Provider
You develop an AI system or model, or have one developed, and put it on the EU market under your own name. Most duties land here.
Art. 3(3) · Art. 16
Regulation (EU) 2024/1689 · the EU AI Act
The AI Actfor people who ship
Europe wrote the world's first horizontal AI law. This guide skips the press releases and covers what engineers and their product leads need: what the law does, which parts apply now, what they cost, and whether it helps or hurts European companies.
00 — Cast
Pick your character
Your duties depend more on which role you play than on how clever your model is. Pick the one closest to you. The rest of the guide adapts to it, and you can switch at any time.
Deployer
You use someone else's AI system in a professional capacity. Example: your HR team using a CV screening tool. Lighter duties, but they are real.
Art. 3(4) · Art. 26
Model provider
You train or substantially modify a general-purpose AI model and release it, through an API or as open weights. This role has its own set of rules.
Art. 3(63) · Arts. 51–56
Importer & distributor
You bring a non-EU provider's AI system into the EU, or resell it. For high-risk systems, your job is to check that the provider did theirs.
Arts. 23–24
Plot twist (Art. 25): a deployer becomes a provider if they put their own brand on a high-risk system, make a , or repurpose a system so that it becomes high-risk. Your "simple integration" can make you the provider.
Find your wanted level01 — Risk tiers
Your wanted level
The Act doesn't regulate "AI". It regulates uses of AI, and the obligations grow with the risk of the use. Same model, different use, different tier.
General-purpose models (GPAI) sit outside this ladder. They have their own track, covered in section 05.
Check the timeline02 — Timeline
The road so far
The Act is phased in over several years. In 2026 the moved the high-risk dates back by 16 to 12 months. Several parts already apply today.
03 — Self-check
Run the check
Answer for one AI system or use case. The result updates as you go. This is a first triage to bring to your lawyer, not a substitute for one.
04 — Fines
The bill
Fines follow the GDPR model: a fixed amount or a share of worldwide annual turnover. Large companies pay whichever is higher. SMEs and start-ups pay whichever is lower (Art. 99).
€50M
€1M€100M€10B€500B
These are maximums. Authorities weigh how serious the breach was, how long it lasted, whether you cooperated, and what you did to limit the damage. The Commission fines GPAI model providers directly, up to €15M or 3% (Art. 101), and those powers apply from 2 Aug 2026.
05 — Foundation models
The big models
have had their own rules since 2 Aug 2025. Every GPAI provider has a baseline of duties. Above a compute threshold the model is presumed to carry , and much heavier duties apply.
Rough training compute: C ≈ 6 · N · D
The 6·N·D rule of thumb holds for dense transformers. The Act counts the cumulative compute used for training, synthetic data generation included. The Commission can change the threshold by delegated act.
6.3 × 10²⁴ FLOP
Every GPAI provider Art. 53
- Technical documentation of the model, held ready for the AI Office
- Information and documentation for downstream providers who build on the model
- A policy for complying with EU copyright law, including machine-readable text-and-data-mining opt-outs
- A public summary of the training content, using the Commission's template
Open-weight models under a free and open licence skip the first two. They do not skip copyright or the summary, and they get no exemption if they carry systemic risk.
Systemic-risk models Art. 55
- State-of-the-art model evaluations, including adversarial testing
- Assess and mitigate systemic risks at EU level
- Track serious incidents and report them to the AI Office without undue delay
- Adequate cybersecurity for the model and its infrastructure
Providers must notify the Commission within 2 weeks of crossing, or foreseeing, the threshold.
The Code of Practice
Published in July 2025, with three chapters: transparency, copyright, and safety & security. Signing it is voluntary. It gives you a recognised way to show compliance until harmonised standards exist. Most large US and EU labs signed. Some signed only parts, and at least one big lab refused.
Fine-tuning a model makes you its provider only if the modification is significant. The Commission's guidelines use roughly one third of the original training compute as the indicator.
06 — The European view
Side A, Side B
Is the AI Act a competitive advantage or a handbrake for European companies? Both. Flip the tape.
Liner notes
For most European tech companies the AI Act is a documentation and governance job, not a product ban. Very few of the practices it outlaws were legitimate business models anyway. The real cost sits in high-risk systems. That cost is fixed, comes up front, and weighs on a 12-person start-up much more than on a hyperscaler. The payoff is one set of rules for 450 million customers, with foreign competitors bound by the same rules. That payoff only arrives if the standards ship, the 27 national regulators enforce the same way, and Brussels stops moving the dates.
07 — Playbook
What to do on Monday
A pragmatic order of operations for a tech team. Your progress is saved in this browser only.
08 — Glossary