The EU AI Act has entered into force in phases: the regulation officially took effect on August 1, 2024, but not all of its requirements apply at the same time. Depending on the type of AI system, different deadlines apply, spread out over a two-year period. If you’re a Dutch organization working with AI, it’s important to know which rules are already in effect and which ones are still to come. In this article, we answer the most frequently asked questions about the EU AI Act and its timeline.
What are the phases involved in the implementation of the EU AI Act?
The EU AI Act follows a phased implementation schedule with four key milestones. The law took effect on August 1, 2024, but the specific obligations will come into force gradually over a 24-month period. This gives organizations time to prepare, but the clock is definitely ticking.
The four phases are as follows:
- August 1, 2024: The EU AI Act formally enters into force. The text is binding, but most of the obligations do not yet apply.
- February 2, 2025: The ban on AI applications that pose an unacceptable risk takes effect. These are the so-called prohibited practices listed in Article 5.
- August 2, 2025: The requirements for providers of General-Purpose AI (GPAI) models take effect. These include large language models and other versatile AI systems.
- August 2, 2026: The full set of regulations for high-risk AI systems takes effect. This is the strictest and most comprehensive category of requirements.
For Dutch organizations, this means that by 2026, you will have already gone through the first two phases and will now be entering the third phase. The time to take action is now, not after the deadline.
What are the first requirements that will take effect as early as 2025?
Effective February 2, 2025, certain AI applications will be completely banned throughout the European Union. These are practices considered to pose an unacceptable risk and may no longer be used, developed, or marketed, effective immediately.
Prohibited practices include, among others:
- Subliminal or manipulative techniques that influence behavior and cause harm without a person’s awareness
- Exploiting vulnerabilities based on age, disability, or socioeconomic status
- Social scoring by governments based on personal behavior
- Predictive policing based solely on profiling, without concrete evidence
- The creation of facial recognition databases through undirected scraping of the internet or security cameras
- Emotion recognition in the workplace or in educational institutions, excluding medical or safety applications
- Biometric categorization to infer sensitive characteristics such as race, political beliefs, or sexual orientation
- Real-time remote biometric identification in public spaces for law enforcement, except in strict cases
Effective August 2, 2025, additional requirements will apply to providers of GPAI models. They must prepare technical documentation, inform downstream providers about the capabilities and limitations of their models, implement a policy to ensure compliance with copyright laws, and make a summary of the training data used publicly available.
Which AI systems fall into the high-risk category?
High-risk AI is defined in Article 6 of the EU AI Act and encompasses two types of systems. First: AI used as a safety component in products that are already subject to existing European harmonization legislation and for which a third-party conformity assessment is required. Second: AI systems deployed in one of the eight specific domains listed in Annex III of the Act.
Those eight areas are:
- Biometrics (including emotion recognition and biometric categorization)
- Critical infrastructure (energy, water, transportation, digital infrastructure)
- Education and Vocational Training (Admission, Student Evaluation)
- Employment and Human Resources Management (recruitment, performance evaluation, promotion)
- Access to essential services (creditworthiness, insurance, emergency calls)
- Law enforcement (risk assessments, evidence, investigations)
- Migration and Border Control
- The Administration of Justice and Democratic Processes
Important to know: A system that performs only a limited procedural or preparatory task in one of these areas and does not pose a significant risk to fundamental rights may fall outside the high-risk category. However, the provider must provide substantiated documentation to support this. AI systems that profile natural persons are always high-risk, without exception.
What is the deadline for high-risk AI systems?
The full requirements for high-risk AI systems will take effect on August 2, 2026. That is the deadline by which providers and users of high-risk AI must be in full compliance with all requirements of the EU AI Act. For organizations that are already working with these types of systems, preparation is therefore urgent.
The obligations for providers of high-risk AI are extensive:
- Establish a continuous risk management system throughout the system’s entire lifecycle
- Working with training, validation, and test data that are representative and as free of errors as possible
- Systematically investigate and mitigate potential bias
- Prepare technical documentation in accordance with Annex IV
- Enable automatic event logging
- Provide clear instructions to deployers
- Adopt a design that effectively enables human oversight
- Ensuring accuracy, robustness, and cybersecurity
- Arrange for a quality management system, a declaration of conformity, CE marking, and registration in the EU database
Deployers—the organizations that use high-risk AI under their own authority—also have obligations. They must use the system in accordance with the user manual, assign human oversight to qualified individuals, retain logs for at least six months, inform employees before the system is put into use, and, where necessary, conduct a data protection impact assessment (DPIA).
What are the consequences of non-compliance with the EU AI Act?
Failure to comply with the EU AI Act may result in significant financial penalties. The fines are similar to those under the GDPR: they depend on the severity of the violation and the size of the organization. For the most serious violations, such as the use of prohibited AI practices, the maximum fines are set at the highest level.
In addition to financial penalties, there are also operational and reputational risks. A system that does not meet the requirements may be withdrawn from the market or prohibited from use. Furthermore, under Article 86, individuals affected by decisions made by high-risk AI systems may request an explanation of the factors that determined those decisions. This increases the legal vulnerability of organizations that do not operate transparently.
For Dutch organizations, regulators will also begin actively enforcing the law. The Dutch Data Protection Authority and other relevant agencies will play a role in overseeing compliance with the AI Act, in addition to the European AI Office, which oversees GPAI models.
How are Dutch organizations preparing for the AI Act?
Preparing for the EU AI Act begins with a clear inventory of all AI systems that your organization uses or offers. Next, for each system, you identify which risk category it falls into and what obligations result from that. This sounds straightforward, but in practice, it’s a complex process for many organizations.
A practical approach consists of the following steps:
- Identify all AI applications within your organization, including purchased software that contains AI components
- Classify each system based on the risk categories specified in the AI Act
- Determine your role: Are you a provider or a deployer? The obligations differ significantly
- Prepare documentation in accordance with the requirements, including technical documentation and risk analyses
- Set up processes for human oversight, logging, and incident reporting
- Train employees who work with high-risk AI so that they understand their responsibilities
- Stay up to date on the latest developments, as codes of conduct and harmonized standards are still being further developed
For organizations that use AI in customer interactions or business processes, it’s also wise to consider the broader governance framework surrounding AI. This includes aligning AI compliance with existing frameworks for information security and quality management.
How Pegamento Helps with AI Act Compliance
We understand that the EU AI Act raises many questions, especially if you’re already using AI solutions for customer engagement or process automation. At Pegamento, we help Dutch organizations get started with AI in a responsible and compliant manner. Our Agentic AI for customer service is built on a foundation of transparency, human oversight, and reliability. Agentic AI represents the evolution from traditional RPA bots to self-thinking assistants that not only follow instructions but also take the initiative and act independently within predefined parameters.
What we offer in the context of responsible AI use:
- A smart combination of proven modules that meet the requirements for transparency and human oversight
- Everything under one roof: from consulting and implementation to management and support, without complex supplier structures
- Solutions that align with our ISO 27001-certified approach to information security, supplemented by ISO 9001 and ISO 26000
- Guidance on setting up logging, user manuals, and human oversight in accordance with the requirements of the AI Act
Would you like to know where your organization stands right now in light of the EU AI Act? Please contact us, and we’d be happy to help you figure out the next step.
Frequently Asked Questions
Does the EU AI Act also apply to small and medium-sized enterprises (SMEs)?
Yes, the EU AI Act applies to all organizations that offer or use AI systems within the EU, regardless of their size. However, the law does provide some relief for SMEs and startups, such as reduced costs for compliance assessments and access to regulatory sandboxes to experiment with AI under the guidance of regulators. Nevertheless, even smaller organizations are required to avoid prohibited AI practices and, when using high-risk AI, to comply with the relevant requirements.
What if my organization uses AI software from a third-party vendor? Am I still responsible?
Yes, as a deployer—the party that deploys an AI system under its own authority—you have your own responsibilities under the EU AI Act, even if you did not develop the software yourself. This means you must deploy the system in accordance with the provider’s instructions, ensure human oversight, and retain logs for at least six months. It is therefore advisable to specify in the contract when purchasing AI software what documentation and support the supplier will provide to facilitate your compliance.
How do I know if my AI system truly falls outside the high-risk category?
This is one of the most practical challenges in implementing the AI Act. A system falls outside the high-risk category if, although it is used in one of the eight Annex III domains, it performs only a limited procedural or preparatory task without posing a significant risk to fundamental rights. It is crucial that you substantiate and document this assessment in writing—without that substantiation, the exclusion is legally vulnerable. When in doubt, it is advisable to seek legal or technical advice before concluding that a system is not high-risk.
What are the most common mistakes organizations make when preparing for the AI Act?
A common mistake is underestimating the scope: many organizations do not realize how many AI components are already embedded in standard software such as HR tools, CRM systems, or customer service platforms. In addition, many organizations wait too long to conduct an inventory, leaving insufficient time to prepare the required documentation and set up processes before the 2025 and 2026 deadlines. A third common mistake is failing to clearly define roles: who is the provider and who is the deployer, and what are their respective responsibilities?
How does the EU AI Act relate to the GDPR (General Data Protection Regulation) we are already familiar with?
The EU AI Act and the GDPR complement each other but overlap in certain areas, particularly regarding the processing of personal data by AI systems. For example, the requirement for deployers to conduct a DPIA for high-risk AI is directly linked to GDPR obligations. In practice, this means that AI compliance and privacy compliance cannot be viewed separately and should preferably be addressed in an integrated manner within a single governance framework. Organizations that already have a mature GDPR process in place can use this as a foundation for their AI Act preparations.
Are there any official guidelines or standards available to assist with implementation?
The EU AI Act refers to harmonized standards that are still being developed by European standardization bodies such as CEN and CENELEC. In addition, the European AI Office is working on codes of conduct, particularly for providers of GPAI models. However, practical tools are already available, such as the European Commission’s AI Act Compliance Checker and sector-specific guidance from regulators. It’s important to actively monitor these developments, as the further elaboration of standards will directly impact how you can comply with the requirements.
What does 'human oversight' mean in concrete terms in the context of the AI Act, and how do I implement it?
Human oversight means that a qualified person has the ability to understand, monitor, correct, or stop the AI system when necessary—and that this is actually carried out in practice, not just on paper. In practice, this means designating employees who are responsible for oversight, training them so they understand the system’s operation and limitations, and establishing procedures for escalating or intervening in the event of unexpected outcomes. For AI systems used in customer interactions or decision-making, it is also important that the supervisor not only has the authority to intervene but also has the time and resources to do so effectively.
