Prohibited practices
Art 5 · since Feb 2025Social scoringFace scrapingEmotion recognition at workHigh risk
Annex III · from Dec 2027Annex I · from Aug 2028CV screeningCredit scoringInsurance pricingTransparency
Art 50ChatbotsDeepfakesAI-generated contentMinimal risk
No new dutiesSpam filtersVideo game AI
You offer or use it in the EU, or its output is used there, wherever you’re based
You develop an AI system or general-purpose AI model, or have one built, and offer or use it under your name
You’re established in the EU, or the system’s output is used in the EU
You use an AI system under your authority at work, such as a hiring tool or a chatbot you bought
Your duties apply to high-risk AI: check its CE marking and documentation first
You place a non-EU provider’s AI system on the EU market, or sell an AI system on down the supply chain
Article 25 then treats you as its provider, with the provider’s duties
You put your name on a high-risk system, substantially modify one, or repurpose AI so it becomes high-risk
Art 9, 10 · If you build it
For a high-risk system, run a risk management process from design through use, with regular review, and govern the data it’s trained, validated and tested on.
Art 11 to 15 · If you build it
Keep technical documentation, design the system to record events in logs, write clear instructions for deployers, and build in human oversight, accuracy and cybersecurity.
Art 17, 43, 48, 49 · If you build it
Run a quality management system, complete the conformity assessment and affix the CE marking. For Annex III uses, register the system in the EU database too.
Art 72, 73 · If you build it
Run a post-market monitoring system that tracks how the AI performs in use, and report serious incidents to the authorities.
Art 50(1), (2) · If you build it
Design AI that interacts with people so they know it’s AI, and mark generated audio, images, video and text as AI-made. Generators on the market before August 2, 2026 have until December 2, 2026.
Art 53, 55 · If you build it
Keep technical documentation, adopt a copyright policy and publish a summary of training content. Models with systemic risk also need evaluations, adversarial testing and incident reports.
Art 4 · If you use it
Take measures to support the AI literacy of staff and anyone running AI for you, suited to their role. Since July 2026, you no longer have to ensure a sufficient level. Providers have this duty too.
Art 5 · If you use it
Some uses have been banned since February 2, 2025, for providers and deployers alike. From December 2, 2026, so is AI that makes nonconsensual intimate deepfakes or child sexual abuse material.
Art 26 · If you use it
Follow the provider’s instructions, give oversight to trained people with authority to act, check the input data you control, monitor it, report risks and keep its logs at least six months.
Art 99(3)
For a banned practice, or 7% of worldwide annual turnover if that’s higher
Art 99(4)
For most other duties, including provider, deployer and transparency duties
Art 99(5)
For giving authorities incorrect, incomplete or misleading information
Art 99(6), (6a)
Face the lower cap. Since the Omnibus, small mid-caps do too, except for bans
Mainly the high-risk dates moved. The bans and AI literacy have applied since February 2025, general-purpose AI duties since August 2025 and Article 50 since August 2026. [1]
Deployers of high-risk AI have their own duties under Article 26, from trained oversight to keeping logs for at least six months. And no deployer may use the practices Article 5 bans. [2]
They cover AI that makes nonconsensual intimate deepfakes of real people, and child sexual abuse material. Marking AI-generated content is a separate Article 50(2) duty, due December 2, 2026 for older generators. [1]
Does the EU AI Act apply to US companies?
It can. The Act covers providers that place AI systems or general-purpose AI models on the EU market, wherever they’re based. It also covers providers and deployers outside the EU whose AI output is used in the EU. A US company selling AI to EU customers is likely in scope, and one whose AI output is used in the EU may be too. Check each system against Article 2(1).
Has the EU AI Act been delayed?
In part. The Digital Omnibus, Regulation (EU) 2026/1744, entered into force on July 27, 2026. It moved the high-risk duties to December 2, 2027 for uses listed in Annex III, such as hiring and credit scoring, and to August 2, 2028 for AI in products under EU safety law (Annex I). Other dates largely stand. The Commission’s guidance on which systems count as high-risk is still a draft, with the final version due by the end of 2026.
When does a deployer become a provider under the EU AI Act?
Article 25 names three cases. You put your name or trademark on a high-risk system already on the market. You substantially modify one so it stays high-risk. Or you change the intended purpose of an AI system, including a general-purpose one, so it becomes high-risk. You then carry the provider’s duties. The original provider must help, and since the Omnibus that explicitly includes technical documentation, known limitations and access for testing, unless it said the system mustn’t be made high-risk.
Is AI literacy still mandatory under the EU AI Act?
Yes, in a softer form. Since the Digital Omnibus took effect in July 2026, Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and others who run AI on their behalf. It no longer asks them to ensure a sufficient level, and says they needn’t guarantee any specific level for any individual. The Commission and member states must help, particularly smaller firms. Training matched to each role, with a record of it, is still a sensible way to show what you’ve done.
What are the new EU AI Act bans from December 2026?
From December 2, 2026, Article 5 also bans AI that generates or manipulates realistic intimate or sexual images, video or audio of an identifiable person without their explicit consent, and AI that generates child sexual abuse material. A system is banned from the market if that’s its purpose, or if it can foreseeably produce such material without reasonable safeguards. A deployer breaks the ban only by using AI for that purpose.
How does Enzai help with EU AI Act compliance?
Pick an AI system from your inventory and run the EU AI Act as an assessment on it. How you classify the system decides which controls appear. Each control gets an owner, a due date and evidence, and every control is approved before the assessment is complete. Risks are scored before and after treatment. If the framework is updated, you’re told and choose when to move over. Your auditors and regulators judge compliance. Enzai keeps the record.
Sources · Reviewed Oct 2026
