The EU AI Act can apply when an organisation develops, sells, imports, distributes, integrates, or uses AI in the EU. It can also cover providers and deployers based outside the EU when output produced by their is used in the EU. This hub helps identify the regulated system or model, each organisation's role, and the rules that follow.
Use the visual timeline for chronology and the linked guides for the facts, roles, controls, and evidence behind each milestone.
Start with the real product and use case. Then check scope, actor roles, prohibited uses, high-risk classification, duties, transparency duties, and the application date for each obligation.
Common starting points
Start with penalties, the amended calendar, high-risk requirements, or AI literacy under the EU Artificial Intelligence Act (AI Act). The complete guide library below covers each role, risk tier, obligation, and evidence path.
is the AI Act's penalty table. Match the actor and infringement to the correct maximum tier, then check the national process, application date, and the lower ceiling where the fined business is a small or medium-sized enterprise (SME). The amounts are maximums, not automatic fines.
Review AI Act penalty tiersSeparate the 2 August 2026 general application date from the amended dates for high-risk AI systems. Sections 1 to 3 apply from 2 December 2027 to the paragraph 2 route in for uses, such as specified recruitment or credit-scoring systems, and from 2 August 2028 to the paragraph 1 route for product-related systems.
Check the current AI Act datesUse to decide whether the system is high-risk. If it is, require controls and evidence for risk management, data, technical documentation, logs, instructions, human oversight, accuracy, robustness, and cybersecurity.
Open the high-risk checklistAI literacy means giving people enough knowledge and skill to operate or use an responsibly in its actual setting. Providers and deployers should tailor training and instructions to the person's experience, the use case, and the people affected, then keep evidence that the measures were delivered.
Read the AI literacy answerApply each date to the relevant rule. Definitions and the original Article 5 prohibitions have applied since 2 February 2025, and most GPAI, governance, and penalty provisions since 2 August 2025. , published on 24 July 2026 and entering into force on 27 July 2026, keeps 2 August 2026 as the general application date but moves Sections 1-3 to 2 December 2027 for high-risk systems and 2 August 2028 for (1) product-linked systems. Its new prohibition on specified non-consensual intimate material and child sexual abuse material applies from 2 December 2026.
New to the Act? Start with scope, roles, and classification. If those decisions are already documented, jump directly to the obligation, evidence, deadline, monitoring, or comparison you need.
Establish what the product or use case is, whether the Act applies, which operator roles each organisation holds, and which risk route needs investigation.
Move from the initial screen into the rules for prohibited practices, high-risk systems, GPAI models, transparency, impact assessment, and penalties.
Translate the assigned obligations into controls, conformity decisions, technical documentation, provider evidence, and owned operating workflows.
Sequence the staged application dates, then connect post-market monitoring and serious-incident triage to the systems and models already classified.
See how AI Act work relates to ISO/IEC 42001 and the NIST AI RMF, or use the focused FAQ when you already know the question you need to resolve.
This hub is the shared entry point for AI Act inventory, role mapping, risk-tier screening, obligation assignment, and evidence governance. Route uncertain facts into cited research and convert confirmed duties into owners, records, and release gates.
