What Is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive, horizontal law governing artificial intelligence. It entered into force on 1 August 2024 and regulates AI not by sector but by risk: the higher the potential harm an AI system poses to health, safety, or fundamental rights, the stricter the obligations placed on it. The Act applies to providers and deployers of AI systems used in the EU - including organizations based outside the EU whose AI outputs are used within it - making it, like the GDPR before it, a de facto global standard.

The AI Act matters because it converts the broad idea of "responsible AI" into binding legal requirements with real penalties. It establishes what AI may never be used for, what high-stakes AI must prove before it reaches the market, and what every AI system must disclose to the people interacting with it. For any organization building or deploying AI, it turns governance from a voluntary good practice into a compliance obligation - and the foundation of that compliance is being able to document and govern the data behind every model.

EU AI Act Defined

The AI Act is a regulation - directly applicable across all EU member states without needing national transposition. It defines an "AI system" broadly, in terms aligned with the OECD definition, and assigns obligations based on the role an organization plays: provider (develops or places an AI system on the market), deployer (uses an AI system under its authority), and to a lesser degree importers and distributors. Most of the heavy obligations fall on providers of high-risk systems.

The defining characteristics of the Act:

• Risk-based, not technology-based - The same algorithm can be unregulated in one use and high-risk in another. What matters is the context and potential for harm, not the technique.
• Extraterritorial reach - It applies to non-EU organizations whose AI systems or outputs are used in the EU.
• Horizontal scope - It cuts across every sector rather than regulating, say, only healthcare or finance AI.
• Fines above the GDPR's - The top tier reaches €35 million or 7% of worldwide annual turnover, against the GDPR's €20 million or 4%. For most organizations whichever is higher applies; for SMEs, including start-ups, whichever is lower (Article 99(6)).

The Four Risk Tiers

The Act sorts AI systems into four levels of risk, each with a different regulatory burden.

1. Unacceptable risk - prohibited

Article 5 of the original text bans eight practices outright because they are judged incompatible with EU values: manipulative or deceptive techniques that cause significant harm, exploitation of vulnerabilities linked to age, disability, or social or economic situation, social scoring by any actor, public or private, predicting an individual's risk of committing a crime based solely on profiling, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools, biometric categorization to infer sensitive traits such as race or political opinions, and real-time remote biometric identification in public spaces for law-enforcement purposes, subject to narrow exceptions. These prohibitions were the first provisions to apply, on 2 February 2025. The Digital Omnibus on AI adds two more from 2 December 2026: AI systems that generate non-consensual intimate material or child sexual abuse material.

2. High risk - strict obligations

AI reaches the high-risk tier by two routes. Under Article 6(1) and Annex I, AI that is a safety component of a product covered by EU product-safety law, such as a medical device or machinery, is high risk when that product needs third-party conformity assessment. Under Annex III, AI used in listed consequential areas - employment and hiring, access to credit and essential services, education, critical infrastructure, law enforcement, migration, and the administration of justice - is "high risk" too. It is not banned, but it must meet a substantial set of obligations before and after it reaches the market. This is where most of the Act's compliance work lives.

3. Limited risk - transparency duties

Systems that interact with people or generate content carry transparency obligations: users must be told they are dealing with a chatbot, and AI-generated or manipulated content (deepfakes) must be labeled as such. These Article 50 duties apply from 2 August 2026. The aim is informed interaction, not pre-market approval.

4. Minimal risk - no specific obligations

The vast majority of AI - spam filters, recommendation engines, game AI - falls here. It carries no specific obligations under the Act beyond the AI literacy provision of Article 4, which applies to providers and deployers of any AI system, though voluntary codes of conduct are encouraged.

High-Risk Obligations

For high-risk systems, providers must build and maintain a compliance program that spans the entire AI lifecycle. The core obligations are:

• Risk management system - A continuous process to identify, evaluate, and mitigate risks across the system's lifecycle.
• Data and data governance (Article 10) - Training, validation, and testing datasets must be relevant, sufficiently representative, and as free of errors as possible, and examined for bias. This is an explicit data quality and governance mandate.
• Technical documentation - Detailed documentation demonstrating compliance, kept up to date.
• Record-keeping (logging) - Automatic logging of events for traceability throughout the system's operation.
• Transparency & information to deployers - Clear instructions so deployers can use the system correctly.
• Human oversight - The system must be designed so people can effectively oversee it.
• Accuracy, robustness & cybersecurity - Appropriate levels maintained throughout the lifecycle.
• Conformity assessment & registration - High-risk systems undergo a conformity assessment before going to market, and Annex III high-risk systems are registered in the EU database (Articles 49 and 71).

GPAI & the Timeline

General-purpose AI (GPAI) models - foundation models and large language models that can be adapted to many tasks - are governed under their own regime. All GPAI providers face transparency and documentation obligations, including a summary of training-data content and a copyright policy. Models deemed to pose "systemic risk" (identified largely by very high training compute) carry additional obligations around evaluation, risk mitigation, and incident reporting.

The Act applies in phases rather than all at once. As amended by the Digital Omnibus on AI, the schedule is:

• 1 August 2024 - Entry into force.
• 2 February 2025 - Prohibitions on unacceptable-risk AI and AI-literacy obligations begin to apply.
• 2 August 2025 - GPAI model rules and governance/penalty provisions apply.
• 2 August 2026 - Most remaining rules apply, including the Article 50 transparency duties.
• 2 December 2026 - The two new prohibitions apply, and generative AI systems placed on the market before 2 August 2026 must meet the Article 50(2) marking duty.
• 2 December 2027 - High-risk obligations for Annex III systems apply.
• 2 August 2028 - High-risk obligations for AI embedded in Annex I regulated products apply.

The two high-risk dates were originally 2 August 2026 and 2 August 2027. Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved them after the Council gave its final green light on 29 June 2026, largely because the harmonised standards needed to comply were not ready. It was adopted on 8 July 2026 and entered into force on 27 July 2026. It also softened the AI literacy provision of Article 4, from ensuring a sufficient level of AI literacy to taking measures to support it, and extended SME reliefs to small mid-cap companies. For the full picture of the changes, see our blog: The AI Omnibus - What Changed in the EU AI Act.

Data Governance Under the AI Act

Strip the AI Act down to its operational core and much of it is a data governance mandate. Article 10's requirement that high-risk training data be relevant, representative, error-checked, and examined for bias cannot be met without knowing what data trained a model, where it came from, and whether it is fit for purpose. The documentation, logging, and traceability obligations are, in practice, requirements to produce governance evidence on demand.

This is where governance tooling becomes compliance infrastructure:

• A data catalog and metadata management provide the inventory of what data exists and how it is used - the starting point for any AI documentation.
• Data lineage, especially column-level lineage, answers "what data trained this model, and what would change if a source changed?" - the backbone of traceability and impact analysis.
• Data classification and quality controls demonstrate that datasets were examined for representativeness, bias, and errors as Article 10 demands.

Dawiso's broader role in this is the subject of its AI governance solution and the related concept of AI governance: turning the catalog, glossary, and lineage your organization already maintains into the documented, auditable evidence the AI Act requires. Compliance is not a separate project bolted onto AI - it is governed data, made provable.

Conclusion

The EU AI Act is the moment AI governance stopped being optional. By tying obligations to risk and backing them with fines whose top tier exceeds the GDPR's, it forces organizations to treat the data behind their AI as a regulated asset - documented, traceable, quality-checked, and governed. The technical requirements are demanding but tractable; the organizations that struggle will be those that cannot answer basic questions about their own data. The ones that already govern their data well will find that AI Act compliance is, to a surprising degree, governance they have already done.

Sources

• Publications Office of the EU (EUR-Lex), Regulation (EU) 2024/1689, the Artificial Intelligence Act (risk tiers, the Article 5 prohibitions, Article 6 and Annexes I and III, Article 10 data governance, registration in Articles 49 and 71, Article 50 transparency, GPAI rules, and fines in Article 99).
• Publications Office of the EU (EUR-Lex), Regulation (EU) 2026/1744, the Digital Omnibus on AI (the revised high-risk dates, the two new prohibitions, the Article 50(2) transition, the amended Article 4, and SME and small mid-cap relief).
• European Commission, AI Act - regulatory framework for AI (overview of the risk-based approach and application dates).
• Council of the EU, Artificial intelligence: Council gives final green light to simplify and streamline rules (29 June 2026 press release).
• OECD.AI, OECD AI Principles (the OECD definition of an AI system the Act aligns with).
• Publications Office of the EU (EUR-Lex), Regulation (EU) 2016/679, General Data Protection Regulation (the €20 million or 4% fine ceiling in Article 83, for the comparison).