EU AI Act Compliance: GPAI Penalties in Force, High-Risk Rules From December 2027

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive AI regulation. It entered into force on 1 August 2024 and applies in stages: 2 February 2025 (AI literacy + prohibited practices), 2 August 2025 (GPAI obligations + governance), 2 August 2026 (general application, transparency, and penalties for GPAI providers), 2 December 2027 (Annex III high-risk AI), and 2 August 2028 (high-risk AI embedded in Annex I products). The last two dates were set by Regulation (EU) 2026/1744. It applies to any organization that provides or uses AI in the EU market.

It applies to any organization that develops, provides, or uses AI systems in the EU market, whether or not it is headquartered in Europe. It does not distinguish by sector or size: an SME using a chatbot, a bank running credit scoring, or a US company with European customers are all in scope. Specific obligations vary by your role (provider or deployer) and the system's risk level, but AI literacy (Art. 4) applies across the board.

On 2 August 2026, penalties for providers of GPAI models became applicable (their obligations have applied since 2 August 2025), along with the Art. 50 transparency obligations, such as telling people they are talking to an AI. The requirements for Annex III high-risk AI (risk management, data quality, technical documentation, human oversight, and robustness), originally due on that date, were postponed to 2 December 2027 by Regulation (EU) 2026/1744. High-risk AI embedded in Annex I products moves to 2 August 2028.

The fines exceed the GDPR: up to €35M or 7% of global annual turnover (whichever is higher) for prohibited practices. For most other violations, including high-risk and GPAI provider obligations: up to €15M or 3%. For supplying incorrect or misleading information to authorities: up to €7.5M or 1%. For SMEs and start-ups, the lower of the two amounts applies.

It is an AI system that, under Annex III, may affect people's safety or fundamental rights. This includes AI in HR recruitment and management (CV filtering, performance evaluation), credit and insurance scoring, administration of justice, border control, critical infrastructure, education (admissions, assessments), and healthcare (diagnosis, triage). If your AI influences decisions that affect people's rights, it is likely high-risk.

A general-purpose AI (GPAI) model is a large-scale model trained to perform many different tasks, such as GPT, Claude, or Gemini. Their providers have had obligations since 2 August 2025 (technical documentation, transparency, copyright compliance), and the associated penalties have applied since 2 August 2026. If your company integrates one of these models via API, you are a deployer and have your own obligations, even though you are not the model provider.

Even if you only use third-party AI (ChatGPT, Copilot, a chatbot, an HR tool), you are a deployer and already have obligations. Since 2 February 2025 you must take AI literacy measures for your team (Art. 4) and avoid prohibited practices. If the system is high-risk, you add human oversight, transparency, and impact assessment. These obligations cannot be delegated to the model provider. Check which ones apply to you in two minutes with our EU AI Act self-assessment.

It is the obligation, in force since 2 February 2025, for every organization that uses or oversees AI systems to take measures so its staff understand AI: what it is, how it works, its risks, and its responsible use. Since Regulation (EU) 2026/1744 it is an obligation of means: it does not require a specific level for each person, nor does it require documentation. Even so, we recommend tailoring the training to each role and keeping a record of it so you can prove it. It is the first obligation that affects virtually every company, whether it develops AI or not.

Start by knowing what you have: our EU AI Act self-assessment places you in two minutes, free. For the full inventory, our AI Compliance Diagnostic inventories all your AI systems, classifies them by risk level under the regulation, detects the gaps against the regulation, and delivers a prioritized action plan in 2-3 weeks. From there you know exactly what to do and in what order, without spending ahead of time. If you want to go deeper into architecture, we pair it with AI consulting.

This page has the up-to-date timeline, with the dates set by Regulation (EU) 2026/1744, and links to the official texts on EUR-Lex. To see which obligations apply to you, take our EU AI Act self-assessment: ten questions and an indicative result. If you prefer something applied to your own case, the AI Compliance Diagnostic gives you your organization's real status against the regulation.