The AI Act is the EU's first horizontal law on artificial intelligence (AI). It regulates how AI systems are developed, sold and used in the EU, and sets separate rules for general-purpose AI models. The guide explains what the AI Act does, who it applies to, what it means for your business right now, and how to prepare. It explains what the AI Act does, who it applies to, what it means for your business right now, and how to prepare.
In Short
What: the AI Act is the EU's product-safety-style rulebook for AI, banning certain practices and imposing detailed duties on high-risk systems and general-purpose AI models.
Who: providers and deployers of AI systems in the EU, and non-EU organisations whose AI output is used in the EU.
When: rules are phasing in from February 2025 through August 2028.
Risk if you don't act: fines of up to EUR 35 million or 7% of global turnover, and high-risk systems cannot lawfully reach the EU market without a conformity assessment.
What to do now: classify your AI systems, stop any prohibited use cases, set up governance, and work through the checklist below.
-
What is the AI Act and who does it apply to?
Regulation (EU) 2024/1689 of 13 June 2024 (AI Act) works like a product-safety framework for AI. It sets harmonised rules for placing AI systems on the EU market. It bans certain AI practices, sets detailed requirements for high-risk AI systems, adds transparency rules for a limited set of AI systems, and creates a separate regime for general-purpose AI models.
The Act has a broad reach. It applies to providers that place AI systems on the EU market and to deployers established in the EU. It also applies to providers and deployers outside the EU if the output of their AI system is used in the EU. Importers, distributors, product manufacturers and authorised representatives are also covered. AI systems used only for military, defence or national security, however, are outside its scope. The same applies to research and development before a system is placed on the market, and when AI systems are only used purely for personal use. A limited exception also applies to free and open-source AI systems, unless they are high-risk or fall under the banned or transparency categories.
-
When does the AI Act apply?
Key compliance deadlines
The AI Act is a Regulation. It applies directly in every Member State without national transposition. The rules are phased in over several years. In July 2026, the AI Act was amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), which postponed certain deadlines:
- 2 February 2025: prohibited practices, general provisions and the AI literacy obligation apply.
- 2 August 2025: obligations for providers of general-purpose AI models, the governance framework and most penalties apply.
- 2 August 2026: general application; transparency obligations for chatbots, generative AI and deepfakes apply.
- 2 December 2027: obligations for standalone high-risk AI systems apply (postponed from August 2026 by the Digital Omnibus on AI).
- 2 August 2028: obligations for high-risk AI systems embedded in regulated products apply (postponed from August 2027 by the Digital Omnibus on AI).
-
What are the key obligations under the AI Act?
#1 Prohibited practices
Some AI uses are banned outright. This includes manipulative or exploitative systems, social scoring by public authorities, most emotion inference at work and in education, and untargeted scraping of facial images for identification databases. Real-time remote biometric identification in public spaces is also banned, with narrow exceptions for law enforcement. The Digital Omnibus on AI also added two more bans from 2 December 2026.
#2 Requirements for high-risk AI systems
Providers must put in place risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity. They must also pass a conformity assessment before placing the system on the market. High-risk systems and their providers must be registered in an EU database. "High-risk" covers defined uses in biometrics, critical infrastructure, education, employment, essential public and private services, law enforcement, migration and border control, and the administration of justice. It also covers safety components of certain regulated products.
#3 Obligations for deployers of high-risk AI systems
Deployers must use the system in line with the provider's instructions. They must keep human oversight in place, monitor how the system operates and keep the automatically generated logs. Public bodies and certain private deployers must also carry out a fundamental rights impact assessment before deployment.
#4 Transparency for AI interactions and AI-generated content
Users must be told when they interact with an AI system. Synthetic audio, image, video or text must be marked as AI-generated in a machine-readable way. Deepfakes and AI-generated text on matters of public interest must also carry a visible label.
#5 Obligations for providers of general-purpose AI models
Providers must prepare technical documentation, share information with downstream developers that integrate the model, publish a summary of the training content and follow EU copyright law. Providers of models with systemic risk have extra duties. These include model evaluation, systemic risk assessment and mitigation, cybersecurity measures, and reporting serious incidents to the European Commission's AI Office.
#6 AI literacy
Providers and deployers must take steps to build AI literacy among staff and others who operate AI systems on their behalf. Since the Digital Omnibus on AI, they no longer have to guarantee a specific level of AI literacy for any individual.
-
Who enforces the AI Act? Governance and supervisory authorities
EU Level
At EU level, the AI Act creates a layered governance framework. The European Commission’s AI Office is the central enforcement authority. It has exclusive powers over general-purpose AI models. Since the Digital Omnibus on AI, it has full investigative and sanctioning powers, similar to those of a competition authority. The AI Office is supported by three bodies. The European AI Board has one representative per Member State and advises on consistent application. The Advisory Forum brings together industry, civil society and academia. The Scientific Panel of independent experts provides technical support for enforcement.
National level
At national level, each Member State must appoint at least one market surveillance authority and one notifying authority. In the Netherlands, the draft AI Act Implementation Act proposes a decentralised model with ten sectoral market surveillance authorities. The Dutch Data Protection Authority (AP) and the Dutch Authority for Digital Infrastructure (RDI) are the coordinating supervisors, with the RDI as the single point of contact. For the financial sector, the Dutch Authority for the Financial Markets (AFM) and De Nederlandsche Bank (DNB) are proposed as the competent supervisors for AI systems used in regulated financial services. Other designated authorities include the Netherlands Authority for Consumers and Markets (ACM) for consumer protection, the Dutch Healthcare Authority (NZa) for healthcare, the Netherlands Food and Consumer Product Safety Authority (NVWA) for product safety, and the Dutch Inspectorate of Education for education.
-
What are the penalties for non-compliance?
Enforcement
Enforcement is shared. Member States appoint national market surveillance authorities for AI systems in general. The European Commission's AI Office enforces the rules on providers of general-purpose AI models. Fines are substantial. Breaching the prohibited practices can cost up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Breaches of other operator obligations, including those for providers, deployers, importers, distributors and notified bodies, and of the transparency rules, carry fines of up to EUR 15 million or 3%. Supplying incorrect or misleading information to a competent authority can cost up to EUR 7.5 million or 1.5%. For SMEs and start-ups, the lower of the two figures applies rather than the higher.
-
How does the AI Act interact with other EU and Dutch rules?
General EU legislation
The AI Act does not operate in isolation. It sits alongside the GDPR, which continues to apply separately to personal data processed in AI systems. It also sits alongside the Cyber Resilience Act, although meeting the essential cybersecurity requirements of the Cyber Resilience Act counts as meeting the AI Act's cybersecurity requirement. For products already covered by Union harmonisation legislation, such as medical devices, motor vehicles and machinery, the AI Act applies in a coordinated way with the sectoral regime rather than replacing it.
Financial sector
For financial institutions specifically, the AI Act also sits alongside existing financial regulation. AI is almost always an IT application, so its use already falls within sector-specific rules. At EU level, DORA sets out duties on ICT risk management, incident reporting, resilience testing and third-party risk. These duties apply in full to AI systems that are part of a financial institution's ICT infrastructure. Under Dutch law, financial undertakings must maintain sound and controlled business operations (beheerste en integere bedrijfsvoering) under the Dutch Financial Supervision Act (Wft). This duty applies to the use of AI regardless of the AI Act. Supervisory authorities are also very vocal on the prudent use of AI in financial services. DNB, for example, has stated that it expects financial institutions to apply its SAFEST principles (soundness, accountability, fairness, ethics, skills and transparency) when using AI in the financial sector.
What it means for your business
The AI Act reaches further than a "tech company" law. Any organisation that develops an AI system, or uses one under its own authority in the EU, can be captured in its scope. This is true whether the system is a fraud-detection tool in a bank, a CV-screening system in HR, a triage tool in a hospital, or a chatbot on a public-facing website. The extraterritorial trigger is the location of the output, not the location of the provider. Non-EU vendors selling into the EU and non-EU groups that use AI outputs in EU operations are therefore equally in scope. For high-risk systems, non-compliance means you cannot access the EU market, as the AI system cannot lawfully be placed on the market until its conformity has been assessed.
In practice this means several things. Classify your existing AI systems against the Act's risk categories. Update vendor and customer contracts to cover documentation, information flows and incident reporting. Allocate internal ownership across legal, compliance, IT and business. Train staff on AI literacy. Make sure labelling and watermarking are in place for generative-AI outputs, now that the transparency obligations are in force. To help you start, we have included a preparation list below.
Preparing: Your AI Act action checklist
- Map every AI system you use or are developing, and classify each one against the AI Act's categories (prohibited, high-risk, limited-risk transparency, general-purpose AI model, minimal risk).
- Discontinue any use case that falls within the prohibited practices.
- Establish an AI governance framework with clear ownership across legal, compliance, IT and business, and put AI literacy training in place.
- Ensure transparency measures for AI-generated content and AI interactions are in place, in compliance with the transparency obligations that took effect on 2 August 2026.
- Update contracts with AI vendors and customers to reflect the AI Act's documentation, information-sharing and incident-reporting obligations.
- Build compliance workflows for high-risk systems. These should cover risk management, human oversight, logging, post-market monitoring, and a fundamental rights impact assessment where applicable. Have them ready for the December 2027 and August 2028 deadlines.
- Map how the AI Act interacts with other applicable EU or Dutch legislation, and actively monitor guidance and communications from the relevant supervisory authorities.
For further guidance on how the AI Act applies to your organisation, or what steps to take to prepare, please contact our team or download our AI Act onepager.
