EU AI Act: What It Is and How Purplecop Helps

What is the EU AI Act?

The EU AI Act is Regulation (EU) 2024/1689 of June 13, 2024, which lays down harmonized rules on artificial intelligence. The European Commission calls it the first-ever legal framework on AI and says it sets risk-based rules for AI developers and deployers.

It entered into force on August 1, 2024, the twentieth day after publication in the Official Journal (Article 113). It is "binding in its entirety and directly applicable in all Member States." This page is general information, not legal advice.

When does the EU AI Act apply as of October 26, 2026?

The Act applies in stages, and as of October 26, 2026 most of it applies while the high-risk rules are still to come. Under Article 113 as amended by Regulation (EU) 2026/1744:

• February 2, 2025: Chapters I and II, covering general provisions (including AI literacy) and the prohibited practices.
• August 2, 2025: the general-purpose AI chapter (Chapter V), governance (Chapter VII) and penalties (Chapter XII, except Article 101).
• August 2, 2026: the Act's general date of application, including the Article 50 transparency rules and Article 101. The Commission says the Act "became applicable on 2 August 2026, with some exceptions."
• December 2, 2026: the two new prohibitions added by the Omnibus (Article 5(1)(ba) and (bb)), and the deadline in Article 111(4) for synthetic-content providers already on the market to meet Article 50(2).
• December 2, 2027: Chapter III, Sections 1, 2 and 3 (except Article 6(5)) for high-risk systems under Article 6(2) and Annex III.
• August 2, 2028: the same provisions for high-risk systems under Article 6(1) and Annex I, meaning AI in regulated products.

Was the high-risk delay adopted, or is it only a proposal?

The delay is adopted law, not a proposal. Regulation (EU) 2026/1744, the Digital Omnibus on AI, is dated July 8, 2026 and was published in the Official Journal on July 24, 2026. Its Article 4 says it enters into force on the third day after publication, which is July 27, 2026, and the Commission's AI Act page gives the same date.

The original Regulation applied its general rules from August 2, 2026 and the Article 6(1) rules from August 2, 2027 (Article 113). The Commission's proposal was adopted on November 19, 2025, and the Commission says a political agreement followed on May 7, 2026.

This page describes only what is adopted as of October 26, 2026. It does not track later proposals, so check the Commission's AI Act page before you rely on a date.

Who does the EU AI Act apply to, including non-EU companies?

The Act applies to providers and deployers in the EU and to many outside it. Article 2(1) covers:

• providers placing AI systems on the market or putting them into service in the Union, or placing general-purpose AI models on the market there, "irrespective of whether those providers are established or located within the Union or in a third country";
• deployers established or located in the Union;
• providers and deployers in a third country, where the output of the AI system is used in the Union;
• importers, distributors, product manufacturers, authorized representatives and affected persons located in the Union.

What are the EU AI Act risk tiers?

The Commission describes four levels of risk:

• Unacceptable risk: banned practices.
• High risk: uses such as critical infrastructure, education, employment, essential services, law enforcement, migration and justice, subject to strict obligations.
• Transparency risk: disclosure duties, such as telling people they are interacting with an AI system and labeling deepfakes.
• Minimal or no risk: no specific rules, such as AI-enabled video games and spam filters.

Which AI practices does the EU AI Act ban?

Article 5(1) bans eight practices that have applied since February 2, 2025:

• manipulative or deceptive techniques that cause significant harm;
• exploiting vulnerabilities due to age, disability or a specific social or economic situation;
• social scoring that leads to detrimental or unjustified treatment;
• predicting criminal offenses based solely on profiling or personality traits;
• untargeted scraping of facial images from the internet or CCTV for facial recognition databases;
• inferring emotions in workplaces and education institutions, except for medical or safety reasons;
• biometric categorization to infer race, political opinions, religion, sex life or sexual orientation;
• real-time remote biometric identification in public spaces for law enforcement, unless a listed exception applies.

What makes an AI system high-risk, and what must providers and deployers do?

An AI system is high-risk if it is, or is a safety component of, a product under Annex I legislation that needs third-party conformity assessment (Article 6(1)), or if it falls in an Annex III area (Article 6(2)). Annex III covers biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice.

An Annex III system is not high-risk if it poses no significant risk of harm and meets a condition in Article 6(3), but it is always high-risk if it profiles natural persons.

Providers of high-risk systems must (Article 16):

• meet the requirements in Articles 9 to 15: risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity;
• run a quality management system (Article 17);
• complete a conformity assessment, draw up an EU declaration of conformity, affix the CE marking and register the system.

What are the AI Act transparency rules?

Article 50 sets four transparency duties, and they apply from August 2, 2026:

• Providers must design systems that interact directly with people so people are told they are dealing with an AI system, unless that is obvious (Article 50(1)).
• Providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format as artificially generated (Article 50(2)).
• Deployers of emotion recognition or biometric categorization systems must inform the people exposed to them (Article 50(3)).
• Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, with exceptions (Article 50(4)).

What rules apply to general-purpose AI models?

Providers of general-purpose AI models must keep technical documentation, give downstream providers the information they need, set a copyright policy and publish a training-content summary (Article 53(1)). Open-source models are exempt from the documentation duties unless they carry systemic risk (Article 53(2)).

A model is presumed to have high impact capabilities when training used more than 10^25 floating point operations (Article 51(2)). Providers of models with systemic risk must also run model evaluations including adversarial testing, mitigate systemic risks, report serious incidents and ensure cybersecurity protection (Article 55(1)). Providers may rely on codes of practice until a harmonized standard is published (Articles 53(4) and 55(2)). The Commission published a voluntary Code of Practice in July 2025.

What does the AI Office do?

The AI Office is the Commission's function for implementing, monitoring and supervising AI systems and general-purpose AI models, and for AI governance (Article 3(47)). The Commission says it holds enforcement powers over general-purpose AI models: it can request technical documentation, evaluate models, require corrective measures and issue fines.

What are the penalties under the EU AI Act?

Each fine is a ceiling, and Member States lay down the penalty rules (Article 99(1)). The ceilings in Article 99 are:

• Prohibited practices (Article 5): up to EUR 35,000,000 or, for an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)).
• Listed operator obligations, including providers (Article 16), deployers (Article 26) and transparency (Article 50): up to EUR 15,000,000 or up to 3%, whichever is higher (Article 99(4)).
• Incorrect, incomplete or misleading information to notified bodies or authorities: up to EUR 7,500,000 or up to 1%, whichever is higher (Article 99(5)).

Does Purplecop help with the EU AI Act?

The Purplecop AIMS page says it is Purplecop Security's product for governing the AI estate, covering model inventory, AI risk, AI controls and the evidence that an AI system is governed, "mapped to ISO/IEC 42001, the NIST AI RMF and the EU AI Act, across 10 modules."

Its AI Frameworks module lists the three as "mapped like any other framework." Other modules include Model Inventory, AI Risk Register, AI Policies and AI Vendor Assessment.

Mapping a product to the Act is not compliance, and Purplecop AIMS does not make an organization compliant with it. Compliance rests with the providers and deployers the Act covers. For related frameworks, see the NIST AI RMF, ISO/IEC 42001 and GDPR guides. Union data protection law continues to apply to personal data processed under the Act (Article 2(7)). To ask Purplecop Security a question, use the contact page.

Does the EU AI Act apply to companies outside the EU?

Yes, it can. Article 2(1) applies to providers placing AI systems or general-purpose AI models on the Union market wherever they are established, and to providers and deployers in third countries where the system's output is used in the Union.

When do the EU AI Act high-risk rules apply as of October 26, 2026?

Under the adopted Omnibus, the rules for Annex III high-risk systems apply from December 2, 2027, and the rules for high-risk AI in Annex I regulated products from August 2, 2028. Check the Commission's page for any later change.

Is the delay of the EU AI Act high-risk deadlines confirmed or still a proposal?

It is confirmed. Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026 and has been in force since July 27, 2026.

What is the maximum fine under the EU AI Act?

For prohibited practices, Article 99(3) sets up to EUR 35,000,000 or, for an undertaking, up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. It is a ceiling, not a standard fine.

Does the EU AI Act require a CE marking?

For high-risk AI systems, yes. Providers must affix the CE marking (Article 16(h)) after the relevant conformity assessment (Article 16(f)).

Can Purplecop AIMS make my organization EU AI Act compliant?

No. The Purplecop AIMS page says the product is mapped to the EU AI Act, and mapping is not compliance. Compliance is the legal responsibility of the providers and deployers the Act covers.