Who needs to comply with the EU AI Act

Where this starts

The question arrives in three forms recorded on the non-EU provider hub, the startup hub and the enterprise hub: whether the Act applies at all without an EU entity or an EU data centre, whether a procurement questionnaire or an investor list is asking for something the Act requires, and which of many built, licensed and vendor-embedded systems carries a duty. Regulation (EU) 2024/1689 answers all three through the same two articles. Art. 2 decides whether an organisation is in scope and through which hook. Art. 3 decides which role it holds, and the role decides which obligations attach. Regulation (EU) 2026/1744 amended Art. 2(2) for products under Annex I Section B and moved the high-risk dates; it left the scope hooks, the exclusions and the role definitions of Art. 3 unchanged.

Art. 2(1) lists seven hooks. Point (a) reaches providers placing on the market or putting into service AI systems or general-purpose AI models in the Union, irrespective of whether the provider is established in the Union or in a third country. Point (b) reaches deployers with their place of establishment or location in the Union. Point (c) reaches providers and deployers in a third country where the output produced by the AI system is used in the Union. Points (d) to (g) reach importers and distributors, product manufacturers placing a system on the market with their product under their own name or trademark, authorised representatives of providers not established in the Union, and affected persons located in the Union. The roles behind those hooks are defined in Art. 3(3) to 3(8): the provider develops the system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark, for payment or free of charge; the deployer uses a system under its own authority outside a personal non-professional activity; the authorised representative holds a written mandate from a provider outside the Union; the importer places a system from a third-country provider on the Union market; the distributor makes a system available without being the provider or the importer; and Art. 3(8) groups all of them, with the product manufacturer, under the term operator. One organisation holds several roles at once across its portfolio, and Art. 25(1) moves a deployer or distributor into the provider role of a high-risk system on three triggers: its own name or trademark on the system, a substantial modification, or a change of intended purpose that makes the system high-risk.

Art. 2(3) to 2(12) remove named cases from the Regulation, each on a condition that the file has to show. Art. 2(3) excludes areas outside the scope of Union law and systems placed on the market, put into service or used exclusively for military, defence or national security purposes. Art. 2(4) excludes public authorities in a third country and international organisations using AI systems under international law-enforcement or judicial cooperation agreements with adequate fundamental-rights safeguards. Art. 2(6) excludes AI systems and models, including their output, specifically developed and put into service for the sole purpose of scientific research and development. Art. 2(8) excludes research, testing and development activity before a system is placed on the market or put into service, and states that testing in real-world conditions is not covered by that exclusion. Art. 2(10) excludes the obligations of deployers who are natural persons using AI systems in a purely personal non-professional activity. Art. 2(12) excludes AI systems released under free and open-source licences unless they are placed on the market or put into service as high-risk AI systems or as systems that fall under Art. 5 or Art. 50; the separate open-source exception for general-purpose AI models sits in Art. 53(2) and is lost where the model carries systemic risk. Art. 2(2), as amended, limits the Act to Art. 6(1) and the listed governance and enforcement articles for high-risk systems related to products under Annex I Section B, whose requirements run through the sectoral legislation. Each exclusion is read on its condition: a research prototype loses Art. 2(8) at the first real-world test, and an open-source system loses Art. 2(12) at the first high-risk or Art. 50 use.

Once an organisation is in scope in a role, four tiers decide what that role carries, and each tier rests on its own article with its own date. Art. 5 prohibits listed practices for any operator; the original points apply from the Chapter II application date, the same date as the Art. 4 literacy duty 2025-02-02In force, and the points on non-consensual intimate imagery and child sexual abuse material inserted by Regulation (EU) 2026/1744 apply from 2026-12-02Deferred. Art. 6 makes a system high-risk as an Annex I product or safety component under Art. 6(1), or as an Annex III use case under Art. 6(2) unless an Art. 6(3) condition applies and the function performs no profiling; the provider then carries Art. 16 with Art. 9 to Art. 17 and the deployer carries Art. 26, from 2027-12-02Deferred for Annex III systems and from 2028-08-02Deferred for Annex I systems. Art. 50 places transparency duties on providers of systems that interact with natural persons or generate synthetic content and on deployers of emotion recognition, biometric categorisation and deep-fake systems, from 2026-08-02In force. Art. 53 to Art. 55 place documentation, copyright, downstream-information and, for systemic risk, evaluation duties on providers of general-purpose AI models under Art. 3(63), from 2025-08-02In force. A system can sit in more than one tier, and a general-purpose AI model integrated into a high-risk system brings both sets to the same organisation. The Act sets no numeric criterion for role or for the Annex III match; the reading of intended purpose and of the Art. 6(3) conditions comes from Commission guidelines on high-risk classificationDraft at the stage the badge shows, and the model criteria from Commission guidelines on GPAI scopePublished. The risk classifier runs the scope, role and tier routes on the published logic from self-reported answers; PR-CLS v1.0 runs them on the intended-purpose materials and the observed behaviour of each function and marks every result as a technical assessment for discussion with counsel.

The sequence

The work runs in the order below: the scope hook, then the exclusions, then the role per system, then the four tiers, then the register and the file.

1. Record the place of establishment per system and check each Art. 2(1) hook against the market and the output location.

   Record System identification record and territorial scope record: place of establishment, placing on the Union market, output used in the Union

   [Regulation (EU) 2024/1689, Art. 2(1)(a) to (g); PR-CLS steps 1 and 11]

2. Test each system against the exclusions of Art. 2(2) to 2(12) and record the condition that removes it or fails.

   Record Scope and role determination memo under Art. 2 and Art. 3, section on exclusions: one row per exclusion with the condition tested and the evidence

   [Regulation (EU) 2024/1689, Art. 2(2), 2(3), 2(4), 2(6), 2(8), 2(10) and 2(12)]

3. Record every Art. 3 role that fits per system, and check each Art. 25(1) trigger on deployed systems.

   Record Role determination record per system with the Art. 25 trigger record

   [Regulation (EU) 2024/1689, Art. 3(3) to 3(8) and Art. 25(1); PR-CLS steps 8 to 10]

4. Check each function against the practices listed in Art. 5(1), including the points inserted by Regulation (EU) 2026/1744.

   Record Prohibited practice check record, one row per function, with the Art. 5(1) point tested

   [Regulation (EU) 2024/1689, Art. 5(1), including the inserted points (ba) and (bb)]

5. Match each function against Annex I and Annex III, and test each match against Art. 6(3) and the profiling rule.

   Record High-risk classification record per function and Art. 6(3) assessment record per Annex III match, with the profiling check and the Art. 6(4) documentation check

   [Regulation (EU) 2024/1689, Art. 6(1), 6(2), 6(3), 6(4) and Annex III; PR-CLS steps 12 to 17]

6. Assign each function to the Art. 50 paragraphs that apply, and record each general-purpose AI model in use.

   Record Article 50 applicability record per function, GPAI determination record per model, and the provider determination record for any modified model

   [Regulation (EU) 2024/1689, Art. 50(1) to (4) and Art. 3(63); PR-CLS steps 19, 27 and 35]

7. Record the measures taken under Art. 4 to support the AI literacy of staff and other persons operating the systems.

   Record AI literacy measures record under Art. 4: the measures taken for staff and other persons operating AI systems on the organisation's behalf

   [Regulation (EU) 2024/1689, Art. 4(1) as amended]

8. Compile one obligation register across the portfolio, with the regulation entry id for each application date.

   Record Obligation register: applicable articles per system and role, regulation entry id per application date, protocol per testable element

   [PR-CLS steps 38 to 41]

9. Write the classification report, mark each determination as a technical assessment for counsel, and index the evidence pack.

   Record Classification and role determination report, counsel note on each determination, and the evidence pack index

   [PR-CLS steps 42 to 44]

Evidence this situation ends with

Each artifact follows a specification with a synthetic sample on the deliverables page: the scope memo and the determination records follow the assessment memo specification, the obligation register and the literacy record follow the register or checklist specification, and the classification report assembles them under the evidence pack specification, so that a general counsel, an investor and an internal auditor read the same layout.

If nothing is done

An organisation that never runs the scope test keeps every duty its role and tier carry. Where a provider or deployer in scope places or uses a system in a tier without the evidence that tier requires, the market surveillance procedure of Art. 79 applies: the authority evaluates the system and, where it finds a non-conformity with the Regulation, requires the operator to take corrective action, to withdraw the system or to recall it within a period the authority sets, under Art. 79(2). A prohibited practice under Art. 5 sits in the highest penalty tier of Art. 99(3); a breach of the provider duties in Art. 16, the deployer duties in Art. 26 or the transparency duties in Art. 50 sits in Art. 99(4); and incorrect, incomplete or misleading information given to an authority sits in Art. 99(5), with the amount in each tier set by the national authority under the Art. 99(7) criteria. For a provider of a general-purpose AI model the Commission holds the request-for-information and fining powers of Art. 101, from 2026-08-02In force. A third-country provider is reached through Art. 2(1)(a) and (c) whether or not it holds an EU entity, and the authorised representative that Art. 22 requires of a high-risk provider outside the Union is a party the authority can address under Art. 22(3). The action that follows is the sequence above: the scope memo, the role and tier records under PR-CLS, the register, then corrective action under Art. 20 for a provider and suspension of use with notification under Art. 26(5) for a deployer.

Services, guides and tools for this situation

The classification and readiness assessment runs PR-CLS v1.0 across the portfolio and delivers the classification memo, the obligation register and the gap list, within the limits stated on what we cannot do: the memo is a technical assessment, and the decision on scope, role and tier remains with the provider or deployer and their counsel.

Obligations

• Art. 9
• Art. 26
• Art. 50
• Art. 53

Services

• Classification and readiness assessment

Guides

• Provider vs deployer under the AI Act
• Guidelines on classification of high-risk AI systems: applying them to one system

Tools

• Risk and role classifier

ICP hubs

• Enterprises
• Startups
• Non-EU providers

Questions

+−Do I need to comply with the EU AI Act?

Regulation (EU) 2024/1689 applies to an organisation that matches a hook in Art. 2(1): a provider placing an AI system or a general-purpose AI model on the Union market wherever it is established, a deployer in the Union, a third-country operator whose output is used in the Union, or an importer, distributor or authorised representative. Art. 2(3) to 2(12) remove military, research, personal non-professional and, on conditions, open-source cases. The Art. 3 role and the tier under Art. 5, 6, 50 or 53 set the obligations.

+−When does the EU AI Act apply?

Regulation (EU) 2024/1689 applies in stages under Art. 113, and each tier carries its own date on the regulation page: the original Art. 5 prohibitions and the Art. 4 literacy duty on the Chapter II date, the general-purpose AI model duties of Art. 53 to 55 on the GPAI date, the Art. 50 transparency duties on the general application date, and the high-risk obligations on the Annex III and Annex I dates that Regulation (EU) 2026/1744 moved. The Omnibus moved dates, not obligations.

+−What do I need to do to comply with the EU AI Act?

The first step under Regulation (EU) 2024/1689 is a recorded determination: the Art. 2(1) hook, the Art. 2(3) to 2(12) exclusions, the Art. 3 role per system, and the tier under Art. 5, 6, 50 or 53. The obligation set follows from role and tier: Art. 16 for a provider of a high-risk system, Art. 26 for its deployer, Art. 50 for interaction and synthetic content, Art. 53 for a model provider, and Art. 4 literacy measures for every provider and deployer. PR-CLS records the determination for counsel.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com