Frequently asked questions

If your organisation places an AI system on the EU market, puts it into service in the EU, or uses it within the EU — yes. The Act applies regardless of where your company is headquartered. A US startup with EU customers is just as in scope as a Berlin enterprise.

The Act defines an AI system broadly: any machine-based system that, for explicit or implicit objectives, infers from input how to generate outputs like predictions, recommendations, or decisions. This includes traditional ML models, LLM-based products, rule-based expert systems with inference, and hybrid approaches.

The Act is phased. Prohibited-practice and AI-literacy provisions have applied since February 2025, and obligations for providers of general-purpose AI models began in August 2025. Article 50 transparency duties apply from August 2026. Following the 2026 AI Omnibus, Annex III high-risk rules apply from 2 December 2027 and high-risk rules for AI embedded in regulated products apply from 2 August 2028. Your duties also depend on whether you are a provider, deployer, importer, or distributor.

Fines range up to €35 million or 7% of global annual turnover (whichever is higher) for prohibited practices, up to €15 million or 3% for other violations, and up to €7.5 million or 1% for providing incorrect information. SMEs and startups face proportionate amounts based on turnover.

Start with our free exposure check. It highlights obvious high-risk, prohibited-practice, and transparency triggers, but it is not a definitive classification. Pilot customers receive a fuller, source-linked assessment reviewed with a qualified compliance professional.

Probably not, unless you're using it in a way that affects employment decisions, access to essential services, or other Annex III areas. Internal knowledge management, drafting, and brainstorming with a general-purpose AI tool typically fall into the minimal or limited-risk category. Transparency obligations may still apply.

Yes. The risk classification is based on the intended purpose and use case, not the technology alone. If you expand a recommendation engine into a credit-scoring tool, it may move from minimal to high-risk. You should reclassify whenever the intended purpose changes materially.

The current public exposure check is a deterministic screening tool, not a machine-learning model. EUAIFit is developing a versioned, source-linked classification workflow for expert-supported pilots.

A clear system can usually be screened in 10–15 minutes, but a defensible classification may require product, legal, privacy, and technical input. During the pilot we help customers build the inventory, resolve missing facts, and prepare a reviewable evidence pack.

GDPR is separate from the AI Act but often overlaps, especially around automated decision-making, lawful processing, impact assessment, and transparency. The pilot flags areas for specialist review; it does not replace a GDPR assessment.

The UK has its own approach to AI regulation, currently sector-based rather than a single horizontal law. EUAIFit's EU AI Act module is our first release. A UK-specific guidance module is planned for early 2027.