EU AI Act compliance

The AI Act applies to organizations that build AI systems (providers) and to those that use them at work (deployers), in the EU or with output used in the EU. The bans apply since 2 February 2025, the duties for general-purpose AI models since 2 August 2025, and most other rules from 2 August 2026.

  • EU Artificial Intelligence Act
  • 2024/1689
  • Requirements in the catalogue: 43
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Art. 4

    Make sure staff who operate or use AI systems are sufficiently AI-literate.

  • Art. 5

    Do not use prohibited practices, such as social scoring, manipulative techniques or emotion recognition at work.

  • Art. 6, Annex III

    Check whether each system is high-risk, for example in recruitment, education, credit scoring or access to essential services.

  • Art. 9–17

    Providers of high-risk systems run risk management, data governance, technical documentation, logging, human oversight and a quality management system.

  • Art. 26–27

    Deployers of high-risk systems follow the instructions for use, assign human oversight, keep the logs, inform workers and, in some cases, assess the impact on fundamental rights.

  • Art. 50

    Tell people when they interact with an AI system, and mark or label AI-generated and deep-fake content.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • The catalogue's requirements grouped the way the Act is: governance and inventory, prohibited practices, high-risk classification, provider and deployer duties, transparency, general-purpose models and monitoring.

  • Fasttrack asks whether you build or use AI and in which areas, and says whether the AI Act is required, recommended or worth considering, and why.

  • Training assigned by role records who completed which course, as evidence for the AI literacy duty.

  • Policies, evidence and tasks linked to each requirement, with the dates in the governance calendar.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • Governance and AI system inventory4
  • Prohibited AI practices6
  • High-risk classification3
  • Obligations for high-risk AI systems7
  • Provider obligations5
  • Deployer obligations6
  • Transparency obligations for certain AI systems4
  • General-purpose AI (GPAI) models5
  • Post-market monitoring and incident reporting3

Related frameworks: GDPR

Free self-check

Answer a short questionnaire and get an indicative readiness score and the gaps that matter most, by email.

Take the self-check

Common questions

We only use AI tools such as chat assistants. Does the AI Act apply?

Yes, as a deployer. Since 2 February 2025 staff who use AI systems must be AI-literate, and transparency duties apply to certain uses. Most of the heavier duties apply only to high-risk systems.

When is an AI system high-risk?

When it is a safety component of a product covered by the EU laws listed in Annex I, or when it is used in an area listed in Annex III, such as recruitment, education, credit scoring or access to essential services, unless the exception of Art. 6(3) applies.

Does Atitic itself use AI?

Optionally. AI features are off until a company turns them on, read only what the person asking may see, and anything they suggest waits for a person to accept it.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt EU AI Act in a free trial, link the evidence you already have and see what is still missing.

Start a free trial