Log in
Sign up

The EU AI Act

The world’s first horizontal AI regulation. Applies to providers, deployers, importers, and distributors operating in the EU. AI Sigil maps every article to scoped obligations and pre-built controls.

Start Free Trial

At a glance

The EU AI Act is a dense piece of regulation, but its shape rests on six anchor points:

  • What kind of legal instrument it is
  • When its provisions begin to apply
  • Who falls within its geographic reach
  • How it classifies AI risk
  • How AI Sigil covers it
  • What non-compliance costs

Each of these shapes whether and how the Regulation applies to your AI portfolio, read them before diving into obligations, roles, and articles.

Type: Regulation

Directly binding in all 27 EU member states without national transposition.

Status: In force

Entered into force on 1 August 2024, with its obligations applying in phases.

Geographic scope

Applies inside the EU and to non-EU providers and deployers whose AI output is used within the EU.

Controls in AI Sigil

62 pre-built controls, each mapped to the specific article or annex it derives from.

Risk model

Five tiers: Minimal Risk, Limited Risk, High Risk, General-Purpose AI (GPAI), and GPAI with Systemic Risk.

Penalties

Up to €35 million or 7% of global annual turnover, whichever is higher (above GDPR's ceiling).

What it is

  • First comprehensive legal framework specifically regulating AI, adopted by EU Parliament and Council in 2024
  • Classifies AI systems by risk level (prohibited / high / limited / minimal)
  • Imposes proportionate obligations on each actor in the value chain
  • Providers carry the heaviest burden (risk management, technical doc, conformity assessment, post-market monitoring)
  • Deployers, importers, distributors carry lighter but specific duties
  • GPAI models follow a separate track with stricter rules for systemic-risk ones

What you need to remember

  • Phased application started 2 Feb 2025 with prohibited practices
  • Bulk of high-risk obligations apply from December 2027
  • Non-compliance: up to €35M or 7% global turnover, above GDPR
  • Directly applicable in 27 EU member states, no national transposition
  • Extraterritorial reach: any AI output used in EU falls in scope

The regulation

Regulation (EU) 2024/1689, in three views:

– The short version: what the Act does, who it binds, the four risk tiers
– The complete legal text: every article and annex, indexed
– The dates: when each obligation takes effect

Start here if you need to know what the Act says, before working out what it asks of you.

EU AI Act Summary

What the Act does, who it binds, and the four risk tiers. The essentials in five minutes instead of 144 pages.

Open

EU AI Act Full Legal Text

Every article and annex, indexed article by article. Jump straight to the provision you need.

Open

Application timeline

Which obligations are already in force, which are still coming, and the exact date each one switches on.

Open

The path to compliance for the EU AI Act

Six steps, in the order that works. Each is blocked by the one before it, which is why programmes that start in the middle stall.

Step 1
Find every AI system
Including the ones bought inside other software and the ones teams adopted without telling anyone. You cannot classify what you have not found, and this is the longest step in the whole programme.
Step 2
Decide your role on each one
Provider or deployer, system by system rather than company-wide. Most organisations are both, and the answer changes which obligations apply at all.
Step 3
Classify
Risk level derived from what each system actually does, documented and repeatable. Where you assess a listed system as not high risk, that assessment becomes a public filing rather than an internal note.
Step 4
Build the evidence
Risk management, data governance, technical documentation, logging and human oversight. For providers, the quality management system is the container the rest sits in.
Step 5
Prove it
Conformity assessment, declaration, registration. This is where an incomplete step 4 surfaces, which is why it cannot be the place you start.
Step 6
Keep it true
retrained model, a new purpose or a new market can move a system into a different category. Obligations have to be re-derived, and the evidence has to be captured as the work happens rather than assembled the week a regulator asks
Where AI Sigil fits: Register a system with its models, data, interfaces and use cases, and the platform derives the obligations that apply from that profile, then re-derives them when the profile changes. Steps 2, 3 and 6 stop being manual work.