EU AI Act compliance,
by article.
Eight articles that matter. Four open-source tools that produce the artefacts your auditor opens — verbatim regulation, enforcement dates, penalty bands, in one searchable surface.
Pick an article. See exactly what it asks of you.
Verbatim regulation, enforcement date, penalty band, and the open-source tool that produces the named regulatory artefact — all in one click.
Source: Regulation (EU) 2024/1689 · Official Journal of the European Union
Four bands. One CFO conversation.
Tier 1 lands at €35M or 7% of global turnover for Article 5 prohibitions. The bars are drawn to scale.
Two enforcement dates already passed. Two ahead.
Each dot is a wall of obligations switching on. Hover for what enforces.
Two scope regimes. Different rulebooks.
What counts as high-risk
Eight Annex III categories trigger the full obligations stack — risk management, data governance, technical documentation, accuracy. Article 6(3) carves a narrow exemption pathway; profiling automatically keeps a system in scope.
- 1Biometrics — categorisation and emotion inference outside the Article 5 prohibitions
- 2Critical infrastructure — safety components in road, water, gas, electricity
- 3Education — admission, evaluation, monitoring of prohibited behaviours
- 4Employment — recruitment, promotion, performance evaluation
- 5Essential services — credit scoring, insurance, public benefit eligibility
- 6Law enforcement — risk assessment, evidence reliability, profiling
- 7Migration & borders — visa, asylum, identity verification
- 8Justice & democracy — judicial decision support, election influence
GPAI providers
General-purpose AI obligations sit on a separate enforcement chain — the European Commission, via the AI Office, not Member State authorities. A systemic-risk overlay activates above the 10²⁵ FLOPs threshold (Art. 51(2)).
- 53Baseline obligations — Annex XI technical documentation, downstream-provider information, copyright policy, training-data summary (Art. 53(1)(a)–(d))
- 51Systemic-risk threshold — 10²⁵ FLOPs cumulative training compute (Art. 51(2)); LCC also flags 65B+ parameter models per Art. 53(2)
- 55Systemic-risk obligations — model evaluation, adversarial testing, incident reporting
- 56Codes of practice — voluntary mechanism for demonstrating compliance until standards published
- 101Sanctions — up to €15M or 3%, imposed directly by the Commission
Tools surface problems. Programmes solve them.
The articles above translate into evidence packs an engineering team can ship — risk files, training-data manifests, accuracy benchmarks. The next step (programme design, board narrative, regulator engagement) is the work AskAjay covers, the advisory arm of AI Exponent LLC.
Explore advisory at AskAjay.ai →