The EU AI Act and its Implications for Key IoT Applications and Sectors

Update note: This white paper was originally published in July 2025 and was reviewed and updated in October 2026 to reflect changes to the EU AI Act’s implementation timetable and subsequent European Commission guidance. Readers should consult current official guidance when assessing how the Act applies to a specific AI system.

The European Union’s Artificial Intelligence Act (EU AI Act) establishes a binding, comprehensive framework for the regulation of artificial intelligence. It was signed on 13 June 2024 and entered into force on 1 August 2024, with its provisions applying in stages. Subsequent amendments have extended the implementation timetable for some high-risk AI requirements. The legislation establishes a framework intended to protect fundamental rights and public safety while supporting responsible innovation.

The Act follows a risk-based approach. It prohibits specified AI practices, establishes requirements for systems classified as high risk, imposes transparency obligations on certain systems and outputs, and leaves many other AI uses without additional use-specific requirements under the Act. General-purpose AI models are governed through a separate framework. The use of AI across critical infrastructure, retail, telecare, healthcare, automotive and security applications makes it important for business leaders and other stakeholders to understand the requirements that apply to their systems and activities.

It is important to remember, however, that:

• The Act entered into force on 1 August 2024, with its provisions applying in stages
• The classification rules, requirements and obligations in Chapter III Sections 1 to 3 apply from 2 December 2027 to high-risk AI systems listed in Annex III
• The same sections apply from 2 August 2028 to qualifying high-risk AI systems that are, or are safety components of, products covered by Annex I
• Providers and deployers must assess each system against the Act’s classification criteria rather than assuming that all AI used within a particular sector is high risk
• Once the relevant requirements apply, providers of high-risk AI systems must establish and document proportionate post-market monitoring arrangements
• Only specified AI use cases are classified as high risk, and each system must be assessed against Article 6 and the relevant criteria in Annex I or Annex III

This white paper examines the key elements of the EU AI Act and explores their implications for businesses and critical sectors. It draws on the Act itself, European Commission guidance and relevant academic and policy analysis. Because the implementation framework continues to evolve, organisations should confirm the current legal and regulatory position before making decisions about the classification or compliance requirements of a particular system.

The EU AI Act employs a risk-based approach to regulating artificial intelligence. Classification and applicable obligations reflect the risks that a system may present to health, safety and fundamental rights. At a high level, the Act distinguishes between prohibited practices, high-risk systems, systems and outputs subject to specific transparency obligations, and other AI systems. General-purpose AI models are addressed separately.

• Prohibited practices: The Act prohibits specified AI practices considered incompatible with the protection of health, safety or fundamental rights. These include certain harmful manipulative or exploitative uses, social scoring, predictive policing based solely on profiling, untargeted collection of facial images for facial-recognition databases, specified biometric and emotion-recognition uses, and certain uses of real-time remote biometric identification. Two new prohibitions concerning synthetic content, introduced by the 2026 amendments, apply from 2 December 2026.
• High-risk AI systems: AI systems meeting the classification criteria in Article 6 and Annex I or Annex III are subject to the Act’s high-risk framework. Depending on the system and the organisation’s role, applicable requirements may include risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness, cybersecurity, conformity assessment and post-market monitoring. Chapter III Sections 1 to 3 contain the classification rules, the requirements and the obligations of providers and deployers. Following the 2026 amendments, they apply to Annex III systems from 2 December 2027. For qualifying systems that are, or are safety components of, products covered by Annex I, they apply from 2 August 2028 (Article 113(c)). The delay does not extend to the Commission’s duty to issue classification guidelines (Article 6(5)). The rules on notified bodies in Section 4 have applied since 2 August 2025. The 2026 amendments also moved machinery to Section B of Annex I, so its AI requirements will come through the Machinery Regulation instead.
• AI systems and outputs subject to transparency requirements: Article 50 imposes specific transparency obligations on certain systems and outputs, whether or not the system is also classified as high risk. Depending on the use, these may require people to be informed that they are interacting with AI, notified that they are exposed to emotion-recognition or biometric-categorisation systems, or informed that content has been artificially generated or manipulated. These requirements apply from 2 August 2026, subject to specified exceptions and transitional provisions.
• Other AI systems: AI systems that are not prohibited, do not meet the high-risk criteria and are not subject to a specific transparency requirement may have no additional use-specific obligations under the categories summarised above. Providers and deployers remain subject to applicable general provisions, including the AI literacy duty in Article 4. Other legislation, including data-protection, consumer-protection, equality, employment, product-safety and sector-specific requirements, may also apply.

The Act provides regulatory sandboxes for supervised testing of AI systems, and the 2026 amendments expanded both sandboxes and real-world testing. Specified support measures now extend from SMEs and start-ups to small mid-cap companies.

A visual summary of prohibited practices, high-risk systems, transparency requirements and other AI systems is provided in Figure 2. The requirements applicable to an AI system depend on its intended purpose, function, deployment context, the organisation’s role and any relevant product or sector-specific legislation. Classification should therefore be assessed at system and use-case level rather than assigned automatically by technology or sector.

The EU AI Act applies to providers placing AI systems or general-purpose AI models on the EU market, deployers established in the EU and, in specified circumstances, providers and deployers outside the EU where the output produced by the system is used in the EU. Organisations should identify the AI systems for which they are responsible, establish whether they act as a provider, deployer, importer, distributor, product manufacturer or authorised representative, and assess each system against the Act’s classification criteria and applicable timetable.

Key implications include:

• Classification and documentation: Organisations should classify AI systems by their intended purpose and use, determine their role under the Act and document the basis for each classification decision. Where a system is classified as high risk, the applicable requirements may include technical documentation, risk management, data governance, human oversight, record-keeping and post-market monitoring. Existing sector-specific requirements may also continue to apply.
• Radio equipment and connected products: Most connected devices that communicate by radio fall under the Radio Equipment Directive, which remains in Annex I Section A. An AI safety component in such a device is high risk only where the product is required to undergo third-party conformity assessment. Since the 2026 amendments, assessment required solely for risks other than health and safety, such as radio spectrum use, does not meet that condition (Article 6(1c)).
• Transparency obligations: Certain AI systems are subject to specific transparency requirements. These include informing people when they are interacting directly with an AI system in circumstances covered by the Act and marking or disclosing certain artificially generated or manipulated content. The precise requirement depends on the system, the content and the context in which it is provided. According to the Commission’s Article 50 Q&A, AI operating solely in the background or through machine-to-machine communication falls outside the duty to inform people that they are interacting with AI.
• Data governance and interoperability: Once the relevant high-risk requirements apply, providers of high-risk AI systems must establish appropriate data-governance and management practices for training, validation and testing data. For high-risk systems that do not train AI models, these duties apply only to testing datasets (Article 10(6)). Organisations must also consider applicable data-protection, cybersecurity and sector-specific requirements when data moves between systems, organisations or jurisdictions.
• Sector-specific requirements: Organisations operating in regulated sectors must assess the AI Act alongside existing legal and supervisory frameworks. For example, AI systems used to evaluate the creditworthiness of natural persons may fall within the high-risk framework while also remaining subject to applicable financial-services, consumer-protection and data-protection requirements. Annex III point 5(b) excludes AI systems used to detect financial fraud.

Flowchart: Business compliance workflow for the EU AI Act

The following flowchart illustrates the internal process that businesses may adopt to ensure compliance with the EU AI Act:

Critical National Infrastructure (CNI) is fundamental to a nation’s public safety and economic stability. Certain AI systems used as safety components in the management or operation of critical digital infrastructure, road traffic or the supply of water, gas, heating or electricity may be classified as high risk. Classification depends on the intended purpose of the system and whether the relevant criteria under the Act are met. CNI planners should therefore assess the intended purpose of each AI system, its role in the operation of the infrastructure and whether it meets the Act’s high-risk classification criteria.

Following the 2026 amendments, a safety component is an AI component intended to prevent or mitigate risks to health and safety of persons or property. A component also qualifies where its failure or malfunction would endanger the health and safety of persons or property. Recital 55 adds that safety components in critical infrastructure directly protect its physical integrity or the health and safety of persons and property.

Article 6(1a) applies for the purposes of the whole Regulation. It provides that AI used solely for non-safety aspects of user assistance, performance optimisation, service efficiency, automation, convenience or quality control is not a safety component. Such AI remains a safety component where its failure or malfunction would endanger health and safety (Article 6(1b)). The Commission’s classification guidelines remain in draft, so how far this narrows Annex III point 2 is not yet settled.

Relevant considerations include:

• Safety components and risk management:
  Where an AI system used in traffic management, electricity distribution or another critical-infrastructure context meets the Act’s high-risk criteria, the relevant requirements may include risk management, testing, technical documentation, human oversight, robustness and post-market monitoring once the applicable provisions take effect. The particular obligations, application date and conformity-assessment route depend on the system and the legislation under which it is regulated.
• Interaction with existing regulations:
  CNI operators are already subject to sector-specific regulation. The AI Act complements these frameworks by adding requirements for qualifying AI systems. Where an AI system meets the Act’s high-risk classification criteria, the relevant AI-specific requirements apply from the applicable implementation date. Autonomous-driving systems incorporated into public transport follow a different route. They must comply with vehicle safety and type-approval requirements. Article 2(2) limits direct application of the AI Act, and the relevant AI requirements are integrated into that legislation.
• Cybersecurity considerations:
  AI integration can introduce additional cybersecurity risks. Where an AI system is classified as high risk, the Act requires an appropriate level of accuracy, robustness and cybersecurity. Critical-infrastructure operators must also consider the cybersecurity, resilience and incident-management requirements arising under other applicable EU and national legislation. Components used solely for cybersecurity are not safety components for Annex III point 2. A high-risk system within the Cyber Resilience Act is deemed to meet the AI Act’s cybersecurity requirement where CRA Article 12(1) is satisfied. The presumption covers cybersecurity only, so accuracy and robustness, including the resilience measures in Article 15(4), must still be shown directly.
• System resilience and interruption management:
  Operators should establish proportionate controls for system failures, erroneous outputs and interruptions. For high-risk systems, the Act requires appropriate levels of accuracy, robustness and cybersecurity, together with risk-management and post-market monitoring processes. In critical infrastructure, these controls should be coordinated with the organisation’s wider continuity and resilience arrangements. Article 15(4) recognises technical redundancy, including backup or fail-safe plans, as a means of achieving robustness. The Act does not prescribe network uptime or connectivity design; those requirements follow from each system’s risk assessment.

Table: Regulatory considerations for AI in critical national infrastructure

The following table outlines indicative regulatory considerations for AI systems used in critical national infrastructure:

The applicable requirements depend on the system’s intended purpose, classification and deployment context. These considerations should therefore be assessed at system level rather than applied automatically to every use of AI in critical infrastructure.

The EU AI Act’s detailed framework affects various industry sectors in different ways. This section explores the specific implications for retail, telecare, healthcare, automotive systems and security cameras.

Retail

In the retail sector, AI is used for customer profiling, personalised recommendations, inventory management and biometric payment systems. The regulatory implications depend on the function and context of each system. Biometric verification used solely to confirm that a person is who they claim to be is excluded from Annex III’s remote-identification category, although data-protection and payment requirements may still apply.

• Customer profiling and recommendation engines: AI-driven customer-profiling systems may analyse behavioural data to support product recommendations. Where customer-profiling or advertising systems use biometric data, retailers must assess the precise function against the AI Act’s prohibited-practice, high-risk and transparency provisions, as well as applicable data-protection law. The use of biometric data does not, by itself, determine the system’s classification.
• Biometric and emotion-recognition systems: Retailers using facial recognition, biometric categorisation or emotion-recognition technologies must assess each function separately. Certain biometric categorisation and emotion-recognition practices are prohibited, while other uses may be classified as high risk, subject to transparency requirements or governed principally by data-protection law. Separately, the Act prohibits specified manipulative practices and uses that exploit vulnerabilities associated with age, disability or a particular social or economic situation where the relevant legal conditions are met.
• Data handling and transparency: Retailers should establish data-governance controls proportionate to the systems they deploy. Where technical documentation or transparency requirements apply, the relevant information must be maintained or provided in accordance with the organisation’s role and the system’s classification. Data-protection requirements also remain relevant where customer or biometric data is collected and processed for targeted marketing, payment or security purposes.

Telecare

The telecare sector is using artificial intelligence in applications including service-user monitoring, predictive alerts, decision support and personalised care. The regulatory treatment of these systems depends on their intended purpose, function and relationship with applicable medical-device legislation. A device that only relays a fixed alarm to a monitoring centre may not be an AI system. The assessment therefore starts with whether the device or platform makes an AI inference.

• Health monitoring systems:
  AI systems that monitor vital signs, predict potential health emergencies or support the management of chronic conditions may be classified as high risk where they meet the Act’s criteria, including where they form part of a regulated medical device requiring third-party conformity assessment. Testing, validation and clinical-evidence requirements depend on the function of the system and the applicable medical-device framework.
• Confidentiality and data privacy:
  Telecare systems may process health data, which is special-category personal data under the GDPR. The GDPR requires security appropriate to the risk. Where a telecare AI system is classified as high risk, the AI Act adds applicable data-governance, record-keeping and logging requirements.
• Integration with medical devices:
  Telecare solutions may integrate with software or equipment regulated as medical devices. An AI system used as a safety component of a regulated product, or which is itself such a product, may be classified as high risk where the applicable conditions are met. The relevant documentation, conformity assessment, clinical evaluation and human-oversight requirements depend on the system’s intended purpose and applicable medical-device legislation.
• Emergency-call assessment and prioritisation: AI used to evaluate or classify emergency calls, or to establish priorities in dispatching emergency medical aid, may be classified as high risk under Annex III. Telecare providers should therefore assess AI-assisted alarm-call triage and escalation systems separately from routine remote-monitoring functions. Whether a particular alarm-handling application falls within this category depends on its intended purpose, functions and operational context.

Healthcare

Healthcare is a consequential area for AI, where systems may improve the efficiency of care delivery but can also influence clinical decisions, patient safety and health outcomes.

• Medical devices and diagnostics:
  AI is already used in areas including imaging diagnostics, robotic-assisted surgery and predictive analytics. Some of these systems may be classified as high risk, particularly where the AI is a regulated medical device or a safety component of a regulated product requiring third-party conformity assessment. Applicable clinical evaluation, validation, risk-management and conformity-assessment requirements depend on the intended purpose and regulatory status of the system.
  For example, AI-assisted diagnostic tools used in radiology may require clinical evaluation, validation and conformity assessment under the applicable medical-device framework, depending on their intended purpose and regulatory status.
• Operational efficiency and patient safety:
  While AI can streamline administrative and clinical processes, systems classified as high risk are subject to applicable human-oversight requirements. The appropriate form of oversight depends on the system’s intended purpose, risks, deployment context and applicable medical-device requirements. Healthcare providers must therefore balance potential operational benefits with patient safety and clinical accountability.
• Data integrity and security:
  Healthcare platforms require secure data-management arrangements that protect the integrity and confidentiality of patient records. Cybersecurity, backup and recovery controls should be proportionate to the system’s function, risks and applicable healthcare, medical-device and data-protection requirements.

Automotive

The automotive industry is integrating AI into functions ranging from driver-assistance systems to increasingly automated vehicles. AI used as a vehicle safety component may be classified as high risk under Article 6(1), but vehicles are covered by the special treatment for products listed in Section B of Annex I. The relevant AI requirements are therefore integrated into EU vehicle type-approval legislation rather than applying through the full standalone high-risk regime.

• Safety components in vehicles:
  An AI system used as a vehicle safety component may be classified as high risk where the Article 6(1) conditions are met. For vehicles covered by Section B of Annex I, the relevant AI requirements are integrated into EU vehicle type-approval legislation rather than applying through the full standalone high-risk regime. Only the AI Act provisions specified in Article 2(2) apply directly, including the Article 6(1) classification rule, which applies from 2 August 2028. Manufacturers should therefore assess AI-enabled vehicle functions through the applicable type-approval, product-safety and cybersecurity frameworks.
• Cybersecurity in connected vehicles:
  With the increasing connectivity of automotive systems, cybersecurity is a critical consideration. AI-driven diagnostics and vehicle-to-everything (V2X) communications systems require cybersecurity controls proportionate to their function, risks and applicable vehicle legislation. These controls should address potential unauthorised access, disruption and interference with safety-related functions.
• Integration with mobility ecosystems:
  Automotive AI systems may interface with wider mobility ecosystems, including smart traffic management, public-transport coordination and emergency services. Organisations must therefore consider interoperability, data governance, cybersecurity and the interaction between vehicle, transport and AI-specific requirements.

Security Cameras

Security cameras and similar surveillance systems may incorporate AI capabilities such as facial recognition, remote biometric identification, motion detection and behaviour analysis. Their regulatory treatment depends on the precise function, purpose, users and deployment context. Remote biometric identification may be high risk whether it operates in real time or after an event.

• Biometric identification and prohibitions:
  Real-time remote biometric identification for law-enforcement purposes in publicly accessible spaces is prohibited, subject to limited exceptions and safeguards. Other live and post-event remote biometric identification may fall within the high-risk framework where the Annex III criteria are met. Commercial uses, including live facial recognition in retail settings, must therefore be assessed against the high-risk, transparency and data-protection requirements rather than treated as automatically prohibited. The Act also prohibits untargeted scraping of facial images from the internet or CCTV footage to create or expand facial-recognition databases, and prohibits emotion recognition in workplaces and education institutions, except where intended for medical or safety reasons.
• High-risk biometric uses and verification:
  Remote biometric identification may fall within the high-risk framework whether it is conducted in real time or after an event, provided the use is permitted under applicable law and meets the Annex III criteria. Biometric verification used solely to confirm that a person is who they claim to be is excluded from this Annex III category, although data-protection and other legal requirements still apply. A high-risk biometric system listed in Annex III point 1 needs a notified body where no harmonised standard or common specification is available (Article 43(1)). The same applies where the provider has not applied them, or has applied a harmonised standard only in part. Where a harmonised standard was published with a restriction, the notified-body route applies only to the restricted part. Where the provider has applied them in full, it may choose internal control instead. A system also covered by legislation listed in Annex I Section A follows that legislation’s conformity-assessment procedure (Article 43(3)). Detecting a person or vehicle without identifying or categorising anyone falls outside point 1 on the Act’s definitions.

Table: Sector-specific analysis

The following table summarises indicative classifications and key compliance considerations across the five sectors examined in this paper:

The EU AI Act establishes a comprehensive framework for artificial intelligence, but its implementation creates significant legal, technical and operational challenges for businesses and other organisations. The following points outline some of the central hurdles to implementation:

• Technical and financial burdens:
  Where the relevant high-risk requirements apply, technical documentation, monitoring, conformity assessment and associated governance measures may create significant financial and technical demands. Smaller enterprises and start-ups may face particular challenges in securing the necessary legal, technical and operational expertise.
• Interaction between regulations:
  Organisations must assess the AI Act alongside other applicable frameworks, including the GDPR, sector-specific safety legislation and financial-services requirements. Coordinating overlapping obligations may require legal, technical, security and operational teams to work together.
• Rapid technological evolution:
  AI technologies, particularly generative AI and machine-learning models, continue to evolve rapidly. Organisations must therefore monitor changes to their systems, use cases, regulatory guidance and applicable standards to ensure that earlier classification and compliance decisions remain valid.
• Transparency and data governance:
  Implementing applicable transparency measures, including machine-readable marking or disclosure requirements for certain AI-generated content, may require changes to technical systems and content-governance processes. Organisations must also coordinate AI Act compliance with applicable data-protection, cybersecurity and cross-border data requirements.
• Human oversight and accountability:
  Where human oversight is required, organisations must define who will oversee the system, what information those individuals need and when intervention or escalation is expected. Implementing these arrangements may require changes to workflows, responsibilities and training.
• International cooperation and cross-border implications:
  Multinational organisations may need to coordinate the EU AI Act with legal and regulatory requirements in other jurisdictions. This can affect system governance, data transfers, supplier arrangements and the deployment of common AI systems across multiple markets.

The EU AI Act establishes a comprehensive framework for the governance of artificial intelligence within its scope. Its risk-based approach prohibits specified practices, establishes detailed requirements for high-risk systems, imposes transparency obligations on certain systems and outputs, and regulates general-purpose AI models through a separate framework. While the Act provides a structured framework, compliance may require investment in governance, technical documentation, data management, security, monitoring and, where applicable, human oversight and conformity assessment.

• Comprehensive regulatory framework:
  The EU AI Act establishes a comprehensive, legally binding framework for AI systems and general-purpose AI models placed on the EU market or otherwise falling within its scope.
• Risk-based approach:
  Specified AI practices are prohibited, systems meeting the high-risk criteria are subject to detailed requirements, and certain systems and outputs are subject to transparency obligations. These transparency obligations may also apply to systems classified as high risk.
• Implications for business:
  Organisations should maintain an AI inventory, determine their role for each system, document classification decisions and implement the requirements applicable to each use. Technical documentation, data governance and post-market monitoring apply where required by the Act. Financial institutions and organisations in other regulated sectors must coordinate AI Act compliance with existing sector-specific legislation and supervisory requirements.
• Impact on critical national infrastructure:
  Certain AI systems used as safety components in critical infrastructure may be classified as high risk where the Act’s criteria are met. Applicable requirements may include risk management, technical documentation, human oversight, cybersecurity, conformity assessment and post-market monitoring.
• Sector-specific considerations:
  • Retail: Biometric and emotion-recognition systems must be assessed against the Act’s prohibited-practice, high-risk and transparency provisions, alongside applicable data-protection requirements.
  • Telecare and healthcare: AI systems must be classified according to their intended purpose and regulatory status. Where an application is high risk or forms part of a regulated medical device, additional validation, documentation, conformity-assessment and human-oversight requirements may apply. AI that evaluates or prioritises emergency calls is listed in Annex III point 5(d).
  • Automotive: AI-enabled vehicle functions must be assessed under Article 6 alongside applicable vehicle type-approval, product-safety and cybersecurity requirements. For vehicle safety components covered by Section B of Annex I, only the AI Act provisions specified in Article 2(2) apply directly. These include the Article 6(1) classification rule, which applies from 2 August 2028. The AI requirements themselves reach vehicles through the EU type-approval framework.
  • Security cameras: Depending on their function, purpose, users and deployment context, systems using biometric identification may be prohibited, classified as high risk or subject to transparency requirements. Data-protection and other applicable legal requirements must also be considered.
• Compliance challenges:
  Significant technical, financial and administrative challenges exist, particularly for SMEs. The pace of AI development and the need to coordinate the Act with other regulatory frameworks add complexity, while systems subject to human-oversight requirements need clearly defined responsibilities, information and escalation procedures. SMEs and small mid-caps may use simplified technical documentation and proportionate quality-management implementation, and lower fine caps apply to SMEs.

The EU AI Act establishes a regulatory framework that may influence the development of AI governance in other jurisdictions. Its implementation will continue to depend on guidance, standards, sector-specific legislation and cooperation between regulators and organisations developing or deploying AI.

In summary, organisations should distinguish between provisions that already apply and high-risk requirements scheduled for 2027 and 2028. Establishing an AI inventory, identifying organisational roles, documenting classification decisions and monitoring current Commission guidance will provide a stronger basis for proportionate compliance.

The European Commission and the AI Office continue to develop guidance and supporting materials for implementation of the Act. The Commission adopted its Article 50 transparency guidelines on 20 July 2026, while its high-risk classification guidelines remain in draft. Draft guidance and a reporting template for serious incidents involving high-risk systems were published for consultation in September 2025. Guidance on combining AI Act and product-law compliance is due by 1 August 2027, and post-market monitoring guidance by 2 September 2027. EN 18286, covering quality-management systems for AI Act purposes, was published in July 2026. A harmonised standard provides a presumption of conformity only after its reference is published in the Official Journal. Organisations should therefore check the latest official guidance and standardisation position when classifying systems and planning compliance.

Appendix A: Figures

Figure 1: Implementation timeline

Figure 2: Risk categorisation of AI systems

This table provides a high-level summary of prohibited practices, high-risk systems, transparency requirements and other AI systems. General-purpose AI models are governed separately.

Figure 3: Sectoral impact and compliance considerations

The table below compares indicative classifications, compliance considerations and implementation challenges across the five sectors examined in this paper.

Appendix B: Global implications of the Act

The EU AI Act establishes a comprehensive risk-based framework that may influence the development of AI governance in other jurisdictions. It prohibits specified practices, regulates systems meeting the high-risk criteria, imposes transparency obligations on certain systems and outputs, and establishes a separate framework for general-purpose AI models.

For businesses, this may require compliance processes covering system inventories, classification decisions, documentation, transparency and, where applicable, human oversight. These challenges may be particularly acute for SMEs and organisations that rely heavily on AI.

As AI becomes embedded in critical infrastructure and sectors such as retail, healthcare and automotive, organisations must consider the interaction between the AI Act, sector-specific regulation and requirements applying in other jurisdictions.

Effective implementation will depend on cooperation between regulators and organisations to interpret evolving guidance, apply proportionate risk assessments and support responsible innovation.

Appendix C: Additional regulatory notes

• Implementation timeline: The AI Act entered into force on 1 August 2024, with its provisions applying in stages. Under the 2026 amendments, Chapter III Sections 1 to 3 apply from 2 December 2027 to systems classified as high risk under Article 6(2) and Annex III. They apply from 2 August 2028 to qualifying systems under Article 6(1) and Annex I (Article 113(c)). The delay does not extend to the Commission’s duty to issue classification guidelines (Article 6(5)). The notified-body rules in Section 4 have applied since 2 August 2025.
• Biometric identification: Real-time remote biometric identification for law-enforcement purposes in publicly accessible spaces is prohibited, subject to limited exceptions and safeguards. Other remote biometric identification and biometric-categorisation uses must be assessed against the Act’s prohibited-practice, high-risk and transparency provisions and other applicable law.
• General-purpose AI obligations: Providers of general-purpose AI models are subject to specific documentation, transparency and copyright-related obligations. Providers of general-purpose AI models classified as presenting systemic risk are subject to additional model-evaluation, systemic-risk assessment, mitigation, incident-reporting and cybersecurity requirements.
• AI-generated content: Article 50 imposes different transparency duties on providers and deployers. Depending on the system and content, these may include machine-readable marking of synthetic outputs or disclosure of deepfake and certain public-interest content. The Article 50 requirements apply from 2 August 2026, subject to specified exceptions and transitional provisions.

Regulatory position and official sources last reviewed: October 2026.

This white paper provides a general overview and does not constitute legal advice. The classification and obligations applicable to an AI system depend on its intended purpose, role in the AI value chain, deployment context and interaction with other applicable legislation.

• Alvarado, A. (2025). Lessons from the EU AI Act. Patterns, 6(2).
• CEN and CENELEC. (2026). Publication of EN 18286, quality management system for the EU AI Act. 31 July 2026.
• European Commission. (2021). Proposal for a Regulation Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), COM(2021) 206 final.
• European Commission. (2025). Draft guidance and template on serious incidents involving high-risk AI systems. 26 September 2025.
• European Commission. (2026). AI Omnibus enters into force. 27 July 2026.
• European Commission. (2026). Draft Commission guidelines on the classification of high-risk AI systems. 19 May 2026.
• European Commission. (2026). Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, C(2026) 5054 final. 20 July 2026.
• European Commission. (2026). Navigating the AI Act. Last updated 7 August 2026.
• European Parliament and Council of the European Union. (2014). Directive 2014/53/EU on the harmonisation of the laws of the Member States relating to the making available on the market of radio equipment (Radio Equipment Directive).
• European Parliament and Council of the European Union. (2023). Regulation (EU) 2023/1230 on machinery (Machinery Regulation).
• European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).
• European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act).
• European Parliament and Council of the European Union. (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, 2026/1744.
• Madiega, T. (2023). Parliament’s negotiating position on the artificial intelligence act. European Parliamentary Research Service, PE 747.926.
• Palmiotto, F. (2025). The AI Act Roller Coaster: The Evolution of Fundamental Rights Protection in the Legislative Process and the Future of the Regulation. European Journal of Risk Regulation, 16(2), 770–793. https://doi.org/10.1017/err.2024.97
• Passador, M.L. (2026). AI in the Vault: AI Act’s Impact on Financial Regulation. Loyola University Chicago Law Journal, 56(2), 257.
• Rodríguez de las Heras Ballell, T. (2025). Mapping Generative AI rules and liability scenarios in the AI Act, and in the proposed EU liability rules for AI liability. Cambridge Forum on AI: Law and Governance, 1, e5. https://doi.org/10.1017/cfl.2024.8