EU AI Act: Requirements, Risk Tiers and Timeline

What is the EU AI Act?

The EU AI Act, formally Regulation (EU) 2024/1689, is the European Union's horizontal law on artificial intelligence. It is sometimes called the EU artificial intelligence act. It entered into force on 1 August 2024 and applies in stages. Rather than regulating the technology as such, it regulates the use of AI systems according to the risk they pose to health, safety and fundamental rights.

The text is published in the Official Journal and can be read on EUR-Lex. The European Commission explains the framework on its regulatory framework for AI page. The European Commission AI Office coordinates oversight of general-purpose AI models, while national market surveillance authorities supervise most other systems.

Does the EU AI Act apply to companies in the UAE?

It can. Under Article 2, the Act applies to providers that place AI systems or general-purpose AI models on the EU market, wherever they are established. It also applies to providers and deployers located outside the EU where the output produced by the AI system is used in the EU. A Dubai software company selling an AI feature to customers in Germany is a provider in scope. A Gulf bank whose scoring model produces decisions that affect people in the EU may also be caught.

The test is not where your servers or head office sit, but whether your system is placed on the EU market or its output is used there. Organisations that serve only UAE or GCC customers are generally outside the Act, although many choose to align with it because EU customers, partners and regulators increasingly ask for it. Scope questions are fact specific, so document your analysis and have it reviewed.

How does the EU AI Act classify risk?

The EU AI Act requirements depend on a four-tier risk model. Your first task is to place each AI system in the right tier.

• Prohibited practices (Article 5). Uses judged to carry unacceptable risk are banned, for example manipulative techniques that cause harm, social scoring, and untargeted scraping of facial images to build recognition databases.
• High-risk systems. Systems used in areas listed in Annex III, such as employment, education, essential services, law enforcement and migration, and AI that is a safety component of products covered by listed EU product legislation. These carry the heaviest obligations.
• Limited risk (transparency, Article 50). Systems that interact with people, generate synthetic content or detect emotions must tell users that AI is involved, and synthetic content must be marked.
• Minimal risk. Everything else, such as spam filters, faces no specific obligations, although voluntary codes of conduct are encouraged.

General-purpose AI models have their own chapter, with duties on documentation, copyright policy and, for models with systemic risk, evaluation and incident reporting.

Who is a provider and who is a deployer?

Obligations follow roles. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. Importers, distributors and authorised representatives have further duties.

Providers of high-risk systems carry most of the burden: risk management, technical documentation, conformity assessment, CE marking and registration. Deployers must use the system according to its instructions, assign human oversight to competent staff, keep logs they control, monitor operation and inform affected people where required. A deployer can become a provider by putting its name on a system, substantially modifying it or changing its intended purpose, so contracts and internal records should state which role applies.

What do Articles 9 to 15 require for high-risk systems?

Section 2 of Chapter III sets the technical requirements for high-risk systems. Each article translates into evidence you will need to produce.

• Article 9, risk management system. A continuous, documented process that identifies, evaluates and mitigates risks across the lifecycle.
• Article 10, data and data governance. Training, validation and testing data must be relevant, representative and examined for bias, with documented provenance.
• Article 11, technical documentation. Drawn up before the system is placed on the market and kept current.
• Article 12, record keeping. Automatic logging of events so that operation can be traced.
• Article 13, transparency. Instructions for use that let deployers interpret outputs and use the system correctly.
• Article 14, human oversight. Design that allows people to understand, monitor and intervene.
• Article 15, accuracy, robustness and cybersecurity. Appropriate and declared performance levels, resilience to errors and protection against attacks such as data poisoning.

Harmonised standards are being developed to give a presumption of conformity with these articles, so follow their progress.

What is the EU AI Act timeline?

The Act applies in phases. Prohibitions and the AI literacy duty applied from 2 February 2025. Obligations for general-purpose AI models applied from 2 August 2025. The general date of application is 2 August 2026, which covers provisions such as the Article 50 transparency duties.

The timeline has since been amended. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk requirements in Articles 9 to 15 to 2 December 2027 for Annex III systems and to 2 August 2028 for high-risk AI covered by Annex I product legislation. It also postponed some other dates, so check the current consolidated text on EUR-Lex before you plan. Whatever the dates, the preparatory work of inventorying systems, classifying them and collecting evidence takes months, which is why an early mapping exercise pays off. Our 90 day mapping guide sets out one practical way to begin.

What are the fines under the EU AI Act?

Penalties are set in Article 99 and scale with the seriousness of the breach. Using a prohibited practice can lead to administrative fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Breaching most other obligations, including those for high-risk systems, can lead to fines of up to EUR 15 million or 3%. Supplying incorrect, incomplete or misleading information to authorities can lead to fines of up to EUR 7.5 million or 1%.

For small and medium enterprises, the lower of the two amounts applies. Fines on providers of general-purpose AI models are set separately in Article 101, up to 3% or EUR 15 million, whichever is higher, and are imposed by the Commission. Member states set the detailed enforcement rules and designate the authorities, so practice may differ between countries.

How Krasper helps

Krasper Technologies is an AI governance and cybersecurity firm based in Meydan, Dubai, serving regulated organisations in the UAE, the GCC and the EU. Our AI governance consulting helps you inventory AI systems, classify them against the risk tiers, decide your role as provider or deployer and plan the evidence each article expects.

Krasper Raigate is a self-hosted AI governance firewall that enforces AI policy, redacts PII and logs governed requests to the database. It supports the record keeping and oversight evidence described above. It does not certify anything or make an organisation compliant, and legal conclusions remain with your counsel and the competent authorities.

Sources

• Regulation (EU) 2024/1689, Official Journal text
• European Commission, regulatory framework for AI
• NIST AI Risk Management Framework, a voluntary companion framework