EU AI Act

What is the EU AI Act?

Regulation (EU) 2024/1689 is the EU’s first horizontal law on artificial intelligence. It appeared in the Official Journal on July 12, 2024 and entered into force on August 1, 2024. Its obligations phase in over several years, and the schedule was amended in July 2026.

Risk classification anchors the Act. Unacceptable-risk practices are banned outright. High-risk systems face conformity assessment, registration, post-market monitoring, and human-oversight duties. Limited-risk systems face transparency duties such as deepfake disclosure. Minimal-risk systems carry no specific obligations. General-purpose AI models sit on a parallel track of transparency, copyright, and systemic-risk obligations.

Direct application to US law firms is narrow. It reaches the firm only when the firm itself develops, deploys, or distributes an AI system whose output is used in the EU. Indirect application is wider. Any firm with EU clients, EU-exposed clients, or US subsidiaries of EU parents will face client questions about what the Act requires of those clients.

Who must comply?

Two roles drive most operational compliance: providers and deployers.

• Providers: anyone who develops an AI system and places it on the EU market or puts it into service in the EU under their own name or trademark, with or without charge.
• Deployers: anyone using an AI system under their authority, except for personal non-professional use.
• Importers and distributors carry narrower roles. They primarily verify that the provider met its conformity-assessment duties before placing the system on the market.

Extraterritorial reach is broad. Providers and deployers established outside the EU are in scope whenever the AI system’s output is used in the EU. A US law firm running an AI tool to produce work product for an EU client may pull that tool inside the Act by virtue of where the output lands.

When does it apply?

As published in 2024, Article 113 set a general application date of August 2, 2026, with earlier dates for prohibitions and general-purpose AI and a later date for product-safety systems. Regulation (EU) 2026/1744, the “Digital Omnibus on AI,” adopted July 8, 2026, published in the Official Journal on July 24, 2026, and in force on July 27, 2026, amended Article 113 before the high-risk obligations took effect. Its recitals cite the delayed availability of standards and the delayed establishment of national authorities. The dates now in force are:

• February 2, 2025: Chapters I and II, including the prohibited practices and the AI literacy provision (Article 4, which the 2026 amendment rewrote as a duty to “take measures to support the development of AI literacy” of staff).
• August 2, 2025: general-purpose AI model obligations, governance structures, and penalties (except Article 101 fines on general-purpose AI providers).
• August 2, 2026: the general date of application, unchanged by the 2026 amendment. It covers the Article 50 transparency duties, among others. Providers of generative systems placed on the market before that date have until December 2, 2026 to comply with Article 50(2) marking of synthetic content.
• December 2, 2026: new prohibitions added by the 2026 amendment in Article 5.
• December 2, 2027: the high-risk requirements in Chapter III, Sections 1 to 3, for systems classified high-risk under Article 6(2) and Annex III (the use-case list covering, for example, employment, education, credit, and administration of justice). Originally August 2, 2026.
• August 2, 2028: the same high-risk requirements for systems that are safety components of products under Article 6(1) and Annex I. Originally August 2, 2027.

For most US firms advising EU-exposed clients, the next milestones are December 2, 2026, when the Article 50(2) grace period for generative systems already on the market ends and the new Article 5 prohibitions apply, and December 2, 2027, when the Annex III high-risk requirements apply. The Article 50 transparency duties otherwise already apply.

What does compliance documentation look like?

A client deploying a high-risk AI system in the EU should expect to produce, by the applicable high-risk date:

• A risk management system covering the system’s lifecycle, from design and training through deployment and post-market monitoring.
• Technical documentation per Annex IV: system architecture, training-data provenance, validation and testing methodology, accuracy and robustness metrics.
• Records of conformity assessment, either internal control or notified-body assessment, depending on system category.
• A registration entry in the EU database for high-risk systems before market placement.
• Human-oversight protocols specifying how a human reviewer can interpret, override, or stop the system.
• An incident-reporting workflow that meets the Act’s national-authority reporting timeframes.

For firms advising EU-exposed clients on Act readiness, that list is the diligence agenda.

How does the Act interact with US frameworks?

The Act runs parallel to, but independent of, Colorado’s AI law and the NIST AI RMF. Colorado’s original act (SB 24-205) borrowed the high-risk idea, but SB 26-189, signed May 14, 2026, repealed and reenacted it before it took effect. The reenacted Colorado law, applying from January 1, 2027, has no risk tiers: it regulates automated decision-making technology used to materially influence consequential decisions in listed domains such as employment, residential real estate, lending, insurance, and health care, through advance notice, an explanation after an adverse decision, and data-correction and human-review rights, with no conformity assessment (signed act). AI RMF is a voluntary US framework, not law, and gets no mention in the Act. Formal compliance under the Act runs through EU harmonized standards published by CEN/CENELEC and through Commission common specifications. Practical overlap is real: AI RMF documentation already covers much of the lifecycle territory the Act’s risk-management rules address. The evidentiary track the Act recognizes, though, is the harmonized-standard or common-specification one.

Firms that already document AI governance against AI RMF or ISO/IEC 42001 face a relabeling and extension exercise, not a separate program. Firms starting from scratch face the most prescriptive of the three frameworks.

Primary sources

• Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), Official Journal of the European Union, July 12, 2024: eur-lex.europa.eu.
• Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI), amending Article 113 and other provisions: eur-lex.europa.eu.
• Consolidated text of Regulation (EU) 2024/1689 as of July 27, 2026: eur-lex.europa.eu.
• Colorado SB 26-189 (signed May 14, 2026; applies to consequential decisions made on or after January 1, 2027): signed act (PDF); bill page.