systemic risk. Companies that only use AI tools are not in scope. Evidence: Not applicable to deployers. |
| 2 August 2026 64 days ago | Transparency obligations, Article 50 EU · EU AI Act (Reg. 2024/1689) | In force | Providers of AI that talks to people or generates content; deployers of emotion recognition, biometric categorisation, deepfakes and AI-written public-interest text | Chatbots must disclose they are AI unless obvious. Generated audio, image, video and text must be marked as artificial in a machine-readable way. Deepfakes and AI-generated public-interest text must be disclosed. Disclosure must be clear and given at the latest at first interaction. Not deferred by the Omnibus. Evidence: Disclosure texts in place, marking mechanism documented, transparency checklist completed per system. Source: EU AI Act explorer, Article 50 |
| 2 December 2026 in 58 days | Machine-readable marking of generative AI output EU · EU AI Act as amended by Reg. 2026/1744 | Upcoming | Providers of generative AI systems and, in practice, companies publishing generated content | New obligation introduced by the Digital Omnibus: generated output must carry machine-readable marking. The same package bans generating non-consensual intimate imagery and child sexual abuse material, with penalties up to €35M or 7% of global turnover. Evidence: Marking mechanism in place for every generative system in the inventory. |
| 2 December 2027 in 423 days | High-risk obligations for stand-alone systems (Annex III) EU · EU AI Act as amended by Reg. 2026/1744 | Deferred | Providers and deployers of high-risk AI in employment, education, credit, essential services, law enforcement, migration and justice | Risk management, data governance, technical documentation, logging, human oversight, conformity assessment and registration. Deferred from 2 August 2026 by the Digital Omnibus. Evidence: Risk classification record, impact assessment, vendor documentation, oversight design. Source: Gibson Dunn, Omnibus agreement |
| 2 August 2028 in 667 days | High-risk obligations for AI in regulated products (Annex I) EU · EU AI Act as amended by Reg. 2026/1744 | Deferred | AI embedded in products under EU product law (machinery, medical devices, vehicles and similar) | Deferred from 2 August 2027 by the Digital Omnibus. Evidence: Product conformity files updated for AI components. Source: Gibson Dunn, Omnibus agreement |
What to do first
- List every AI system you use with the free inventory template.
- Check which rows above apply with the readiness scan.
- Put the disclosures in place with the disclosure generator.
- Hold the evidence. In the Compliance Kit the documents that matter most here are:
- 02 Acceptable use policy: Article 4 written rules
- 03 AI inventory: the starting point for every duty
- 04 Risk classification: prohibited, high-risk, Article 50 or minimal
- 05 Transparency checklist: Article 50 texts and checks
- 06 AI literacy programme: Article 4 evidence
Terms you will meet
AI inventory (AI register) · AI literacy · AI system · Annex I (AI in regulated products) · Article 50 (transparency obligations) · Biometric categorisation system · Deep fake · Deployer · Digital Omnibus on AI · Distributor · Emotion recognition system · Fine tiers and the SME rule · General-purpose AI model · High-risk AI system (Annex III) · Impact assessment · Importer · ISO/IEC 42001 · Machine-readable marking · NIS2 · Prohibited practices · Provider · Serious incident · Statement of Applicability · Substantial modification
Get an email before each date
One email 30 days and one 7 days before each date in the markets you tick, with who it applies to and what to have ready. Next: Machine-readable marking of generative AI output, 2 Dec 2026.
Vendors based in the EU
42 verified listings from the directory, each checked against the company's own website. Listing is free; paid placements are labelled.
Acuity AI Advisory
Irish AI consultancy offering EU AI Act readiness reviews, governance and risk frameworks, board advisory, AI strategy and training as fixed-fee engagements.
EU AI ActISO/IEC 42001
Advisera
Zagreb provider of ISO documentation toolkits, online courses and compliance software, including ISO 42001 toolkits, courses and employee training academies.
ISO/IEC 42001GDPR
aiacto
EU AI Act compliance software that classifies AI system risk and generates Annex IV technical documentation and Article 26 deployer registers.
EU AI Act
Algorithm Audit
Dutch nonprofit conducting algorithm audits and bias analyses, supporting AI Act and GDPR implementation, and publishing open-source bias detection tools.
EU AI ActGDPR
AnnexOps
Platform for AI system discovery, EU AI Act risk classification, obligation timelines, Annex IV documentation, evidence storage and monitoring, with SDK and API.
EU AI ActGDPR
appliedAI Initiative
Munich AI initiative offering AI strategy consulting, implementation, enablement programs and EU AI Act compliance support, including an accelerator for SMEs.
EU AI Act
ARROWS law firm
Czech law firm advising on AI Act compliance, process analysis, data protection and contract documentation of AI projects, with AI training.
EU AI ActGDPR
AY Prime
Polish training and HR company delivering KFS-subsidised courses in AI and automation, digital skills and management for companies with 10 to 5,000+ employees.
CNFCE (Centre National de Formation Continue aux Entreprises)
Two-day AI Act training covering risk categories, stakeholder obligations, compliance strategy and audit basics, in person, on-site or virtual.
EU AI Act
ComplianceHive
SMB compliance tool for GDPR and NIS2 with an AI system register for documenting AI tools, risk classification and measures under the EU AI Act.
EU AI ActGDPR
Considerati
Amsterdam legal and compliance consultancy providing AI compliance and governance, privacy, DPO-as-a-service, risk assessments and training.
EU AI ActGDPR