EU AI Act — Frequently Asked Questions

The EU AI Act (Regulation EU 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. It classifies AI systems by risk level and imposes governance, documentation, and oversight requirements on companies operating in the European Union. It entered into force on August 1, 2024, and fully applies from August 2, 2026.

The EU AI Act applies to any company that develops, deploys, or uses AI systems that affect users in the EU — regardless of where the company is headquartered. This includes startups, SMEs, and enterprises in Europe and internationally.

Fines range from €7.5 million (or 1.5% of global annual turnover) for minor violations, up to €35 million (or 7% of global annual turnover) for the most serious breaches, including the use of prohibited AI practices.

The EU AI Act classifies AI systems into four categories: (1) Prohibited — banned outright, such as social scoring systems; (2) High-risk — subject to strict obligations including technical documentation and conformity assessment; (3) Limited-risk — transparency obligations only; (4) Minimal-risk — no mandatory requirements.

High-risk AI systems include those used in recruitment and HR decisions, credit scoring and financial services, medical diagnosis, biometric identification, and systems used in critical infrastructure. The full list is defined in Article 6 and Annex III of the EU AI Act.

The full regulation applies from August 2, 2026. Prohibitions on unacceptable-risk AI (Article 5) applied from February 2, 2025. AI systems already on the market before August 2, 2026 must comply by August 2, 2027.

Yes. If your company deploys an AI-powered feature or product to EU users, you are the "deployer" under the EU AI Act — regardless of whether the underlying model is provided by a third party. Your compliance obligations are based on the risk category of your use case, not the underlying technology.

Verumt delivers audit-ready compliance in 12 weeks. Traditional law firms typically require 6 to 18 months for equivalent work. Timeline depends on the number of AI systems and their risk classification.

Verumt's compliance packages start at €2,500 for a single AI system (Starter plan) and €5,900 for up to five AI systems (Professional plan). Traditional law firms charge €50,000 or more for comparable scope.

Yes. Article 55 of the EU AI Act includes specific provisions for SMEs and startups, including priority access to regulatory sandboxes and reduced conformity assessment fees. However, core compliance obligations still apply — the accommodations reduce cost and friction, not the underlying requirements.

A conformity assessment is the process by which a company verifies that a high-risk AI system meets EU AI Act requirements. For most high-risk systems, this is a self-assessment documented in the technical file. Some categories — such as real-time biometric identification — require third-party assessment by a notified body.

GDPR governs how personal data is collected, stored, and processed. The EU AI Act governs how AI systems are designed, tested, documented, and overseen. The two regulations overlap significantly for AI systems that process personal data, and compliance programs should address both simultaneously.