Global AI Monitor
Preview

European Economic Area (EEA) · Module Detail

European Economic Area: High-Risk Systems

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

4 instruments · 7 obligations · 9 claims · Next: (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

4 instruments (4 current) · 7 obligations · 9 claims · 13 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Draft Commission guidelines on classification of high-risk AI systems Draft, no legal force

    Draft guidelines on Article 6 classification with examples for Annex I and Annex III.

    Verified · Official text
  • German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29

    German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.

    Binding · Authority: Federal Network Agency (Bundesnetzagentur) · Verified · Official text

Obligations

  • Article 16

    Providers of high-risk AI systems must ensure Section 2 compliance, run a quality management system, keep documentation and logs and complete conformity assessment before placing the system on the market.

    conformity assessment · Applies to: provider · Artificial Intelligence Act
  • Article 26(1)-(2)

    Deployers of high-risk AI systems must use them per instructions for use and assign human oversight to competent, trained and authorised natural persons.

    human oversight · Applies to: deployer · Artificial Intelligence Act
  • Article 73(1)-(2)

    Providers of high-risk AI systems must report serious incidents to the market surveillance authorities of the Member State where it occurred, immediately and in any event within 15 days of awareness.

    incident reporting · Applies to: provider · Artificial Intelligence Act
  • Article 4a(1)

    Providers of high-risk AI systems may exceptionally process special categories of personal data where strictly necessary for bias detection and correction, with appropriate safeguards.

    data governance · Applies to: provider · Artificial Intelligence Act
  • Article 27(1)

    Public-law bodies, private entities providing public services and deployers of certain Annex III point 5 systems must assess the impact on fundamental rights before deploying a high-risk AI system referred to in Article 6(2).

    fundamental rights impact assessment · Applies to: deployer · Artificial Intelligence Act
  • § 18

    When a provider or German authorised representative ceases business, the person responsible for liquidation or dissolution of the legal entity must discharge the Article 18(1) document-retention duty.

    record keeping · Applies to: provider · German AI market surveillance and innovation promotion act (KI-MIG)
  • Article 12, inserting Article 437-bis of the Criminal Code

    Omitting the technical safety measures or human oversight measures required for high-risk AI systems is a crime punished with one to five years' imprisonment where danger to life or public or individual safety results.

    prohibition · Applies to: provider · Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • German KI-MIG enters into force Met
    German AI market surveillance and innovation promotion act (KI-MIG)
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (9)

  • Derived: Probable Breach of provider, deployer, importer, distributor, transparency or GPAI obligations is subject to fines of up to EUR 15 million or 3% of turnover, whichever is higher.

    Confidence: Confirmed · As of 2 Aug 2025 · evidenced
    Evidence and sources

  • High-risk AI providers must meet Article 16 duties and report serious incidents under Article 73, and deployers must meet Article 26 duties, from 2 December 2027 for Annex III systems.

    Confidence: Probable · As of 2 Dec 2027 · evidenced
    Evidence and sources

  • The Omnibus deletes point 1 of Annex I Section A of the AI Act and lists the Machinery Regulation (EU) 2023/1230 as point 21 of Section B.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources

  • New Article 4a lets providers of high-risk AI systems exceptionally process special-category personal data where strictly necessary for bias detection and correction, with safeguards.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • AI Act Service Desk: Article 4a (consolidated text as amended) T1 · retrieved · retrieved 8 Oct 2026 · Article 4a(1)To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g), of this Regulation, providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards

  • Article 27 requires public-law bodies, public-service deployers, and certain Annex III point 5 deployers to assess fundamental-rights impact before deploying a high-risk AI system under Article 6(2).

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • AI Act Service Desk: Article 27 T1 · retrieved · retrieved 8 Oct 2026 · Article 27(1)Prior to deploying a high-risk AI system referred to in Article 6(2)... deployers that are bodies governed by public law, or are private entities providing public services... shall perform an assessment of the impact on fundamental rights that the use of such system may produce.

  • The Omnibus moves application of Chapter III Sections 1 to 3 to 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I systems.

    Confidence: Confirmed · As of 2 Dec 2027 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(40)(b), amending Article 113(b) point (c) is replaced by the following: '(c) Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III;
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Recital on application dates for high-risk systems2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I.
    • AI Act - Shaping Europe's digital future T1 · retrieved · retrieved 8 Oct 2026 · Omnibus timelinesystems used in certain high-risk areas — including biometrics, critical infrastructure, education, employment, migration, asylum and border control — will apply from 2 December 2027**.

  • The Commission published draft guidelines on high-risk classification on 19 May 2026 and invited views by 23 June 2026.

    Confidence: Confirmed · As of 19 May 2026 · evidenced
    Evidence and sources

  • Section 18 KI-MIG places the Article 18(1) AI Act documentation-retention duty on the person responsible for liquidating a provider or authorised representative that ceases business.

    Confidence: Confirmed · As of 29 Jul 2026 · evidenced
    Evidence and sources

  • Derived: Probable Article 12 of the Italian decree inserts Article 437-bis into the Criminal Code, punishing omission of required high-risk AI safety/oversight measures with one to five years' imprisonment where danger to life or safety results.

    Confidence: Probable · As of 30 Sep 2026 · evidenced
    Evidence and sources