← All articlesData protection explained
EU AI Act: Complete obligations overview
All obligations under the AI Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus, sorted by actor, risk class and type, with legal basis, deadline and maximum fine.
In short
- Since 2 February 2025, the prohibitions under Art. 5 and the duty to support AI literacy among staff (Art. 4) apply.
- Since 2 August 2025, the obligations for providers of general-purpose AI (GPAI) models apply. Models already on the market before that date have until 2 August 2027.
- Since 2 August 2026, the transparency obligations under Art. 50 apply, for example to chatbots, deepfakes and AI-generated text. For machine-readable marking, systems already on the market have a transition period until 2 December 2026.
- From 2 December 2026, AI systems for non-consensual intimate deepfakes and for child sexual abuse material are also prohibited.
- Following the Digital Omnibus, Regulation (EU) 2026/1744, the high-risk obligations apply from 2 December 2027 for Annex III systems, for example in recruitment or credit scoring, and from 2 August 2028 for AI in products under Annex I.
- In Germany, the Federal Network Agency (Bundesnetzagentur) has been the central supervisory authority since 29 July 2026 (KI-MIG).
All obligations at a glance
Actor:
Risk class:
Type:
Showing 71 of 71 entries
| # | Obligation / task | Description | Actor | Risk class | Type | Legal basis | Deadline | Fine (max.) |
|---|---|---|---|---|---|---|---|---|
| General obligations: apply regardless of risk class | ||||||||
| 1 | Support AI literacy | Measures that support the AI literacy of staff and other persons operating or using AI systems on the company’s behalf, taking into account prior knowledge, experience, training and context of use. Since the Digital Omnibus (in force since 27 Jul 2026) this is a duty to support: a specific level of literacy no longer has to be guaranteed. | ProviderDeployer | All classes | Organizational | Art. 4 | since 2 Feb 2025 | no specific fine |
| Prohibited practices (Art. 5): since 2 Feb 2025, two new prohibitions from 2 Dec 2026 | ||||||||
| 2 | Prohibition: manipulative or deceptive techniques | AI systems that use subliminal, purposefully manipulative or deceptive techniques to materially distort people’s behaviour in a way that causes, or is reasonably likely to cause, significant harm to them or others. | All | Prohibited | Prohibition | Art. 5(1)(a) | since 2 Feb 2025 | €35m / 7% |
| 3 | Prohibition: exploiting vulnerabilities | AI systems that exploit vulnerabilities due to age, disability or a specific social or economic situation to materially distort behaviour, causing significant harm. | All | Prohibited | Prohibition | Art. 5(1)(b) | since 2 Feb 2025 | €35m / 7% |
| 4 | Prohibition: non-consensual intimate deepfakes (new) | AI systems that generate or manipulate realistic image, video or audio content showing the intimate parts or sexual acts of an identifiable person without their explicit consent. Providers: prohibited if this is the intended purpose or a foreseeable result without effective safeguards. Deployers: prohibited if they use the system for this purpose. Added by the Digital Omnibus. | All | Prohibited | Prohibition | Art. 5(1)(ba), (1a), (1b) | from 2 Dec 2026 | €35m / 7% |
| 5 | Prohibition: child sexual abuse material (new) | AI systems that generate or manipulate child sexual abuse material within the meaning of Directive 2011/93/EU. The same conditions for providers and deployers apply as for the intimate deepfake prohibition. Added by the Digital Omnibus. | All | Prohibited | Prohibition | Art. 5(1)(bb), (1a) | from 2 Dec 2026 | €35m / 7% |
| 6 | Prohibition: social scoring | Evaluating or classifying people over time based on their social behaviour or personal characteristics where this leads to detrimental treatment in unrelated contexts or to unjustified or disproportionate treatment. Applies to public authorities and companies alike. | All | Prohibited | Prohibition | Art. 5(1)(c) | since 2 Feb 2025 | €35m / 7% |
| 7 | Prohibition: predicting crime from profiling alone | Assessing the risk that a person will commit a criminal offence based solely on profiling or personality traits. Supporting a human assessment that is based on objective and verifiable facts remains permitted. | All | Prohibited | Prohibition | Art. 5(1)(d) | since 2 Feb 2025 | €35m / 7% |
| 8 | Prohibition: facial recognition databases via scraping | Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage. | All | Prohibited | Prohibition | Art. 5(1)(e) | since 2 Feb 2025 | €35m / 7% |
| 9 | Prohibition: emotion recognition at work and in education | AI systems that infer people’s emotions in the workplace or in educational institutions. Exception: medical or safety reasons. | All | Prohibited | Prohibition | Art. 5(1)(f) | since 2 Feb 2025 | €35m / 7% |
| 10 | Prohibition: biometric categorisation by sensitive traits | Systems that infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation from biometric data. Exception: labelling or filtering of lawfully acquired datasets, for example in law enforcement. | All | Prohibited | Prohibition | Art. 5(1)(g) | since 2 Feb 2025 | €35m / 7% |
| 11 | Prohibition: real-time remote biometric identification | Use in publicly accessible spaces for law enforcement. Narrow exceptions (searching for victims and missing persons, preventing imminent threats or terrorist attacks, suspects of serious crimes) only with prior authorisation, a fundamental rights impact assessment and registration. | Deployer | Prohibited | Prohibition | Art. 5(1)(h), (2) to (7) | since 2 Feb 2025 | €35m / 7% |
| General-purpose AI models (GPAI, Art. 51 to 56): since 2 Aug 2025 | ||||||||
| 12 | Technical documentation of the model | Draw up and keep up to date documentation on architecture, training, testing and evaluation results, including at least the information in Annex XI (among other things compute and energy consumption), and provide it to the AI Office on request. Compliance can be shown via the GPAI Code of Practice. Exception for open-source models without systemic risk. | Provider | GPAI | Technical | Art. 53(1)(a), (2), (4) + Annex XI | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 13 | Information for downstream providers | Information and documentation for providers integrating the model into their own AI systems, so they understand its capabilities and limitations and can meet their own obligations. Minimum content per Annex XII. Exception for open-source models without systemic risk. | Provider | GPAI | Transparency | Art. 53(1)(b) + Annex XII | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 14 | Copyright compliance policy | A policy to comply with EU copyright law, in particular to identify and respect opt-outs from text and data mining (Art. 4(3) Directive 2019/790). | Provider | GPAI | Organizational | Art. 53(1)(c) | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 15 | Publish a training content summary | A public, sufficiently detailed summary of the content used for training, using the AI Office template. | Provider | GPAI | Transparency | Art. 53(1)(d) | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 16 | Authorised representative in the EU (non-EU providers) | Providers established outside the EU appoint an authorised representative in the EU in writing before placing the model on the market, who among other things keeps the technical documentation available for ten years. Exception for open-source models without systemic risk. | Provider | GPAI | Administrative | Art. 54 | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 17 | Notification to the Commission | If a model meets the threshold for systemic risk (presumed above 10²⁵ floating-point operations in training), the provider notifies the Commission without delay and in any event within two weeks of the threshold being met or becoming foreseeable. | Provider | GPAI + systemic risk | Administrative | Art. 52(1), Art. 51 | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 18 | Model evaluation and adversarial testing (red teaming) | Model evaluation using standardised, state-of-the-art protocols and tools, including documented adversarial testing, to identify and mitigate systemic risks. | Provider | GPAI + systemic risk | Technical | Art. 55(1)(a) | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 19 | Assess and mitigate systemic risks | Assess and mitigate possible systemic risks at EU level, including their sources, that may stem from the development, placing on the market or use of the model. | Provider | GPAI + systemic risk | Organizational | Art. 55(1)(b) | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 20 | Report serious incidents | Track, document and report without undue delay to the AI Office and, where appropriate, national authorities relevant information about serious incidents and possible corrective measures. | Provider | GPAI + systemic risk | Monitoring / reporting | Art. 55(1)(c) | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| 21 | Cybersecurity for the model and infrastructure | Ensure an adequate level of cybersecurity protection for the model and its physical infrastructure. | Provider | GPAI + systemic risk | Technical | Art. 55(1)(d) | since 2 Aug 2025 (legacy models: 2 Aug 2027) | €15m / 3% (Art. 101) |
| High-risk AI, provider obligations: from 2 Dec 2027 (Annex III) or 2 Aug 2028 (Annex I) | ||||||||
| 22 | Document and register an exemption from high-risk classification | Providers who consider a system listed in Annex III not to be high-risk (for example because it only performs a narrow procedural or preparatory task) document this assessment before placing it on the market and still register the system in the EU database. Systems that profile people are always high-risk. The registration duty remains in place after the Digital Omnibus. | Provider | High-risk | Administrative | Art. 6(3), (4), Art. 49(2) | from 2 Dec 2027 (Annex III only) | if misclassified: Art. 99 (Art. 80(7)) |
| 23 | Risk management system | Establish, document and maintain risk management across the entire lifecycle. A continuous process: identify, analyse and evaluate risks, take measures and document residual risks. | Provider | High-risk | Organizational | Art. 9 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 24 | Data and data governance | Training, validation and test data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete; data provenance, preparation and bias examination must be documented. Special categories of personal data may only be processed to detect and correct bias under the strict conditions of the new Art. 4a. | Provider | High-risk | Technical | Art. 10, Art. 4a | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 25 | Technical documentation | Complete technical documentation before placing on the market, containing at least the information in Annex IV and kept up to date. SMEs, start-ups and small mid-caps may use a simplified Commission form. | Provider | High-risk | Technical | Art. 11 + Annex IV | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 26 | Automatic logging | The system must technically allow automatic recording of events over its lifetime so that risks can be identified, operation monitored and incidents traced. | Provider | High-risk | Technical | Art. 12 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 27 | Transparency and instructions for use | The system must be sufficiently transparent for deployers. The instructions for use state, among other things, the provider, performance characteristics, known limitations, input data requirements, human oversight measures and maintenance. | Provider | High-risk | Transparency | Art. 13 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 28 | Enable human oversight (by design) | The system must be designed so that humans can effectively oversee it during operation, override its output and stop it. | Provider | High-risk | Technical | Art. 14 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 29 | Accuracy, robustness, cybersecurity | Appropriate accuracy, resilience against errors and manipulation, and cybersecurity throughout the lifecycle. Systems meeting the Cyber Resilience Act requirements are deemed to meet the cybersecurity requirement. | Provider | High-risk | Technical | Art. 15, Art. 42(3) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 30 | State name and contact address | Indicate name, registered trade name or trade mark and contact address on the system, its packaging or the accompanying documentation. | Provider | High-risk | Administrative | Art. 16(b) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 31 | Quality management system | A documented quality management system covering, among other things, regulatory compliance, design, data management, risk management, post-market monitoring and incident reporting. Its scope is proportionate to company size; SMEs without partner or linked enterprises may implement certain elements in a simplified way. | Provider | High-risk | Organizational | Art. 17, Art. 63 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 32 | Keep documentation for ten years | Keep the technical documentation, quality management records, notified body decisions and EU declaration of conformity available to authorities for ten years after placing on the market. | Provider | High-risk | Administrative | Art. 18 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 33 | Keep logs (at least six months) | Keep automatically generated logs under the provider’s control for at least six months, unless other law (such as data protection law) provides otherwise. | Provider | High-risk | Administrative | Art. 19 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 34 | Conformity assessment | Before placing on the market: internal control for most Annex III systems; for biometric systems (Annex III point 1) possibly involving a notified body. For products under Annex I Section A, the procedure of the relevant product legislation applies. | Provider | High-risk | Administrative | Art. 43 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 35 | Reassessment after substantial modification | After a substantial modification a new conformity assessment is required; technical documentation and declaration of conformity are updated. | Provider | High-risk | Administrative | Art. 43(4) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 36 | EU declaration of conformity | A written statement by the provider that the system meets the requirements, containing the information in Annex V (including provider, system, standards applied, date, signature). Keep it up to date. | Provider | High-risk | Administrative | Art. 47 + Annex V | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 37 | CE marking | Affix the CE marking visibly, legibly and indelibly to the system; digitally for digital systems, otherwise on the packaging or accompanying documentation. | Provider | High-risk | Administrative | Art. 48 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 38 | Registration in the EU database | Register Annex III systems in the EU database before placing them on the market. Systems for critical infrastructure (Annex III point 2) are registered at national level. | Provider | High-risk | Administrative | Art. 49(1), Art. 71 | from 2 Dec 2027 (Annex III only) | €15m / 3% |
| 39 | Corrective actions and duty of information | In case of non-conformity, immediately correct, withdraw, disable or recall the system and inform distributors, deployers, authorised representatives and importers; where there is a risk, also inform market surveillance. | Provider | High-risk | Monitoring / reporting | Art. 20 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 40 | Cooperation with authorities | On reasoned request, provide all information and documentation needed to demonstrate conformity in an easily understood language and grant access to the logs. | Provider | High-risk | Administrative | Art. 21, Art. 16(k) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | up to €50,000 (§ 15 KI-MIG); false information €7.5m / 1% |
| 41 | Authorised representative in the EU (non-EU providers) | Providers established outside the EU appoint an authorised representative in the EU in writing before making the system available, who keeps documents for ten years and cooperates with authorities. | Provider | High-risk | Administrative | Art. 22 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 42 | Change of role: when deployers and distributors become providers | Deployers, distributors, importers or other third parties are treated as providers with all provider obligations if they put their name on a high-risk system, substantially modify it, or change the intended purpose of a system (including a GPAI system) so that it becomes high-risk. | DeployerImporterDistributor | High-risk | Administrative | Art. 25(1) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 43 | Initial provider supports the new provider | After a change of role, the initial provider gives the new provider technical documentation, information on known limitations and failure modes, and targeted technical access. Not required if the initial provider has expressly excluded conversion into a high-risk system. Specified and made subject to fines by the Digital Omnibus. | Provider | High-risk | Organizational | Art. 25(2) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 44 | Written agreement with suppliers | Providers and suppliers of AI systems, models, tools or components used in a high-risk system set out information, technical access and support in a written agreement. Exception: components released under a free and open-source licence, unless they are GPAI models. | Provider | High-risk | Organizational | Art. 25(4) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 45 | Post-market monitoring | Set up a system for monitoring performance in use, based on a plan that is part of the technical documentation. The Commission will publish guidelines with a template for this plan by 2 Sep 2027. | Provider | High-risk | Monitoring / reporting | Art. 72 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | no specific fine |
| 46 | Report serious incidents | Report to the market surveillance authority of the Member State where the incident occurred: within 15 days of becoming aware, within 10 days in case of death, within 2 days for widespread infringements or incidents in critical infrastructure. An incomplete initial report is allowed. | Provider | High-risk | Monitoring / reporting | Art. 73 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | no specific fine |
| High-risk AI, deployer obligations: from 2 Dec 2027 (Annex III) or 2 Aug 2028 (Annex I) | ||||||||
| 47 | Use in line with the instructions | Take technical and organisational measures to use the system in accordance with its instructions for use. Changing the intended purpose can turn a deployer into a provider (Art. 25). | Deployer | High-risk | Organizational | Art. 26(1) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 48 | Assign human oversight | Assign oversight to people with the necessary competence, training and authority, and give them the support they need. | Deployer | High-risk | Organizational | Art. 26(2) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 49 | Check input data | Where input data is under the deployer’s control: ensure it is relevant to the intended purpose and sufficiently representative. | Deployer | High-risk | Technical | Art. 26(4) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 50 | Monitor operation, suspend if risky | Monitor operation on the basis of the instructions for use. If there is a risk, inform the provider or distributor and the market surveillance authority without delay and suspend use. | Deployer | High-risk | Monitoring / reporting | Art. 26(5) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 51 | Report serious incidents | In case of a serious incident, inform first the provider and then the importer or distributor and the competent market surveillance authority without delay. | Deployer | High-risk | Monitoring / reporting | Art. 26(5) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 52 | Keep logs (at least six months) | Keep automatically generated logs under the deployer’s control for at least six months, unless other law provides otherwise. | Deployer | High-risk | Administrative | Art. 26(6) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 53 | Inform workers and their representatives | Employers inform workers’ representatives and the affected workers before a high-risk system is put into service at the workplace. | Deployer | High-risk | Transparency | Art. 26(7) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 54 | Inform affected persons | Deployers of Annex III systems that make or assist decisions about people inform those affected that a high-risk system is being used. | Deployer | High-risk | Transparency | Art. 26(11) | from 2 Dec 2027 (Annex III only) | €15m / 3% |
| 55 | Registration by public bodies | Deployers that are public authorities or EU bodies, or act on their behalf, register their use of Annex III systems in the EU database (except critical infrastructure). Private companies are not subject to this duty. | Deployer | High-risk | Administrative | Art. 26(8), Art. 49(3) | from 2 Dec 2027 (Annex III only) | €15m / 3% |
| 56 | Fundamental rights impact assessment (FRIA) | Before first use of Annex III systems (except critical infrastructure): required for public bodies, private entities providing public services, and deployers of systems for creditworthiness assessment or for risk assessment and pricing in life and health insurance. Notify the result to market surveillance. Since the Digital Omnibus, an existing data protection impact assessment may be referenced; the AI Office is preparing a template questionnaire. | Deployer | High-risk | Organizational | Art. 27 | from 2 Dec 2027 (Annex III only) | up to €50,000 (§ 15 KI-MIG) |
| 57 | Explain decisions on request | Anyone affected by a decision with legal or similarly significant effects based on an Annex III system can request from the deployer a clear explanation of the AI system’s role and the main elements of the decision (except critical infrastructure). | Deployer | High-risk | Transparency | Art. 86(1) | from 2 Dec 2027 (Annex III only) | up to €50,000 (§ 15 KI-MIG) |
| High-risk AI, importer and distributor obligations: from 2 Dec 2027 (Annex III) or 2 Aug 2028 (Annex I) | ||||||||
| 58 | Importer: verify conformity before placing on the market | Verify that conformity assessment, technical documentation, CE marking, declaration of conformity, instructions for use and, where needed, an authorised representative are in place. If in doubt, do not place on the market until conformity is established. | Importer | High-risk | Administrative | Art. 23(1), (2) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 59 | Importer: contact details and record keeping | Indicate name, trade name or trade mark and address on the packaging or documentation; keep the certificate, instructions for use and declaration of conformity for ten years. | Importer | High-risk | Administrative | Art. 23(3), (5) | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| 60 | Distributor: check CE marking and documents | Before making the system available, check for CE marking, declaration of conformity and instructions for use. If in doubt, do not make it available; in case of non-conformity, ensure corrective action and inform the provider or importer. | Distributor | High-risk | Administrative | Art. 24 | from 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I) | €15m / 3% |
| Transparency obligations (Art. 50): since 2 Aug 2026 | ||||||||
| 61 | Disclose AI interaction (e.g. chatbots) | Design systems that interact directly with people so that users are informed they are dealing with an AI, unless this is obvious. The notice must be given clearly and accessibly at the latest at the first interaction. | Provider | Limited risk | Transparency | Art. 50(1), (5) | since 2 Aug 2026 | €15m / 3% |
| 62 | Machine-readable marking of AI-generated content | Providers of systems generating synthetic audio, image, video or text content (including GPAI systems) mark the output in a machine-readable format as artificially generated, for example via watermarks or metadata. Exceptions: purely assistive functions for standard editing, or no substantial alteration of the input. For systems already on the market before 2 Aug 2026, the duty applies from 2 Dec 2026. | Provider | Limited risk | Transparency | Art. 50(2), Art. 111(4) | since 2 Aug 2026; legacy systems from 2 Dec 2026 | €15m / 3% |
| 63 | Notice for emotion recognition and biometric categorisation | Deployers of such systems inform the persons exposed to them and comply with data protection law. Exception: systems permitted by law for law enforcement. | Deployer | Limited risk | Transparency | Art. 50(3) | since 2 Aug 2026 | €15m / 3% |
| 64 | Disclose deepfakes | Anyone using AI to generate or manipulate image, audio or video content constituting a deepfake discloses that it is artificially generated. For evidently artistic, satirical or fictional works, a notice that does not hamper enjoyment of the work is sufficient. | Deployer | Limited risk | Transparency | Art. 50(4), first subpara. | since 2 Aug 2026 | €15m / 3% |
| 65 | Disclose AI text on matters of public interest | Anyone publishing AI-generated text to inform the public on matters of public interest discloses this. Exception: the text has undergone human review or editorial control and a person or company holds editorial responsibility. | Deployer | Limited risk | Transparency | Art. 50(4), second subpara. | since 2 Aug 2026 | €15m / 3% |
| Penalties and fines (Art. 99, 101 AI Act, § 15 KI-MIG) | ||||||||
| 66 | Fine: prohibited practices | Infringements of Art. 5: up to €35m or 7% of worldwide annual turnover, whichever is higher. | All | Prohibited | Sanction | Art. 99(3) | since 2 Aug 2025 | €35m / 7% |
| 67 | Fine: operator obligations and transparency | Infringements of the obligations of providers (Art. 16), authorised representatives (Art. 22), importers (Art. 23), distributors (Art. 24), operators along the value chain (Art. 25(2), (4)), deployers (Art. 26) and of the transparency obligations (Art. 50): up to €15m or 3%. | All | All classes | Sanction | Art. 99(4) | since 2 Aug 2025 | €15m / 3% |
| 68 | Fine: incorrect information to authorities | Incorrect, incomplete or misleading information to notified bodies or authorities: up to €7.5m or 1%. | All | All classes | Sanction | Art. 99(5) | since 2 Aug 2025 | €7.5m / 1% |
| 69 | Fine: GPAI model providers | The European Commission can fine GPAI providers for intentional or negligent infringements up to €15m or 3%. | Provider | GPAI | Sanction | Art. 101 | since 2 Aug 2026 | €15m / 3% |
| 70 | Additional German fines (KI-MIG) | The German implementing act provides for fines of up to €50,000, among other things for a missing fundamental rights impact assessment (Art. 27), a missing explanation (Art. 86) or failure to cooperate with authorities (Art. 21). The Federal Network Agency (Bundesnetzagentur) is the central market surveillance authority. | All | High-risk | Sanction | § 15 KI-MIG | since 29 Jul 2026 | up to €50,000 |
| 71 | Caps for SMEs, start-ups and small mid-caps | SMEs and start-ups: the lower of the fixed amount and the turnover percentage applies. Small mid-caps: the same, but only for fines under Art. 99(4) and (5). Authorities must also take the economic viability of smaller companies into account. | All | All classes | Sanction | Art. 99(1), (6), (6a) | since 2 Aug 2025 | lower amount |
Fine (max.): fixed amount or share of worldwide annual turnover, whichever is higher; for SMEs and start-ups whichever is lower. “No specific fine” means the obligation is not subject to its own fine under Art. 99(3) to (5) AI Act or § 15 KI-MIG. Authorities can still order measures.
EU AI Act: obligations overview | Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 | Not legal advice; for orientation only.
Sources
Author
Sebastian Schenk
Co-Founder & CEO
Lawyer and data protection officer. Drives product vision at simply Legal and ensures Dieter is sound legally and in practice.
This article reflects the position at the date of publication. We update our content when the law changes.