Guides & analysis
Plain-English explainers on the EU AI Act — who it affects, what you have to do, and when each obligation takes effect.
Is AI in university admissions high-risk under the EU AI Act?
Usually, yes. AI intended to decide who gets into a university, school or vocational training institution, or to assign admitted people to one, is listed as high-risk in Annex III, point 3(a). In our reading, ranking individual applicants will usually be profiling, which shuts the Article 6(3) way out. Emotion recognition in admission interviews or tests is prohibited, in the Commission's reading of Article 5(1)(f). Scholarships, applicant chatbots and AI-text detectors are less clear-cut. Here is the line, case by case.
Is facial recognition in shops high-risk under the EU AI Act?
Usually, yes. A shop that matches shoppers' faces against a watchlist is using remote biometric identification, listed as high-risk in Annex III, point 1(a). It is not the Article 5(1)(h) ban, which concerns real-time identification for law enforcement, unless the shop runs it on the police's behalf. Untargeted scraping of faces into a database, and biometric categorisation to infer race, religion or similar traits, are prohibited. Here is the line, case by case.
Is AI employee monitoring high-risk under the EU AI Act?
Usually, yes. AI intended to monitor and evaluate the performance and behaviour of workers is listed in Annex III, point 4(b), and scoring individual workers will usually be profiling, which shuts the Article 6(3) exit. Inferring workers' emotions from biometric data is, outside medical or safety uses, not high-risk but prohibited. Here is the line, case by case.
Is AI pricing for health and life insurance high-risk under the EU AI Act?
Yes, in most cases. AI intended for risk assessment and pricing of natural persons in life and health insurance is listed in Annex III, point 5(c), and individual risk scoring will usually be profiling, which shuts the Article 6(3) exit. Motor, home and travel lines are not listed.
Is a customer-service chatbot high-risk under the EU AI Act?
Usually not: customer service is not an Annex III use case. It becomes high-risk if it is used to score creditworthiness, price life or health insurance, assess public-benefit eligibility for an authority, filter job applicants or classify emergency calls. AI disclosure applies either way.
Is AI exam proctoring high-risk under the EU AI Act?
Usually yes. AI that monitors students to detect cheating in tests at an educational or vocational training institution is listed in Annex III, point 3(d). Inferring their emotions is banned.
Is AI tenant screening high-risk under the EU AI Act?
Not by name: Annex III never mentions tenant screening. But a tool that scores an applicant's creditworthiness can fall under point 5(b), and public housing allocation under 5(a). Here is the test.
Deploying AI agents in the EU: which AI Act obligations actually apply to you
The EU AI Act has no separate regime for AI agents. An agent is an AI system, and your obligations depend on what it does and whether you built it or only use it. Here is the map, article by article, with the dates that apply.
Built on an AI model API? Under the EU AI Act, you may have to watermark the output
Under Article 50(2) of the EU AI Act, the marking duty sits with the provider of the AI system — often the company that built the app, not the model lab. You can rely on your model provider's watermark if it meets Article 50(2), but it may be off by default and the burden of showing compliance stays with you.
EU AI Act regulatory sandboxes: what startups get, and when
Every EU country must run an AI regulatory sandbox by 2 August 2027, not 2026. What it gives you: guidance, an exit report, and no administrative fines if you follow the plan and the authority's guidance in good faith.
Do you need a notified body for your high-risk AI system?
For seven of the eight Annex III areas the answer is no — Article 43(2) lets you self-assess. For one Annex III category it can be yes, Annex I Section A products keep their sectoral procedure, and as of 27 September 2026 the Commission's own register listed no notified bodies designated under the AI Act at all. Here is which route you are on.
EU AI Act Article 6(3): when an Annex III system is not high-risk, and the public registration it triggers
Article 6(3) lets a provider conclude that an Annex III AI system is not high-risk. It is a real exit, but it is not a quiet one: it carries a documentation duty and a public entry in the EU database. The Digital Omnibus cut that filing from nine fields to seven in July 2026.
Fine-tuning an AI model: do you become its provider?
Sometimes. The Commission's indicative criterion: modifying a general-purpose AI model with more than a third of its original training compute can make you its provider. It says few modifications may currently meet it.
Article 50 disclosure template: copy-paste texts for the EU AI Act
Ready-to-use disclosure wording for every Article 50 duty — the chatbot notice, AI-generated content and deepfake labels, and the emotion-recognition notice — aligned with the Commission's July 2026 guidelines, with the placement rules that make them compliant.
EU AI Act prohibited practices (Article 5): what is banned, and the business uses that get caught
Article 5 of the EU AI Act has banned eight AI practices since 2 February 2025, and two more arrive on 2 December 2026. Here is the full list in plain English, the qualifiers that decide whether your use is caught, and where common business uses actually land.
EU AI Act deployer obligations: what you owe when you use a high-risk AI system
Most companies will not build high-risk AI — they will buy it. Article 26 sets out what deployers must do, Article 27 decides who needs a fundamental rights impact assessment, and the Digital Omnibus made that assessment easier to combine with a GDPR DPIA.
EU AI Act AI literacy (Article 4): what your company actually has to do
Article 4 is the EU AI Act obligation almost every company already has. The Digital Omnibus softened it in July 2026, and national supervision has been running since early August. Here is what it requires and what counts as compliance.
Is your AI a "safety component" under the EU AI Act?
Article 6(1) makes AI high-risk when it is a safety component of a product under Annex I law. The Digital Omnibus narrowed this twice: it defines what is not a safety component, and moves machinery out of the AI Act's full high-risk regime.
Is there an SME exemption in the EU AI Act? What small companies actually get
There is no size exemption in the EU AI Act — but there are six concessions for SMEs, and the Digital Omnibus added a new 'small mid-cap' tier. Here is what each one gives you, which articles they sit in, and why most of them only help if you build high-risk AI.
Who enforces the EU AI Act? The authorities, and what changed on 2 August 2026
Enforcement of the EU AI Act started on 2 August 2026. Here is who actually enforces it — the AI Office, your national market surveillance authority, and the EDPS — how a complaint reaches them, and why not every Member State is ready.
Is your software an 'AI system' under the EU AI Act?
Only software that meets the Article 3(1) definition is covered. The Commission's guidelines name four kinds of software that can fall outside it, including basic data processing and simple statistical prediction. The test, with examples.
Does the EU AI Act apply to companies outside the EU?
Yes, it can. Establishment is not the test: Article 2(1) catches non-EU providers placing AI on the EU market and non-EU providers and deployers whose AI output is used in the EU. A worked in-or-out table, plus the EU-representative duty.
EN 18286: the first AI Act harmonised standard, explained
Cited in the Official Journal on 14 October 2026. What EN 18286 covers, the presumption of conformity it can give (and what it does not), and how it differs from ISO/IEC 42001.
EU AI Act 2 December 2026 deadline: what changes
Two things land on 2 December 2026: Article 50(2) marking applies to generative AI already on the market before 2 August 2026, and two new Article 5 prohibitions take effect. Who is affected.
Is emotion recognition at work banned under the EU AI Act?
Mostly, yes. Since 2 February 2025, AI that infers employees' emotions from their face, voice or other biometric data is prohibited, except for medical or safety reasons. Where the line actually falls.
What happens if the Commission investigates your AI model?
Implementing Regulation (EU) 2026/1755, in force since 10 August 2026: the access the Commission can demand to a general-purpose AI model, its evaluators, your right to be heard, and a five-year limitation period for fines.
Is AI training mandatory under the EU AI Act?
Short answer: no — the EU AI Act does not mandate a specific AI training course. It requires you to support AI literacy through proportionate measures — and the Digital Omnibus (Regulation (EU) 2026/1744) just made that even clearer. Here is what you actually have to do.
The EU AI Act for fintech: credit scoring and creditworthiness AI
AI that scores creditworthiness is high-risk under the EU AI Act — with one important carve-out for fraud detection. Here is what that means for lenders, credit-scoring providers, and insurers, and when it applies.
The EU AI Act in Germany: KI-MIG and the Bundesnetzagentur
The EU AI Act applies directly in Germany — but Germany still needs its own law to name the authorities and set the fines. That law is the KI-MIG, and the Bundesnetzagentur is the authority to know. Here is what applies and who enforces it.
The EU AI Act for HR & recruitment software
AI used to screen, rank, or manage candidates and employees is high-risk under the EU AI Act. Here is what that means for HR-tech providers and for the employers who deploy them — the obligations, who is responsible, and the (now-deferred) deadline.
EU AI Act fines: how much can your company be penalized?
The EU AI Act's penalties run up to €35 million or 7% of worldwide turnover. Here is the full fine structure — which breaches cost what, who enforces it, the lighter caps for SMEs, and when it all took effect.
EU AI Act Article 50: transparency obligations explained
Article 50 applies from 2 August 2026: tell people they are talking to an AI, mark AI-generated content in a machine-readable way, and label deepfakes. Who must do what, the exceptions, and the 2 December 2026 marking grace period.
Has the EU AI Act high-risk deadline been delayed to 2027?
Yes. The Digital Omnibus moved the high-risk obligations to 2 December 2027 for stand-alone systems and 2 August 2028 for embedded products. What changed, what still applied from 2 August 2026, and what to plan for.
Is your AI system “high-risk” under the EU AI Act?
High-risk is the tier where the EU AI Act's real obligations and largest fines live. Here is the actual test from Article 6 and Annex III — the two ways in, the exception most companies miss, and worked examples.
EU AI Act timeline: every deadline from 2025 to 2028
The EU AI Act doesn't apply all at once. Here is the phased timeline as amended by the Digital Omnibus — prohibitions in 2025, GPAI rules, transparency in 2026, high-risk in December 2027, embedded products in 2028 — and what each date means.
Which EU AI Act obligations apply to your company?
A plain-English guide to working out your EU AI Act obligations: your role (provider, deployer, importer, distributor) and your AI's risk tier decide what you have to do.