TL;DR: The Act sorts AI uses into prohibited practices, high-risk systems, systems with transparency duties, and everything else, with separate obligations for general-purpose AI models. Your role (provider or deployer) decides which duties fall on you. As of November 2026: the original prohibitions have applied since February 2025, general-purpose model duties since August 2025 and Article 50 transparency duties since August 2026. Under the 2026 amending regulation, two further prohibitions apply from 2 December 2026, and high-risk obligations apply from 2 December 2027 for Annex III uses and 2 August 2028 for Annex I products. Always confirm with counsel.
Roles
- Provider: develops an AI system or model and places it on the EU market under its name. Most design, documentation and conformity duties sit here.
- Deployer: uses an AI system in a professional capacity. Duties include using it as instructed, assigning human oversight, monitoring, and informing affected people in certain cases.
- Others include importers and distributors. A company can be a provider for one product and a deployer of another vendor's system.
The Act applies to providers placing systems on the EU market and, in some cases, to non-EU providers and deployers whose system outputs are used in the EU.
Risk tiers
| Tier | Examples | Consequence |
|---|---|---|
| Prohibited | Prohibited social scoring, manipulative techniques causing significant harm, emotion recognition in workplaces and education (narrow exceptions), certain biometric uses | Not allowed |
| High-risk (Annex III uses) | Employment and recruitment, credit scoring, education access and assessment, essential services, certain biometric systems, law enforcement and migration uses | Full obligations before market entry |
| High-risk (Annex I) | AI as a safety component of regulated products (medical devices, machinery, toys, vehicles) | Integrated with product safety regimes |
| Transparency duties (Article 50) | Chatbots, generated or manipulated media, emotion recognition and biometric categorisation disclosures | Inform people; mark synthetic content |
| Minimal risk | Most AI features | No specific obligations beyond general law; voluntary codes |
General-purpose AI models (the large models underlying many products) carry separate provider obligations: documentation, information for downstream providers, copyright policies, and additional duties for models with systemic risk.
Read diagram description
The EU AI Act's tiers drawn as a pyramid: prohibited practices at the top, which are not allowed; high-risk uses, with full obligations before market entry; uses with transparency duties, which must inform people and mark synthetic content; and minimal-risk uses at the base, under general law and voluntary codes. General-purpose AI models carry separate provider duties, with more for models with systemic risk.
The calendar, as of November 2026
Read diagram description
EU AI Act milestones as checked on 6 November 2026 against the amended Act: original prohibitions and AI literacy from 2 February 2025; general-purpose model obligations from 2 August 2025; Article 50 transparency from 2 August 2026; on 2 December 2026, two new prohibitions on non-consensual intimate deepfakes and child sexual abuse material, and the end of the grace period for machine-readable marking on systems already on the market; Annex III high-risk obligations on 2 December 2027; and Annex I high-risk obligations on 2 August 2028.
Sources checked on 6 November 2026: the Commission's AI Act overview and enforcement timetable, and the Official Journal text of the 2026 amending regulation, Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July.
Three changes in that regulation matter for product planning. First, two new prohibitions apply from 2 December 2026: AI that generates realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent, and AI that generates child sexual abuse material. For providers the ban covers systems where this is the intended purpose or a foreseeable, reproducible outcome without adequate safeguards, so an image or voice product needs those safeguards tested before that date. Second, providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2) machine-readable marking; this transition does not delay the other transparency duties. Third, the AI literacy duty in Article 4 was rewritten: providers and deployers must take measures to support AI literacy, without having to guarantee any specific level of it.
High-risk obligations as product work
For a provider of a high-risk system:
| Obligation | Product translation |
|---|---|
| Risk management system | Ongoing risk identification, mitigation and testing, documented |
| Data governance | Training, validation and test data examined for quality, relevance and bias |
| Technical documentation | Design, data, evaluation, limitations; kept current |
| Record-keeping | Automatic logs enabling traceability |
| Transparency to deployers | Instructions covering purpose, accuracy, limitations, oversight |
| Human oversight | Interfaces that let people understand, intervene and override |
| Accuracy, robustness, cybersecurity | Declared and tested, including adversarial resilience |
| Conformity assessment, registration | Before placing on the market |
| Post-market monitoring, incident reporting | Ongoing |
Many of these are good practice regardless: evaluation evidence, documentation, oversight design and monitoring are what enterprise buyers ask for anyway.
Transparency duties in practice
- Tell people they are interacting with an AI system unless obvious from context.
- Mark AI-generated or manipulated content in a machine-readable way, and disclose deepfakes.
- Inform people exposed to emotion recognition or biometric categorisation (where those are permitted).
How PMs use this
- Classify each feature by tier and by your role.
- Remove prohibited functionality for EU users.
- Plan high-risk work early; documentation and oversight design take quarters, not weeks.
- Build transparency into the UX rather than the terms of service.
- Keep a dated register of obligations with counsel, because dates and guidance change.
In the interview
EU AI Act questions test careful handling of facts and the ability to turn regulation into product requirements. Strong answers classify the use, distinguish provider from deployer duties, state dates as of a specific month with appropriate hedging, and map obligations to product work. Overconfident, undated claims are a red flag to interviewers at companies with legal exposure.