EU AI Act (Regulation 2024/1689)

What Is the EU AI Act?

Regulation (EU) 2024/1689, known as the EU AI Act, establishes the world's comprehensive first legal framework for governing the development, deployment, and use of artificial intelligence (AI) systems within the EU market. The Act follows a risk-based classification approach, organizing AI systems into four tiers based on level of risk:

The Act broadly applies to providers, deployers, importers, and distributors of AI systems, including non-EU organizations whose systems or outputs are placed on the EU market or whose outputs are used in the EU. The law protects natural persons who interact with or are affected by AI systems, emphasizing fundamental rights, health, safety, and non-discrimination.

On 8 July 2026, the European Parliament and the Council of the EU signed the Digital Omnibus on AI as Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The Digital Omnibus is a simplification package originally proposed by the European Commission that also expands Article 5 to introduce two new prohibited practices:

• AI systems that generate or manipulate non-consensual intimate imagery
• AI systems that generate or manipulate child sexual abuse material

The adopted regulation defers the compliance deadline for high-risk AI systems under Annex III to 2 December 2027, and for Annex I systems to 2 August 2028. It also narrows parts of the high-risk classification and simplifies registration under Annex VIII. The deferral is a delay, not a repeal. Notably, Article 50, which covers transparency obligations regarding chatbots, deepfakes, and AI-generated content, was not deferred and remains applicable as of 2 August 2026.

Who Is Responsible for the EU AI Act?

The primary enforcement body for general-purpose AI models and systemic risk models is the European AI Office, established within the European Commission. Enforcement for most other AI systems sits with the national competent authorities of each EU member state, which were required to be designated by 2 August, 2025.

The AI Board, composed of member state representatives, coordinates the consistent application of the Act across the EU. Where an AI system also processes personal data, Data Protection Authorities may exercise parallel jurisdiction under the GDPR.

Where the legal system of a member state so requires, fines may be imposed by national courts rather than administrative authorities. In all cases, enforcement powers under Article 99 are subject to effective judicial remedies and due process in accordance with Union and national law.

What Are the Possible Penalties Under the EU AI Act?

The Act establishes a three-tier administrative fine structure under Article 99. Fines are calculated as the higher of a fixed euro amount or a percentage of global annual turnover, meaning the penalty scales with an organization’s economic size. For SMEs and startups, fines are capped at the lower of the fixed euro or percentage amount.

Violations of prohibited practices under Article 5 carry fines of up to 35 million euros or 7% of global annual worldwide turnover. Non-compliance with high-risk AI and GPAI obligations carries fines of up to 15 million euros or 3% of global annual turnover. Providing incorrect, incomplete, or misleading information carries fines of up to 7.5 million euros or 1% of global annual turnover. 

What Does the EU AI Act Require?

An organization’s compliance obligations under the Act depend on its role in the AI value chain and the risk classification of its AI systems. For high-risk AI systems under Annex III, requirements include:

For general-purpose AI models, providers must maintain technical documentation and publish summaries of the training data used. GPAI providers whose models meet the systemic-risk threshold (>10^25 floating-point operations) must conduct adversarial testing, assess and mitigate systemic risks, implement incident reporting, and apply cybersecurity protections.

Deployers of high-risk AI in employment contexts, including automated CV screening, performance monitoring, and task allocation, face specific transparency obligations toward affected individuals.

Fundamental rights impact assessments are required of public bodies, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems, but these obligations still make the Act directly relevant , making the Act directly relevant to HR and compliance teams in medium-to-large organizations using third-party AI tools.

Since 2 August 2026, Article 87 has applied the EU Whistleblower Directive to reports of AI Act infringements, so a worker who raises a breach internally, with a national competent authority, or in defined circumstances publicly, qualifies for anti-retaliation protection. The limits matter. 

The Directive does not oblige anyone to accept anonymous reports: Article 6(2) leaves that choice to each member state, so the position differs by country. A person who reports anonymously and is later identified is protected if retaliation follows, provided the report met the Directive's conditions, including reasonable belief that the information was true and a work-related connection to the organization. 

Knowingly false reports carry no protection. For organizations already running internal channels because they have 50 or more workers, the practical step is to extend the scope of those channels, and investigator training, to AI Act breaches rather than build something separate.

Why Is the EU AI Act Important?

The EU AI Act sets the compliance baseline for any organization using or building AI at scale in Europe. Its extraterritorial scope, modeled on the GDPR, means organizations headquartered outside the EU cannot avoid its obligations if their AI systems are placed on the EU market or their outputs are used in the EU.

With fines for the most serious violations exceeding the GDPR's maximum, the financial stakes of non-compliance are substantial, and the enforcement framework, including the AI Office's enforcement powers, is operational. Beyond legal risk, the Act reflects a shift in how regulators and boards view AI governance.

Executives are increasingly expected to account for AI risk in the same way they account for financial or cybersecurity risk. Organizations that establish AI governance programs now, covering system inventories, role classification, and conformity documentation, are better positioned for future regulatory iterations.

How Does FaceUp Help Comply with the EU AI Act?

The EU AI Act does not directly require organizations to operate a whistleblowing system. Article 87 does something narrower and still significant: since 2 August 2026 it has made AI Act breaches a protected category of disclosure under the EU Whistleblower Directive, so the channel an organization already runs becomes the place those concerns land. However, the Act does create significant compliance complexity, and internal reporting channels are valuable in this context.

Employees interacting with or building AI systems need a secure, anonymous channel to raise concerns about prohibited practices without fear of retaliation. At the same time, organizations deploying high-risk AI systems must demonstrate accountability structures for regulators, and an auditable internal reporting system contributes to that evidence base.

For organizations subject to both the EU AI Act and the EU Whistleblower Directive, FaceUp provides fully anonymous, multi-channel reporting across web surveys, iOS/Android mobile apps, and 24/7 hotlines in 113 languages. Its centralized case management system with full audit trails keeps compliance documentation available on demand.