EU AI Act II: obligations, GPAI, dates and penalties

High-risk provider obligations

1. Risk management system across the whole lifecycle
2. Data and data governance: training, validation and test data relevant, sufficiently representative, examined for bias, and as error-free and complete as possible
3. Technical documentation (Annex IV)
4. Record-keeping: automatic logging of events
5. Transparency and instructions for use for deployers
6. Human oversight designed into the system
7. Accuracy, robustness and cybersecurity
8. Quality management system
9. Conformity assessment, EU declaration of conformity and CE marking
10. Registration in the EU database
11. Post-market monitoring and serious-incident reporting to market surveillance authorities

High-risk deployer obligations

• Use the system according to the instructions for use
• Assign human oversight to people with competence, training and authority
• Make sure input data under their control is relevant and representative
• Monitor operation; inform the provider and authorities of risks and serious incidents
• Keep automatically generated logs for at least six months
• Inform workers and their representatives before using high-risk AI at work
• Inform people when high-risk AI makes or assists decisions about them; affected people get a right to an explanation (Art. 86)
• Fundamental Rights Impact Assessment (Art. 27) before first use, for public bodies, private entities providing public services, and deployers doing credit scoring or life and health insurance risk pricing

General-purpose AI (GPAI) models

All GPAI providers: technical documentation; information and documentation for downstream providers; a policy to comply with EU copyright law, including rights-holder opt-outs; a publicly available summary of training content. Open-source models are exempt from the first two unless they have systemic risk.

GPAI with systemic risk (presumed when training compute exceeds 10^25 FLOPs, or designated by the Commission) must also: perform model evaluations including adversarial testing; assess and mitigate systemic risks; track and report serious incidents to the AI Office; ensure adequate cybersecurity.

The GPAI Code of Practice (July 2025) is a voluntary way to demonstrate compliance.

Key dates

The 2026 AI Omnibus moved the high-risk dates. The Commission proposed it in late 2025 and the Council gave final approval on 29 June 2026. It postponed Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I from 2 August 2027 to 2 August 2028, added the prohibition above, and softened the AI literacy duty (Art. 4) from ensuring staff literacy to supporting it.

For the exam, know both sets of dates. The AIGP Body of Knowledge v2.1 was approved in September 2025, before the Omnibus, so a question may still use the original ones: Annex III from 2 August 2026, Annex I from 2 August 2027.

Penalties (whichever is higher)

SMEs and start-ups pay whichever is lower. Enforcement sits with national market surveillance authorities; the EU AI Office supervises GPAI models.