Two-minute brief
EU AI Act requirements explained: video brief
A two-minute brief on the tiers of the EU AI Act and what each requires.
Key takeaways
- Prohibited practices have applied since 2 February 2025.
- High-risk systems are defined by Annex III uses or by regulated products.
- Providers of high-risk systems need risk management, documentation, oversight and a conformity assessment.
- Deployers have their own duties, including human oversight.
- The Act applies in stages, as amended by the Digital Omnibus on AI.
Obligations by tier and by role
Under the EU AI Act, obligations depend on a system's tier and the organisation's role for it. This short film sets out the tiers and the requirements for high-risk systems. Legal readings are for legal advisers.
Article 5 prohibits a short list of practices, including harmful manipulation or deception, exploiting vulnerabilities, social scoring, untargeted facial-image scraping, emotion recognition at work or in education outside medical and safety uses, and certain uses of biometric identification and categorisation; the prohibitions have applied since 2 February 2025. High-risk systems are defined either by use, in areas listed in Annex III such as biometrics, critical infrastructure, education, employment and worker management, access to essential private and public services, law enforcement, migration and the administration of justice, or by being part of products covered by EU product legislation. Article 50 sets transparency duties for certain systems, and general-purpose AI model providers carry their own obligations.
What high-risk systems must meet
Providers of high-risk systems must operate risk management, data governance, technical documentation, automatic record-keeping, transparency and instructions for deployers, human oversight, and accuracy, robustness and cybersecurity, within a quality management system, and must complete a conformity assessment before placing the system on the market, usually by internal control, followed by an EU declaration of conformity and CE marking. Deployers must use systems according to the instructions, assign human oversight to competent people and monitor operation, with further duties in some cases.
The Regulation entered into force on 1 August 2024 and applies in stages, and it has been amended by the Digital Omnibus on AI, in force since 27 July 2026, which affects the timetable. It reaches providers, deployers, importers and distributors of AI on the EU market and organisations abroad whose AI output is used in the EU. No general AI Act certificate exists.
A high-risk provider usually shows conformity by internal control, then signs the EU declaration of conformity and affixes the CE mark.
EU AI Act at a glance
- Purpose
- Risk-based rules for AI in the EU: banned practices, strict requirements for high-risk systems, transparency duties and obligations for general-purpose AI models
- Relevant to
- Providers, deployers, importers and distributors of AI on the EU market, general-purpose AI model providers, and organisations abroad whose AI output is used in the EU
- Edition
- Regulation (EU) 2024/1689, in force since 1 August 2024 and applying in stages, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026
- Certification
- No general AI Act certificate exists. High-risk systems pass a conformity assessment, usually the provider's internal control, then carry the provider's EU declaration of conformity and CE mark
- Sterling's role
- AI inventory and classification, governance, documentation and evidence with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for an EU AI Act compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 10 months
EU AI Act: questions people ask
Is there an EU AI Act certification?
Not for most AI; the Act has no general certificate or seal. A high-risk provider shows conformity by the Article 43 route, usually internal control, then signs the EU declaration of conformity and affixes the CE mark. Notified bodies issue certificates only for certain biometric systems under Annex VII and for AI in products whose own legislation requires third-party assessment. Any other "AI Act certificate" is marketing.
Have the high-risk deadlines moved?
Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, set 2 December 2027 for Annex III high-risk systems and 2 August 2028 for AI in Annex I products, replacing 2 August 2026 and 2 August 2027. The original bans, AI literacy and general-purpose AI rules were not delayed, and transparency duties apply from 2 August 2026.
We are outside the EU. Does the Act apply to us?
It can. It covers providers placing AI systems or general-purpose models on the EU market from anywhere, and providers and deployers abroad whose AI output is used in the Union. A non-EU provider of a high-risk system first appoints an authorised representative in the Union by written mandate.
We only use AI tools such as chatbots and copilots. What applies?
As a deployer you take AI literacy measures, avoid prohibited uses and meet Article 50 where it applies, such as disclosing deep fakes. Using AI for an Annex III purpose, such as screening applicants, brings the high-risk deployer duties from 2 December 2027; rebranding, substantially modifying or repurposing a system into high-risk use makes you its provider.
Is ISO/IEC 42001 certification enough for the AI Act?
No. ISO/IEC 42001 is a voluntary, certifiable management system standard, not a harmonised standard under the Act, and the Commission has said its goals and definitions are not aligned with the Act's quality management system. EN 18286:2026 was written for Article 17, but gives a presumption of conformity only once its reference is published in the Official Journal. An AI management system is still a strong base for the governance the Act draws on.
Keep exploring
Related to this video
The complete guide
Everything on EU AI Act
Start with the EU AI Act page, or go straight to the guide you need.
On the EU AI Act page
- What are the main EU AI Act requirements?
- How do you become EU AI Act compliant?
- How much does EU AI Act compliance cost?
- How long does EU AI Act compliance take?
- Who needs to comply with the EU AI Act?
- How EU AI Act compliance supports trust, sales and control
- Frequently asked questions about the EU AI Act
Guides
Talk to a consultant
Plan your EU AI Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice