The EU AI Act requires organizations that develop, import, or deploy AI to comply with a series of legal requirements that depend on the risk level of the AI system being used. These obligations range from transparency requirements for simple chatbots to comprehensive conformity assessments for systems that impact fundamental rights. In this article, we answer the most frequently asked questions about the obligations, the timeline, and the consequences of non-compliance. Would you like to learn how AI can support your organization? Read more about AI-driven intelligence and what that means in practice.
Which organizations are subject to the EU AI Act?
The EU AI Act applies to any organization that develops, markets, imports, or deploys AI systems within the European Union, regardless of where the company is based. Organizations outside the EU are also subject to the law if their AI systems are used by people or companies in the EU.
The law distinguishes between various roles, each with its own responsibilities:
- Providers are organizations that develop and market AI systems. They bear the heaviest obligations.
- Deployers are organizations that deploy an existing AI system for their own use or for their customers.
- Before placing a product on the market, importers must verify that the conformity assessment has been conducted, that the CE marking is affixed, and that the documentation is retained for ten years.
- Distributors verify that the required documents are present and suspend distribution if they suspect nonconformity.
An important point to note: a distributor, importer, deployer, or third party becomes a provider in its own right—with all the associated obligations—when it places its name on a system, makes a substantial modification to it, or changes its intended purpose in such a way that the system falls into the high-risk category. Furthermore, organizations outside the EU are required to appoint an authorized representative in the EU.
How are AI systems classified into risk categories?
The EU AI Act identifies four risk levels: prohibited AI, high-risk AI, low-risk AI, and AI with minimal or no risk. This classification determines which obligations apply. Most AI applications in use today fall into the lowest category and remain largely unregulated.
Prohibited AI Applications
Certain AI applications are completely prohibited because they pose an unacceptable risk to fundamental rights and human dignity. These prohibitions have been in effect since February 2, 2025, and include, among others:
- Subliminal or manipulative techniques that influence behavior without a person’s awareness and cause significant harm
- Exploiting vulnerabilities based on age, disability, or socioeconomic status
- Social scoring by governments
- Predictive policing based solely on profiling
- Building facial recognition databases through undirected scraping
- Emotion recognition in the workplace or in educational institutions (except in cases involving medical or safety concerns)
- Biometric categorization to infer sensitive characteristics such as race, political views, or sexual orientation
- Real-time remote biometric identification in public spaces for law enforcement purposes, except in strictly defined situations
High-risk and lower-risk applications
High-risk AI is defined in Article 6 of the Act in two ways: the system is a safety component of a product covered by European harmonization legislation, or it falls under one of the eight use cases listed in Annex III. Those eight domains are biometrics, critical infrastructure, education and vocational training, employment and human resources management, access to essential services (including creditworthiness and emergency calls), law enforcement, migration and border control, and the administration of justice and democratic processes. Systems that perform profiling of natural persons are always high-risk, without exception.
AI with limited risk is subject to less stringent transparency requirements, such as the reporting requirement for chatbots. AI with minimal risk—such as spam filters or entertainment recommendation systems—is completely unregulated.
What requirements apply to high-risk AI systems?
Providers and deployers of high-risk AI systems must comply with a comprehensive set of requirements before the system may be placed on the market or put into service. The core requirements include risk management, data quality, technical documentation, and human oversight.
The main obligations are:
- Risk Management System: an ongoing system that identifies, analyzes, and manages risks throughout the entire system lifecycle
- Data quality requirements: training, validation, and test data must meet quality criteria regarding relevance, representativeness, and freedom from errors
- Technical documentation: detailed documentation on the system’s design, operation, and performance
- Transparency and user information: Deployers must receive sufficient information to be able to use the system responsibly
- Human oversight: The system must be designed so that people can monitor it, understand it, and intervene if necessary
- Accuracy, robustness, and cybersecurity: the system must perform consistently and be resistant to attempts at manipulation
- Conformity assessment: depending on the type of system, either by the provider itself or by a third party
- Registration in the EU database: high-risk systems must be registered in a central European database
An Annex III system that performs only a narrow procedural or preparatory function and does not pose a significant risk to fundamental rights may be excluded from the high-risk category, provided that the provider documents this with supporting evidence.
What are the transparency requirements for AI chatbots and assistants?
Low-risk AI systems, such as chatbots and virtual assistants, must clearly inform users that they are interacting with an AI system and not a human. This transparency requirement applies whenever there is direct contact between the system and an end user.
The disclosure requirement means that users must be informed at the time of interaction. This is not required if it is evident to a reasonable person that they are interacting with an AI system, for example, in a clearly marked automated customer service environment.
Additional obligations apply to General-Purpose AI (GPAI) models, such as large language models. All providers of GPAI models must:
- Prepare and maintain technical documentation in accordance with Annex XI
- Downstream providers shall provide information on capacities and limitations in accordance with Annex XII
- Implement a policy to comply with the Copyright Directive
- Make a summary of the training data used publicly available
Providers of models under a free and open-source license are exempt from the documentation and information requirements, unless the model poses a systemic risk. A GPAI model is classified as a model posing a systemic risk if its cumulative training compute exceeds 10 to the power of 25 floating-point operations (FLOP). Upon reaching that threshold, the provider must notify the European Commission within two weeks.
When must organizations comply with the EU AI Act?
The EU AI Act has a phased implementation timeline. Not all requirements take effect at the same time, which gives organizations the flexibility to comply in stages. The most urgent deadlines have already passed or are approaching in 2026.
The most important milestones are:
- February 2, 2025: The prohibited AI practices listed in Article 5 took effect. Organizations that were using prohibited applications should have already stopped doing so by this date.
- August 2, 2025: The requirements for providers of GPAI models took effect. This applies to organizations that offer large language models or comparable generative AI systems.
- 2026 and beyond: All requirements for high-risk AI systems will take effect. Organizations that deploy high-risk systems will need this period to put their risk management systems, documentation, and compliance assessments in order.
Until harmonized standards are available, providers can follow a code of practice to establish a presumption of conformity. This provides practical guidance for organizations that want to take action now.
What are the penalties for noncompliance with the AI Act?
The EU AI Act provides for substantial fines for organizations that violate the rules. The amount of the penalty depends on the severity of the violation and the size of the organization, with higher absolute amounts applying to large companies.
The fine structure is organized as follows:
- Prohibited AI practices: fines of up to 35 million euros or 7% of global annual revenue, whichever is higher
- Other violations of obligations: fines of up to 15 million euros or 3% of global annual revenue
- Providing inaccurate information to regulators: fines of up to 7.5 million euros or 1% of global annual revenue
Lower maximum amounts apply to small and medium-sized enterprises. In addition to financial penalties, regulators may also impose temporary or permanent market bans on non-compliant AI systems. Enforcement is the responsibility of national regulators in collaboration with the European AI Office, which is specifically responsible for overseeing GPAI models.
How Pegamento Helps with AI Compliance and the Smart Use of AI
Navigating the requirements of the EU AI Act is complex, especially if you also want to use AI to make your organization more efficient. We help Dutch organizations achieve both goals: deploying AI responsibly and in compliance with regulations, while also delivering real value.
What we can do for you:
- Agentic AI assistants that take the initiative and act on their own, rather than simply following instructions. This is what we see as the evolution from traditional RPA to Agentic AI for customer service: self-thinking assistants that handle complex tasks autonomously.
- Customized solutions using standard building blocks, so you don’t need costly custom work but still get a solution that fits your processes and systems perfectly.
- Everything under one roof: from advice on risk classification and documentation to implementation, management, and support—without complex supplier management or silos.
- An ISO 27001-certified process as the foundation for information security, supplemented by ISO 9001 and ISO 26000 for quality and social responsibility.
Would you like to know how your organization can make the transition to responsible AI while complying with the EU AI Act? Contact us, and we’d be happy to help you figure it out.
Frequently Asked Questions
Hoe weet ik zeker in welke risicocategorie mijn AI-systeem valt?
Begin met het controleren of je systeem voorkomt in Annex III van de EU AI Act, dat de acht hoog-risico domeinen beschrijft. Controleer daarna of het systeem profilering van natuurlijke personen uitvoert — dat is altijd hoog-risico. Als je twijfelt, is het sterk aan te raden een formele risicoanalyse te laten uitvoeren en dit schriftelijk te documenteren, want de bewijslast ligt bij de aanbieder.
Wij gebruiken een AI-tool van een externe leverancier. Zijn wij dan ook verantwoordelijk voor compliance?
Ja, als deployer ben je medeverantwoordelijk. Je bent verplicht om te controleren of de aanbieder aan zijn verplichtingen heeft voldaan, de tool te gebruiken conform het beoogde doel, en menselijk toezicht te waarborgen. Let op: zodra je de tool aanpast, je eigen naam erop zet, of het gebruik buiten het oorspronkelijke doel uitbreidt, word je zelf aangemerkt als aanbieder met alle bijbehorende zware verplichtingen.
Wat is de eerste concrete stap die mijn organisatie nu moet zetten?
Start met een AI-inventarisatie: breng alle AI-systemen in kaart die je organisatie momenteel ontwikkelt, gebruikt of overweegt in te zetten. Classificeer elk systeem op basis van de risicocategorieën uit de EU AI Act. Zo krijg je direct inzicht in welke deadlines voor jou relevant zijn en waar de hoogste prioriteit ligt voor compliance-maatregelen.
Geldt de meldplicht voor chatbots ook als we die alleen intern gebruiken, bijvoorbeeld voor medewerkers?
De transparantieverplichting richt zich op situaties waarbij eindgebruikers direct interacteren met een AI-systeem. Bij intern gebruik waarbij medewerkers weten dat ze met een AI-tool werken, kan de uitzondering gelden dat het ‘voor een redelijk persoon evident’ is. Toch is het verstandig om ook bij interne tools een duidelijke AI-melding op te nemen, zowel voor compliance als voor vertrouwen binnen de organisatie.
Wat houdt een 'substantiële wijziging' precies in, en wanneer word ik daardoor ineens aanbieder?
De EU AI Act definieert een substantiële wijziging als een aanpassing die invloed heeft op de conformiteit van het systeem of waarbij het beoogde doel verandert, waardoor het systeem in een hogere risicocategorie terechtkomt. Praktische voorbeelden zijn het hertrainen van een model op nieuwe data, het uitbreiden van functionaliteit naar een hoog-risico toepassing, of het integreren in een nieuw systeem dat grondrechten raakt. Bij twijfel is juridische toetsing vóór de wijziging essentieel.
Hoe verhoudt de EU AI Act zich tot de AVG? Moeten we die verplichtingen apart beheren?
De EU AI Act en de AVG vullen elkaar aan maar zijn aparte regelgevingen met eigen verplichtingen. De AVG regelt de bescherming van persoonsgegevens, terwijl de AI Act zich richt op de veiligheid en betrouwbaarheid van AI-systemen zelf. In de praktijk overlappen ze bij hoog-risico AI die persoonsgegevens verwerkt — denk aan vereisten rond datakwaliteit en transparantie. Een geïntegreerde compliance-aanpak die beide wetten samenbrengt is efficiënter dan ze volledig gescheiden te behandelen.
Wat als mijn organisatie nu al een hoog-risico systeem in gebruik heeft dat nog niet compliant is?
De volledige verplichtingen voor hoog-risico systemen gaan in 2026 van kracht, wat betekent dat je nu nog tijd hebt om orde op zaken te stellen. Gebruik deze periode om prioriteit te geven aan het opzetten van een risicomanagementsysteem, het opstellen van technische documentatie en het inrichten van menselijk toezicht. Wacht hier niet mee tot de deadline nadert: conformiteitsbeoordelingen en het aanpassen van bestaande systemen kosten meer tijd dan organisaties doorgaans verwachten.
