The AI Act: what your AI systems must be able to show.
The AI Act sets rules for AI by risk. Most systems face light duties. High-risk systems, such as AI in medical devices or critical infrastructure, must prove they are safe, documented and overseen. An amendment in 2026 moved those dates back, not away.
A technical view, not legal advice. Facts checked against the official sources below on 1 November 2026.
- Providers who build AI systems or put them on the EU market
- Deployers who use AI systems in their work in the EU
- Makers of products where AI is a safety component, such as medical devices
- Providers of general-purpose AI models
- 1 Aug 2024 In force.
- 2 Feb 2025 Prohibited practices banned; AI literacy duty applies.
- 2 Aug 2025 Obligations for general-purpose AI models.
- 2 Aug 2026 General application, including transparency duties.
- 2 Dec 2027 High-risk systems listed in Annex III, such as critical infrastructure and employment.
- 2 Aug 2028 High-risk AI in products under Annex I law, such as medical devices.
- Pending A proposal to move medical devices to a lighter AI Act regime is in Parliament. Not adopted when checked.
High-risk means evidence, built in from the start.
Know your class
An AI system is high-risk if it is a safety component of a product that needs third-party assessment, such as a medical device, or if it is listed in Annex III.
Risk and data
Providers of high-risk systems need a risk-management process and governed training, validation and test data.
Documentation and logs
Technical documentation, automatic logging and a quality management system, kept up to date for the life of the system.
Human oversight
The system must be designed so a person can understand its output, oversee it and step in.
Accuracy and security
Declared accuracy, robustness and cybersecurity, followed by conformity assessment, CE marking and registration.
Penalties
Fines reach €35 million or 7% of worldwide turnover for prohibited practices, and €15 million or 3% for most other breaches.
From requirement to working system.
The requirements read like good engineering practice, because they are. Built in from the first design, they cost far less than added before an audit.
- Classify your AI systems and use cases against the Act
- Design risk management, data governance and logging into the system
- Validation and explainability that give oversight something real to check
- Technical documentation that stays current as the system changes
What does this mean for your systems?
Tell us what you build or run. We will give you a straight, technical answer.
Book a consultation