EU AI Act Guide (2026): Risk Tiers, Deadlines After the AI Omnibus, Fines

Who it applies to

The Act sets obligations by role, and one company can hold several roles:

• Providers develop an AI system or GPAI model, or have one developed, and place it on the EU market under their own name. This applies wherever they're established.
• Deployers use an AI system under their own authority in a professional capacity.
• Importers, distributors and authorized representatives have their own supply-chain duties.

An "AI system" is a machine-based system that "infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions" (Art. 3). Non-EU providers are in scope when their systems or outputs are used in the EU.

Risk tiers and key requirements

Prohibited practices (Article 5)

Article 5 bans, among other practices:

• harmful manipulation, and exploitation of people's vulnerabilities
• social scoring that leads to detrimental treatment
• risk assessments that predict whether a person will commit a crime based solely on profiling
• creating or expanding facial-recognition databases by untargeted scraping
• inferring emotions in the workplace and in education, with limited exceptions
• certain biometric categorization
• real-time remote biometric identification in public for law enforcement, with narrow exceptions

From 2 December 2026, AI systems that generate non-consensual intimate imagery or CSAM are also prohibited.

High-risk AI (Article 6, Annex III)

Article 6 covers two groups. The first is AI used as a safety component of products under Annex I legislation, such as machinery, toys and lifts. The second is the Annex III use cases:

• biometrics
• critical infrastructure
• education
• employment
• access to essential services, including credit and insurance
• law enforcement
• migration and border control
• administration of justice and democratic processes

Providers of high-risk AI need:

• risk management
• data governance
• technical documentation
• logging
• transparency to deployers
• human oversight
• accuracy, robustness and cybersecurity
• a quality management system
• conformity assessment, CE marking and EU database registration

Deployers (Art. 26) must:

• use the system according to its instructions
• assign competent human oversight
• monitor the system's operation
• keep automatically generated logs for at least six months
• inform workers' representatives and affected workers before using high-risk AI at work

Transparency (Article 50)

Under Article 50:

• People must be told when they're interacting with an AI system.
• Synthetic audio, image, video and text must be "marked in a machine-readable format and detectable as artificially generated or manipulated".
• Deep fakes must be disclosed.

Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the marking duty in Art. 50(2).

General-purpose AI models (Article 53)

Under Article 53, GPAI providers must:

• keep technical documentation
• give information to downstream providers
• put in place a policy to comply with EU copyright law
• publish a "sufficiently detailed summary" of training content

Models with systemic risk carry extra duties. Models placed on the market before 2 August 2025 must comply by 2 August 2027.

AI literacy (Article 4)

The AI Omnibus rewrote Article 4. It replaced the duty to ensure a "sufficient level" of AI literacy with a duty to "take measures to support the development of AI literacy" of staff. The amended text says this does not require a guaranteed level, and the Commission and Member States take on a promotional role.

Key dates

Sources: timeline, European Commission.

Conformity assessment process

There's no general "AI Act certificate". High-risk providers carry out conformity assessment under Article 43, using one of two routes:

• Internal control (Annex VI). Most Annex III systems use this route.
• Assessment by a notified body (Annex VII). Biometric systems need this route where harmonised standards or common specifications aren't applied.

Annex I products follow the conformity procedure in their own sector legislation. After assessment, the provider issues an EU declaration of conformity, affixes the CE mark, registers the system and runs post-market monitoring.

Penalties

Under Article 99:

• Prohibited practices: up to €35M or 7% of worldwide annual turnover.
• Most other obligations: up to €15M or 3%.
• Supplying incorrect or misleading information to authorities: up to €7.5M or 1%.

The higher amount applies, except for SMEs (and, after the Omnibus, small mid-caps), where the lower amount applies.

Mapping to related frameworks

• ISO/IEC 42001: an AI management system that supports the Act's quality management, risk and documentation duties.
• NIST AI RMF: its Govern, Map, Measure and Manage functions are a practical basis for risk management.
• GDPR: applies alongside the Act whenever AI processes personal data.
• ISO/IEC 27001: supports the cybersecurity and logging requirements.

Readiness checklist

1. Inventory every AI system and model you build, buy or embed.
2. Classify your role for each one: provider, deployer, importer or distributor.
3. Screen against Article 5 and stop any prohibited use, including the new NCII/CSAM ban from 2 December 2026.
4. Classify risk: Annex I, Annex III, transparency-only or minimal.
5. For GPAI, prepare technical documentation, a copyright policy and a training-content summary.
6. Implement Art. 50 disclosures and machine-readable marking by 2 December 2026.
7. For high-risk systems, build risk management, data governance, logging and human oversight, and a QMS, before 2 December 2027 or 2 August 2028.
8. As a deployer, assign oversight, keep logs for six months or more, and notify workers.
9. Put AI literacy measures in place for staff.
10. Map the controls to ISO/IEC 42001 and the NIST AI RMF to reuse evidence.

Common pitfalls

• Assuming the Omnibus delayed everything. Prohibitions, GPAI duties and transparency deadlines still apply.
• Ignoring deployer duties when you only buy AI.
• Missing AI embedded in SaaS tools your teams already use.
• Treating ISO/IEC 42001 certification as legal conformity. It isn't.
• Relying on pre-Omnibus literacy guidance with "sufficient level" wording.

How AssureCore helps

AssureCore includes the EU AI Act among its 34 frameworks. You can track obligations in the Controls Register, record AI risks in the Risk Register, draft policies with AI-assisted writing and gap analysis, and use Cross-framework Mapping to reuse ISO/IEC 42001 and NIST AI RMF work.

Frequently asked questions

Official references

• European Commission – AI Omnibus enters into force (27 Jul 2026)
• AI Act implementation timeline
• AI Act Article 3 – Definitions
• AI Act Article 4 – AI literacy
• AI Act Article 5 – Prohibited practices
• AI Act Article 6 – High-risk classification
• AI Act Annex III – High-risk use cases
• AI Act Article 26 – Deployer obligations
• AI Act Article 43 – Conformity assessment
• AI Act Article 50 – Transparency
• AI Act Article 53 – GPAI provider obligations
• AI Act Article 99 – Penalties
• Regulation (EU) 2024/1689 on EUR-Lex

Related frameworks

• ISO 42001 guide
• NIST AI RMF guide
• UK AI Reg guide
• GDPR guide