Risk tiers, the timeline and concrete requirements for companies that build or use AI systems.
In short
The EU AI Act (AI-förordningen) regulates AI systems by risk. A few practices are banned, high-risk uses carry strict duties, chatbots and generated content need disclosure, and most other AI is unregulated. As of October 2026, bans, AI literacy and general-purpose AI rules already apply, while most high-risk obligations start in December 2027 or August 2028.
Most companies in Sweden and the Nordics now use AI somewhere, often inside tools they buy rather than systems they build. This summary is written by Devies, a Gothenburg-based product and engineering consultancy, for CTOs, data leaders and compliance leads who need to know which parts of the regulation actually reach them, and what to put in place now.
What does the EU AI Act cover?
The EU AI Act is Regulation (EU) 2024/1689, a single EU-wide law that applies to anyone who places an AI system on the EU market or uses one in the EU, regardless of where the provider is based.
An AI system, in the regulation's terms, is a machine-based system that infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions, with some degree of autonomy. That covers machine learning models, language-model features in SaaS tools and AI agents. Ordinary rule-based software with fixed logic generally falls outside.
The full legal text is on EUR-Lex. It sits alongside the GDPR rather than replacing it: if an AI system processes personal data, both apply. Some areas are excluded, notably military and national security use, pure scientific research and purely personal, non-professional use.
The four risk tiers
The AI Act sorts AI uses into four tiers, unacceptable, high, transparency and minimal risk, and your obligations depend on which tier each use falls into.
Risk tier
What it means
Examples
Unacceptable
What it means
Banned outright
Examples
Social scoring, emotion recognition at work or in schools, manipulative techniques that cause harm
High
What it means
Allowed with strict requirements
Examples
AI in recruitment, credit scoring, education, critical infrastructure, safety components of regulated products
Transparency
What it means
Disclosure duties
Examples
Chatbots, deepfakes, AI-generated text published to inform the public
Minimal
What it means
No specific rules
Examples
Spam filters, recommendation features, most internal productivity tools
High risk is the tier that matters most for businesses. It covers two groups: AI that is a safety component of products already regulated by EU law (Annex I, such as machinery, lifts or medical devices), and standalone uses listed in Annex III, such as recruitment and worker management, access to education, creditworthiness assessment and pricing of life and health insurance. An Annex III system can escape the high-risk label if it only performs a narrow procedural task and does not materially influence decisions, but a system that profiles people is always high-risk.
Obligations by role: provider, deployer or both?
Your obligations under the AI Act depend on your role: a provider develops an AI system and places it on the market, while a deployer uses an AI system under its own authority in a professional context.
Most companies are deployers. You become a provider if you build an AI system and offer it to others or put it into service under your own name, and also if you put your brand on someone else's high-risk system, substantially modify it, or repurpose a general tool for a high-risk use.
Checklist by role
Everyone (all tiers):
- Take measures to support AI literacy among staff who operate or use AI (Article 4).
- Make sure no use falls under the prohibited practices (Article 5).
Providers of high-risk systems:
- Run a risk management system and data governance for training data.
- Produce technical documentation and enable automatic logging.
- Design for human oversight, accuracy, robustness and cybersecurity.
- Operate a quality management system, complete a conformity assessment, apply CE marking and register in the EU database.
- Monitor the system after release and report serious incidents.
Deployers of high-risk systems:
- Use the system according to the provider's instructions.
- Assign human oversight to people with the competence and authority to intervene.
- Monitor operation, keep the automatically generated logs for at least six months, and report risks to the provider.
- Inform workers' representatives before using it in the workplace, and inform people when a high-risk system makes or supports decisions about them.
- Public bodies, and companies doing credit scoring or life and health insurance pricing, must carry out a fundamental rights impact assessment.
Transparency tier: providers must make clear when people interact with AI and mark synthetic content; deployers must disclose deepfakes and emotion recognition.
Penalties are tiered. For prohibited practices the ceiling is EUR 35 million or 7% of worldwide annual turnover, whichever is higher, with lower ceilings for other breaches.
Timeline: what applies when?
As of October 2026, the prohibitions, AI literacy, general-purpose AI rules and transparency duties apply, while high-risk obligations have been postponed to December 2027 and August 2028.
The original timeline was changed by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. According to the European Commission's AI Act page, the dates are now:
Date
What applies
1 August 2024
What applies
The AI Act enters into force
2 February 2025
What applies
Prohibited practices and AI literacy
2 August 2025
What applies
Governance rules and obligations for general-purpose AI models
2 August 2026
What applies
General application, enforcement by the AI Office and national authorities; transparency rules
December 2026
What applies
New ninth prohibition on non-consensual sexual content, added by the Omnibus
2 December 2027
What applies
High-risk rules for Annex III uses (employment, credit, education and others)
2 August 2028
What applies
High-risk rules for AI in regulated products (Annex I)
The Omnibus also softened the AI literacy duty from ensuring a sufficient level to taking measures that support it, and extended simplified requirements to small mid-cap companies. The postponement gives you time, not an exemption. Conformity work for a high-risk system takes months, so companies with Annex III uses should start now.
How to set up AI governance in practice
AI governance is the set of roles, policies and routines a company uses to decide which AI it uses, how it is controlled and who is accountable, and the AI Act makes a light version of it necessary for almost every company.
You do not need a new department. Most mid-sized companies can build it on existing data protection and information security routines:
- Make an inventory. List every AI system you build or use, including AI features inside purchased SaaS tools. Note owner, purpose and data used.
- Classify each use. Assign a risk tier and your role. Document why a borderline Annex III use is or is not high-risk.
- Write a short AI policy. Which tools are approved, what data may be used with them, and who signs off on new uses.
- Train for AI literacy. Adapt training to role: developers, case handlers and managers need different depth. Keep a record of what you did.
- Ask suppliers the right questions. For high-risk tools, request instructions for use, logging capabilities and conformity documentation.
- Link to existing processes. Combine AI risk assessment with GDPR impact assessments and security reviews instead of running a parallel track.
- Review regularly. New use cases and new features in existing tools appear constantly.
Governance also supports your AI strategy. When you know which uses are low-risk, teams can move faster on them, and effort goes where the regulation and the business risk are greatest. Agent-based automation raises its own control questions, covered in our planned guide to taking AI agents from pilot to production.
Keep reading
From our work
Client Case: Stena LineStena Line modernised its Azure data platform - improving Power BI reliability, reducing pipeline runtimes and scaling with medallion architecture.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
Does the EU AI Act apply to companies that only use AI tools?
Yes. Companies that use AI systems professionally are deployers and have obligations. For most everyday tools, such as writing assistants or spam filters, these are light: take measures to support AI literacy and avoid prohibited uses. The obligations grow considerably if you use a high-risk system, for example AI that screens job applicants or assesses creditworthiness, where you must ensure human oversight, keep logs and inform the people affected.
When do the high-risk requirements of the AI Act apply?
After the Digital Omnibus on AI, which entered into force on 27 July 2026, high-risk rules for standalone uses listed in Annex III, such as recruitment, credit scoring and education, apply from 2 December 2027. High-risk rules for AI embedded in products regulated under other EU laws, listed in Annex I, apply from 2 August 2028. Prohibitions and AI literacy have applied since 2 February 2025.
Is ChatGPT or Copilot high-risk under the AI Act?
Not by default. General-purpose models carry their own obligations, which fall on the model provider, not on you. Whether your use is high-risk depends on the purpose. Drafting emails is minimal risk. Using the same model to rank job candidates or decide on credit can make that specific use high-risk, and you may then take on provider obligations if you build and offer the solution under your own name.
What are the fines under the EU AI Act?
Fines are tiered by severity. Using a prohibited AI practice can cost up to EUR 35 million or 7% of global annual turnover, whichever is higher. Most other breaches, including high-risk obligations, carry up to EUR 15 million or 3%. Supplying incorrect or misleading information to authorities carries up to EUR 7.5 million or 1%. Lower caps apply to SMEs and start-ups, where the lower of the two amounts counts.
