EU AI Act Compliance: One Law, Risk-Based Obligations
The EU has one binding AI law - Regulation (EU) 2024/1689 - with fines reaching €35 million or 7% of global turnover for the most serious violations. Obligations phase in by risk tier and system type, not all at once. Here's what applies to your business, and when.
9+ Years of Compliance Expertise
End-to-End Execution
The EU AI Act is a single, binding regulation that applies to any organisation whose AI systems touch people in the EU - regardless of where the company is headquartered. It uses a risk-based framework: prohibited practices, high-risk systems, limited-risk systems, and general-purpose AI (GPAI) models each carry different obligations and different compliance dates, which have been revised since the regulation's original publication.
Why This Matters
- Fines under the EU AI Act are tiered by severityUp to €35 million or 7% of global annual turnover for prohibited practices, up to €15 million or 3% for most other breaches (including high-risk system non-compliance), and up to €7.5 million or 1% for supplying incorrect or misleading information to authorities. Whichever figure is higher applies — except for SMEs and startups, where the lower figure applies.
- These fines exceed GDPR's maximum (€20 million or 4% of turnover) - and they're calculated on total worldwide turnover, not just EU revenue.
- The Act applies extraterritoriallyIf your AI system affects people in the EU, your location doesn't exempt you.
- Implementation dates have shifted before and may shift again. Building compliance around the risk framework itself, rather than a single deadline, is the more durable approach.
What's Included
AI system risk classification (prohibited / high-risk / limited-risk / GPAI) against Annex I and Annex III
Technical documentation and conformity assessment preparation for high-risk systems
GPAI compliance support: technical documentation, transparency measures, and copyright-related obligations
Article 50 transparency compliance (AI-generated content labelling)
Ongoing monitoring of EU AI Act timeline changes relevant to your systems
Question 1 of 8
Check Your AI Compliance Score
Frequently Asked Questions
Yes. The Act applies extraterritorially - if your AI system is placed on the EU market or affects people in the EU, it applies regardless of where your company is based.
Fines are tiered: up to €35 million or 7% of global annual turnover for prohibited AI practices, up to €15 million or 3% for most other breaches, and up to €7.5 million or 1% for providing incorrect information to authorities. Whichever figure is higher applies for large enterprises; whichever is lower applies for SMEs and startups.
The UAE Data Office can impose administrative fines, order mandatory audits, and suspend or restrict data processing activities.
Yes. The original implementation schedule has been amended at least once since the Act's entry into force. See our timeline page for the current schedule.
Yes. GPAI model providers are overseen directly by the European Commission's AI Office under a separate regime, with fines of up to €15 million or 3% of worldwide turnover.
Prohibited practices (Article 5) - such as social scoring or untargeted biometric scraping - are banned outright and carry the highest fines. High-risk systems are permitted but subject to strict requirements: technical documentation, conformity assessment, and human oversight, among others.
Related
Not sure which EU AI Act risk tier applies to your systems?
By submitting this form, I acknowledge that I have read and agree to the Privacy Policy, and I consent to the processing of my personal data.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.
Please note: We do not provide any personalized investment advice, token selection guidance, or transaction recommendations. AMLzone is a compliance consultancy and project management services provider, not a Virtual Asset Advisor.