EU AI Act (Regulation 2024/1689)

What Is the EU AI Act?

Regulation (EU) 2024/1689, simply known as the EU AI Act, is a landmark regulation that establishes the first-ever comprehensive legal framework for governing the development, deployment, and use of artificial intelligence (AI) systems within the EU market. The Act follows a risk-based classification approach, organizing AI systems into four tiers based on level of risk:

The Act broadly applies to providers, deployers, importers, and distributors of AI systems, including non-EU organizations whose systems or outputs affect individuals in the EU or are placed on the EU market. The law protects natural persons who interact with or are affected by AI systems, emphasizing fundamental rights, health, safety, and non-discrimination.

A significant development occurred on 7 May 2026, when the European Parliament and the Council of the EU reached a provisional political agreement on the Digital Omnibus on AI. The Digital Omnibus is a simplification package proposed by the European Commission that also expands Article 5 to introduce two new prohibited practices:

• AI systems that generate or manipulate non-consensual intimate imagery
• AI systems that generate or manipulate child sexual abuse material

Once formally adopted and published, the agreement will defer the compliance deadline for high-risk AI systems under Annex III to 2 December 2027. Notably, Article 50, which covers transparency obligations regarding chatbots, deepfakes, and AI-generated content, was not deferred and remains applicable as of 2 August 2026.

Who Is Responsible for the EU AI Act?

The primary enforcement body for general-purpose AI models and systemic risk models is the European AI Office, established within the European Commission. Enforcement for all other AI systems sits with the national competent authorities of each EU member state, which were required to be designated by 2 August, 2025.

The AI Board, composed of member state representatives, coordinates the consistent application of the Act across the EU. Where an AI system also processes personal data, Data Protection Authorities may exercise parallel jurisdiction under the GDPR.

Where the legal system of a member state so requires, fines may be imposed by national courts rather than administrative authorities. In all cases, enforcement powers under Article 99 are subject to effective judicial remedies and due process in accordance with Union and national law.

What Are the Possible Penalties Under the EU AI Act?

The Act establishes a three-tier administrative fine structure under Article 99. Fines are calculated as the higher of a fixed euro amount or a percentage of global annual turnover, meaning the penalty scales within an organization’s economic size. For SMEs and startups, fines are capped at the lower of the fixed euro or percentage amount.

Violations of prohibited practices under Article 5 carry fines of up to 35 million euros or 7% of global annual worldwide turnover. Non-compliance with high-risk AI and GPAI obligations carries fines of up to 15 million euros or 3% of global annual turnover. Providing incorrect, incomplete, or misleading information carries fines of up to 7.5 million euros or 1% of global annual turnover. 

What Does the EU AI Act Require?

An organization’s compliance obligations under the Act depend on its role in the AI value chain and the risk classification of its AI systems. For high-risk AI systems under Annex III, requirements include:

For general-purpose AI models, providers must maintain technical documentation and publish summaries of the training data used. GPAI providers whose models meet the systemic-risk threshold (>10^25 floating-point operations) must conduct adversarial testing, assess and mitigate systemic risks, implement incident reporting, and apply cybersecurity protections.

Deployers of high-risk AI in employment contexts, including automated CV screening, performance monitoring, and task allocation, face specific transparency obligations toward affected individuals. They must conduct fundamental rights impact assessments, making the Act directly relevant to HR and compliance teams in medium-to-large organizations using third-party AI tools.

Why Is the EU AI Act Important?

The EU AI Act sets the baseline for compliance for any organization using or building AI at scale in Europe. Its extraterritorial scope, modeled on the GDPR, means organizations headquartered outside the EU cannot avoid its obligations if their AI systems affect individuals within the EU.

With fines for the most serious violations exceeding the GDPR’s maximum, the financial stakes of non-compliance are substantial, and the enforcement framework, including the AI Office’s pre-investigation powers, is operational. Beyond legal risk, the Act reflects a shift in how regulators and boards view AI governance.

Executives are increasingly expected to account for AI risk in the same way they account for financial or cybersecurity risk. Organizations that establish AI governance programs now, covering system inventories, role classification, and conformity documentation, are better positioned for future regulatory iterations.

How Does FaceUp Help Comply with the EU AI Act?

The EU AI Act does not directly require organizations to operate a whistleblowing system. However, the Act does create significant compliance complexity, and internal reporting channels are valuable in this context.

Employees interacting with or building AI systems need a secure, anonymous channel to raise concerns about prohibited practices without fear of retaliation. At the same time, organizations deploying high-risk AI systems must demonstrate accountability structures for regulators, and an auditable internal reporting system contributes to that evidence base.

FaceUp helps organizations subject to both the EU AI Act and the EU Whistleblower Directive by offering fully anonymous, multi-channel reporting across web surveys, iOS/Android mobile apps, and 24/7 hotlines in 113 languages. Additionally, its centralized case management system with full audit trails helps ensure ongoing compliance documentation is available on demand.