Executive briefing: EU AI Act
The EU AI Act: A Summary for Boards, with the Timeline and Risk Categories
The EU AI Act is the European Union's law on artificial intelligence, Regulation (EU) 2024/1689. It sorts AI by risk into four tiers, from banned to minimal. Bans, general-purpose AI rules and transparency duties already apply. After the 2026 Digital Omnibus, most high-risk obligations apply from 2 December 2027, and it reaches UK and US companies.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- The EU AI Act regulates AI by risk: banned, high, limited (transparency) and minimal.
- Bans (February 2025), general-purpose AI rules (August 2025) and Article 50 transparency (August 2026) already apply.
- The Digital Omnibus moved most high-risk obligations to 2 December 2027, and to 2 August 2028 for AI in regulated products.
- It reaches UK and US companies whose AI, or its output, is used in the EU.
- The use, not the product, decides the obligation. The same tool can be minimal risk in one team and high-risk in another.
Why the board should care
Fines at board scale
Up to EUR 35 million or 7% of worldwide annual turnover for banned practices, and up to EUR 15 million or 3% for most other breaches (Article 99).
Parts are already live
Boards waiting for 2027 are already exposed on the bans, AI literacy and transparency duties in force today.
High-risk takes time
A high-risk system found late in 2027 may need to be rebuilt, re-procured or switched off before the deadline.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
- Who it applies to, and who it does not
Next step
Find out where your AI exposure sits
The AI Readiness Assessment (£999 + VAT) scores your business across 30 areas, including governance and risk, with a prioritised roadmap and a 60-minute debrief. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
What is the EU AI Act in simple terms?
It is the European Union's law on artificial intelligence, Regulation (EU) 2024/1689. It bans a small set of harmful AI practices, sets strict controls for high-risk uses such as recruitment and credit, requires transparency for chatbots and AI-generated content, and leaves most other AI largely unregulated beyond AI literacy.
What is the EU AI Act timeline?
In force 1 August 2024. Bans and AI literacy from 2 February 2025; general-purpose AI rules from 2 August 2025; Article 50 transparency from 2 August 2026. After the 2026 Digital Omnibus, Annex III high-risk AI applies from 2 December 2027 and AI in regulated products from 2 August 2028.
Is the EU AI Act in force in 2026?
Yes. The Act has been in force since 1 August 2024. By 2026 the bans, AI literacy, general-purpose AI rules and penalty regime applied, and Article 50 transparency duties started on 2 August 2026. Only the high-risk obligations were moved, to December 2027 and August 2028.
What are the four risk levels in the EU AI Act?
Unacceptable risk, which is banned; high risk, which carries strict obligations such as risk management and human oversight; limited risk, which carries transparency duties; and minimal risk, with no specific duties beyond AI literacy. The tier depends on how the AI is used, not on the product.
What are the EU AI Act high-risk categories?
Annex III lists areas such as biometrics, critical infrastructure, education, employment and recruitment, access to essential services including credit and insurance, law enforcement, migration, and justice. AI that is a safety component of products regulated under Annex I, such as machinery and medical devices, is also high-risk.
Does the EU AI Act apply to UK companies?
It can. The Act applies to companies outside the EU that place AI on the EU market, or whose AI output is used in the EU. A UK company selling AI-enabled products or services to EU customers can be in scope without an EU office. Brexit does not change this.
What are the fines under the EU AI Act?
Up to EUR 35 million or 7% of worldwide annual turnover for banned practices, up to EUR 15 million or 3% for most other breaches, and up to EUR 7.5 million or 1% for misleading authorities. The higher figure applies, except for SMEs, where the lower figure applies.
What should boards do about the EU AI Act?
Find every AI system in use, classify each by risk tier and role, fix the duties that already apply, plan each high-risk system for December 2027, and name an accountable board owner with a quarterly report. Start with a register: most organisations use more AI than they think.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This page is general information about the EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744, correct at the date last reviewed. Governance guidance, not legal advice. AIPEX is not a certification body. For decisions about specific AI systems, take advice from a qualified lawyer.