EU AI Act Compliance Hub Deadlines, GPAI, Omnibus

The AI Act employs a risk-based approach, classifying AI systems into four tiers with escalating regulatory requirements based on potential harm to health, safety, and fundamental rights. Adopted by the European Parliament on March 13, 2024, and entering into force August 1, 2024, it establishes harmonized rules for AI development, deployment, and use across all 27 EU member https://lievell.com/ai-in-business-a-comprehensive-integration-guide.html states. Home PlatformRules, control decisions, and records anyone can verify Resources PricingStart free, pay when a workflow goes into production Company AI systems embedded in products subject to existing sectoral legislation. This guide covers who must comply, what DORA requires, and how to build a compliant training programme. The GDPR governs the processing of personal data (lawful basis, data subject rights, accountability), while the EU AI Act governs AI systems themselves (risk classification, safety, transparency, human oversight).

A US company that sells software with AI features to EU customers or deploys AI affecting persons in the EU must classify its systems and comply with the applicable obligations. Any provider or deployer whose AI output is used in the EU is in scope regardless of where the organization is headquartered. As of August 24, 2026 — 22 days into the enforcement era — no fine, formal investigation opened by Commission decision, or market withdrawal order under the EU AI Act has been publicly confirmed by the European AI Office, the European Data Protection Supervisor, or any national competent authority.

• Set proportionate access, integrity, and retention controls under the relevant rules.
• Healthcare organizations using AI in critical clinical decision support — even tools not classified as medical devices — should conduct a thorough Annex III assessment against the “safety component of critical infrastructure” category.
• The Digital Omnibus deferral has given organizations breathing room on the most demanding high-risk obligations.
• Home PlatformRules, control decisions, and records anyone can verify Resources PricingStart free, pay when a workflow goes into production Company
• The penalty structure does not change under the Digital Omnibus.

He holds CISSP and CISM certifications and advises organizations on NIS2, the EU AI Act, and cybersecurity awareness programs. The European Commission estimated in an impact study that only 5-15% of applications would be subject to stricter rules. Technical documentation and risk-management frameworks are living artifacts.

• Classify each system using the Act’s categories and applicable Annex I or Annex III pathway.
• Browse the AI Buzz Governance & Security Hub — 30+ in-depth guides covering OWASP, NIST, ISO 42001, AI risk management, and enterprise AI security frameworks.
• The phased approach was designed to give organizations time to assess AI use cases, implement controls, and align governance before full enforcement.
• Technical documentation and risk-management frameworks are living artifacts.

What are the penalties of the EU AI Act?

Does using ChatGPT or Claude make my organization a GPAI provider? If you build and sell an HR screening tool, you are the provider. A deployer is an organization that uses an AI system in https://the-business-mag.net/what-legal-mistakes-should-startups-avoid/ a professional context for its intended purpose.

Organizations should implement a phased approach aligned with system classification and the provision-specific calendar. Their acceptance and any compliance conclusion require separate review and evidence. Independent third-party conformity assessment bodies designated by member states to conduct assessments of high-risk AI systems requiring external certification (e.g., biometric systems, medical devices). For SMEs, including startups, each fine must not exceed the lower applicable percentage or fixed ceiling.

July 27, 2026 — Regulation (EU) 2026/1744 enters into force; Digital Omnibus amendments binding law

For high-risk systems, assess current state against Articles 9-15 requirements. Identify provisions already applicable and systems with 2027 or 2028 high-risk dates. Classify each system using the Act’s categories and applicable Annex I or Annex III pathway.

• Where an in-scope AI system processes personal data in processing subject to GDPR, the responsible parties must analyze both regimes and their roles.
• The AI Act employs a risk-based approach, classifying AI systems into four tiers with escalating regulatory requirements based on potential harm to health, safety, and fundamental rights.
• CV screening, interview tools, and performance management AI are explicitly listed in Annex III — and are deployed by more organizations than any other high-risk category.
• Covers AI in critical infrastructure, education, employment, law enforcement, and medical devices — strict pre- and post-market rules apply.
• Under Article 50, limited-risk systems must disclose AI interaction (e.g., chatbots), label AI-generated content (deepfakes, synthetic media), and inform users of emotion-recognition or biometric categorization.
• Integrate with existing ISO or NIST AI RMF frameworks where implemented.

💰 7. EU AI Act Penalties — What Non-Compliance Costs

For foundational governance frameworks, see our guide on building an AI governance framework. It is written for compliance officers, legal teams, CISOs, AI governance leads, and business leaders — not as a beginner introduction, but as a working reference for organizations assessing and managing their EU AI Act exposure in 2026. GLACIS can record which configured controls were evaluated and what they reported, then map those bounded records to review questions. Conduct periodic reviews that assess ongoing compliance with the applicable Articles 9-15 duties and prepare for competent-authority requests. Give reviewers scoped operational records they can inspect. The AI Act establishes one of the most stringent penalty regimes in technology regulation, mirroring GDPR’s structure with fines tied to global annual turnover.