EU AI Act 2026: What Every Business Needs to Do Before the August Deadline

The 4-tier risk pyramid explained

The Act’s core architecture is a four-tier risk classification. Your obligations are entirely determined by which tier your AI systems fall into. Here is the complete picture, including maximum fines and effective dates.

High-risk AI: what you must do before August 2026

If any of your AI systems falls under Annex III of the Regulation — covering recruitment, credit, education, critical infrastructure, law enforcement, immigration, and justice — the following obligations are mandatory and non-negotiable before 2 August 2026.

Mandatory requirements for high-risk AI deployers:

• Risk management system: Establish, implement, document, and maintain a continuous risk management process throughout the AI system’s lifecycle (Art. 9).
• Data governance: Ensure training, validation, and testing datasets are relevant, representative, and free from biases that could lead to discriminatory outcomes (Art. 10).
• Technical documentation: Maintain detailed documentation covering system purpose, performance metrics, architecture, training data sources, and foreseeable risks before market placement (Art. 11).
• Logging & audit trails: Enable automatic logging of events to ensure traceability and post-deployment monitoring. Logs must be retained for a minimum of six months (Art. 12).
• Human oversight: Design and deploy the system so that natural persons can effectively oversee, understand, intervene, and override AI outputs (Art. 14).
• Conformity assessment: Complete a conformity assessment procedure demonstrating compliance before use. For most Annex III systems, this is a self-assessment; for biometric identification systems, a third-party notified body is required (Art. 43).
• EU AI database registration: Register the high-risk AI system in the publicly accessible EU AI database (euaidb.eu) before deployment (Art. 49).

GPAI models (ChatGPT, Gemini, Claude): what are your obligations as a deployer?

General Purpose AI (GPAI) models — large foundation models like GPT-4o, Gemini 1.5 Pro, or Claude — are subject to their own dedicated obligations under Chapter V of the Act (Arts. 51–56). These applied from 2 August 2025.

As a deployer of GPAI models (i.e., you integrate them into your product or workflow via API), your obligations fall into two categories depending on how you use the model:

The practical implication: every integration of ChatGPT, Gemini, Claude, or any other GPAI model into a business workflow requires a documented classification decision. Do not assume that using a commercial API automatically means you have no obligations — the Act explicitly places obligations on deployers.

How to audit your AI stack in 6 steps

Based on IgeraRegTech’s experience classifying 120+ AI use cases for European clients, we recommend structuring your EU AI Act audit as six sequential, documented steps.

Where does RAG-based AI like IgeraRegTech fit in the risk pyramid?

Retrieval-Augmented Generation (RAG) tools — AI systems that answer questions by retrieving and synthesising content from a defined, grounded document corpus — are among the most frequently misclassified AI systems in compliance audits. Here is the correct analysis under the Act.

A RAG-based compliance intelligence tool like IgeraRegTech operates as follows: a user asks a regulatory question in natural language; the system retrieves the most relevant passages from indexed legal texts, contracts, or technical documentation; it then synthesises a cited response grounded exclusively in those source documents. No autonomous decisions are made about individuals’ rights, access to services, employment, or credit.

Under the EU AI Act risk pyramid, this architecture falls into the limited-risk (transparency) tier — not high-risk — because:

• It does not make or influence access decisions for individuals (no HR screening, no credit scoring).
• It explicitly discloses AI identity at the point of interaction.
• Responses are grounded in cited source documents, eliminating hallucination of legal obligations.
• Human review of all generated compliance outputs is built into the workflow — the tool supports human decision-making, it does not replace it.

The key design principle: RAG tools are classified by what decisions they support, not merely by the fact that they use an LLM. IgeraRegTech’s architecture was designed from the outset with EU AI Act tier-classification in mind — document-grounded, human-in-the-loop, transparent, with no autonomous rights determinations.

Frequently asked questions: EU AI Act 2026

Does the EU AI Act apply to non-EU companies?

Yes, unconditionally. The EU AI Act has explicit extraterritorial scope. If your AI system is placed on the EU market, put into service in the EU, or generates outputs that are used within the EU — the Act applies in full, regardless of where your company is incorporated, headquartered, or where your servers are located. This is identical in structure to GDPR’s territorial scope under Art. 3. US, UK, and Asian technology companies deploying AI products to European customers must comply.

Is using ChatGPT or Gemini subject to the EU AI Act?

Yes — both as a GPAI model provider obligation and as a deployer obligation. OpenAI and Google (as providers of GPAI models) must comply with Chapter V transparency requirements since August 2025. But as a deployer who integrates ChatGPT or Gemini into your business workflows — particularly for consequential decisions — you have independent obligations. If your integration constitutes a high-risk AI system (e.g., AI-assisted CV review), the full Annex III obligations apply to you as deployer, even though you did not build the underlying model.

What counts as “high-risk” AI under the Act?

High-risk AI systems are those listed in Annex III: AI used in recruitment and employment decisions (CV screening, performance assessment), credit scoring, access to essential services (insurance, utilities), education and training (student assessment, test scoring), critical infrastructure management, law enforcement, border control and immigration, administration of justice, and certain biometric identification systems. The defining criterion is whether the AI system significantly affects individuals’ fundamental rights, safety, or access to important services.

How does the EU AI Act interact with GDPR?

They are complementary and cumulative. GDPR governs the lawfulness of personal data processing; the EU AI Act governs the AI system itself. High-risk AI systems that process personal data must comply with both frameworks simultaneously. Importantly, a GDPR Data Protection Impact Assessment (DPIA) does not substitute for the EU AI Act conformity assessment — they are separate obligations with separate documentation requirements. High-risk AI systems affecting rights of data subjects will also trigger mandatory DPIAs under GDPR Art. 35.

Does a property management chatbot qualify as high-risk?

No — under standard deployment conditions, a property management chatbot that answers factual questions about community regulations, maintenance procedures, or statutory obligations does not fall under Annex III high-risk categories. It classifies as limited risk (transparency tier). The mandatory obligation is to clearly inform users they are interacting with an AI system. Provided the system does not make autonomous decisions about residents’ legal rights or financial obligations, and responses are grounded in verified documents rather than hallucinated, it remains in the limited-risk tier.

What is a conformity assessment for high-risk AI?

A conformity assessment (Art. 43) is the process by which a provider or deployer demonstrates that a high-risk AI system meets all applicable requirements of the EU AI Act before it is placed on the market or put into service. For most Annex III systems, this is a self-assessment procedure resulting in a declaration of conformity and technical documentation. For specific high-risk systems in biometric identification, a third-party notified body must conduct or verify the assessment. The conformity assessment must be reviewed and updated whenever the AI system undergoes significant changes.