The EU AI Act, explained for teams building with AI

The AI Act sets harmonised rules for AI systems placed on the market or used in the EU. Like GDPR, it reaches companies outside the EU when their AI systems, or the output of those systems, are used in the EU.

It separates roles. Providers develop an AI system, or have one developed, and place it on the market under their name. Deployers use an AI system in a professional setting. Most obligations sit with providers, but deployers have duties too.

General-purpose AI models, such as the large language models behind many chatbots, have a separate set of rules for the companies that provide them.

The high-risk dates were moved back by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026. It is a delay, not a cancellation. AI systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking to the content they generate.

• A risk management system across the whole life cycle (Article 9).
• Data governance: training data that is relevant, representative and examined for bias (Article 10).
• Technical documentation (Article 11) and automatic logging (Article 12).
• Transparency and instructions for use for deployers (Article 13).
• Human oversight that lets people understand, intervene in and override the system (Article 14).
• Accuracy, robustness and cybersecurity (Article 15).
• A quality management system (Article 17), a conformity assessment and registration before the system reaches the market.

Deployers of high-risk systems must use them according to their instructions, assign human oversight, monitor them and keep their logs. Some deployers must also carry out a fundamental rights impact assessment (Article 27).

The higher of the two amounts applies, except for SMEs and startups, where the lower one does.

• No inventory of the AI systems in use and their risk level.
• Chatbots and AI features that do not tell users they are AI.
• No human oversight designed in for AI that makes or supports decisions about people.
• Training data with undocumented sources or no bias checks.
• No technical documentation or logging for systems that may be high-risk.

The free SwaSec EU AI Act assessment asks 12 questions across 5 domains and takes about 8 minutes. It scores where you stand and ties each gap to the clause, control or article it relates to.

• AI System Classification (Art. 5-6). Risk classification of AI systems and prohibited AI practices.
• High-Risk AI Requirements (Art. 8-15). Mandatory requirements for high-risk AI systems covering risk management, data governance, documentation, transparency, human oversight, and robustness.
• Transparency for All AI (Art. 50). Transparency obligations applying to all AI systems, including chatbots and AI-generated content.
• General-Purpose AI Models (Art. 51-56). Obligations for providers and deployers of general-purpose AI models including foundation models and LLMs.
• Governance and Compliance (Art. 16-27). Quality management systems, provider obligations, and deployer obligations for high-risk AI systems.

Start the EU AI Act assessment. It is a self-assessment, not an audit or a certification.

EU AI Act shares 4 areas with the other frameworks SwaSec covers. Where it can, the assessment asks a shared area once, and the answer counts toward each framework.

• Risk Assessment, shared with ISO 27001, ISO 42001, SOC 2 and GDPR. Asked separately, because each framework wants something different.
• Data Governance, shared with ISO 42001 and GDPR. Asked separately, because each framework wants something different.
• Human Oversight of AI, shared with ISO 42001. Asked once.
• Transparency, shared with GDPR. Asked separately, because each framework wants something different.

• Regulation (EU) 2024/1689, EUR-Lex

This guide is general information, not legal advice. Last updated 1st October 2026.