EU AI Act: What High-Risk Obligations Mean for Your Business

This article is general information, not legal advice. Penalty figures and deadlines should be checked against the official text and your legal counsel.

What is a high-risk AI system?

High-risk systems are AI uses with significant effects on people’s rights or safety, such as recruitment screening, credit scoring or access to essential services, as listed in Annex III. If you decide a system on that list is not high risk, you must document the reasoning.

Which dates matter?

Systems already on the market before the application date generally must comply if they are significantly changed afterwards. Note that proposals to adjust these timelines have been discussed, so verify the latest position.

What must providers of high-risk systems do?

• Classify the system and keep the reasoning on file.
• Run a risk management process and a quality management system.
• Apply data governance to training, validation and testing data.
• Keep technical documentation for ten years and enable automatic logging.
• Provide clear instructions and design for effective human oversight.
• Complete a conformity assessment, apply CE marking and register in the EU database.
• Monitor the system after launch and report serious incidents within 15 days.

What are the penalties?

The Act sets tiered fines. The highest tier, up to €35 million or 7% of global annual turnover, applies to prohibited practices; breaches of high-risk obligations carry lower tiers (commonly cited as up to €15 million or 3%). Regulators can also order a system withdrawn. SMEs and start-ups receive adjusted limits.

A readiness checklist

• List every AI system you build, buy or embed, and where it is used in the EU.
• Classify each against Annex III and note the reasoning.
• Appoint an owner for AI governance and incident reporting.
• Check that your data pipelines can show where training data came from.
• Add logging and human-oversight steps to workflows that affect people.
• Ask vendors for their conformity documentation.

Frequently asked questions

When does the EU AI Act apply to high-risk systems?

Requirements for standalone high-risk systems were scheduled from 2 August 2026, and from 2 August 2027 for AI embedded in regulated products. Confirm current dates with the European Commission.

Does the EU AI Act apply to non-EU companies?

Yes, it can apply when an AI system is placed on the EU market or its output is used in the EU.

What is a conformity assessment?

A check that a high-risk system meets the Act’s requirements before it is placed on the market; most Annex III systems use an internal assessment.

What are the fines under the EU AI Act?

Up to €35 million or 7% of global turnover for prohibited practices, with lower tiers for other breaches.

Sources

1. ADVISORI — EU AI Act High Risk: What companies must implement by August 2026
2. Travers Smith — The EU AI Act: the countdown begins

We summarise these sources in our own words. Figures come from the publishers named above and may be updated; vendor surveys can reflect the publisher’s interests.