EU AI Act: The Regulation Reshaping AI
In August 2026, most of the key requirements of the European Union’s AI Act will come into force. This is the first comprehensive regulatory framework of its kind, designed to govern the development and use of AI systems. It also introduces a strict enforcement mechanism, with penalties reaching up to 35 million euros or 7 percent of a company’s global annual turnover.
In August 2026, most of the key requirements of the European Union’s AI Act will come into force. This moment is expected to mark one of the most significant turning points in the evolution of artificial intelligence. For technology companies, organizations developing AI systems, and businesses operating in the European market, this represents a major regulatory shift that requires early preparation.
The EU AI Act is the first comprehensive framework aimed at regulating how AI systems are developed and used. Its purpose is to strike a balance between encouraging technological innovation and protecting fundamental rights, user safety, and algorithmic transparency. The law applies to nearly every field in which AI is used, ranging from financial and medical systems to systems used for recruitment, customer service, and critical infrastructure.
It is important to note that the law does not apply only to European companies. Any organization that offers AI systems in the European market or operates systems that affect users within the European Union may be subject to its requirements This means that organizations outside the European Union offering AI solutions to European users should already be assessing their readiness to comply.
Gradual Implementation of the AI Act
The EU AI Act officially entered into force in 2024, but its implementation is being phased in over several years. This approach is intended to give organizations time to adapt their processes, documentation, risk management practices, and data governance frameworks.
At the beginning of 2025, the first provisions came into effect, focusing on the prohibition of certain AI applications considered to pose an unacceptable risk to fundamental rights. These include systems used for social scoring of individuals, manipulative systems designed to influence user decisions, predictive policing systems based primarily on personal profiling, and systems that create facial recognition databases by collecting images from the internet or surveillance cameras. These restrictions are intended to establish clear boundaries for the use of AI technologies and to ensure that such systems do not undermine fundamental rights, user autonomy, or public trust.
At the same time, initial requirements for General Purpose AI models came into force during 2025. These are large scale models that serve as the foundation for a wide range of applications. They are required to meet transparency obligations, provide information about how they operate, document key data sources, and assess potential risks associated with their use. These requirements are designed to increase accountability and oversight of powerful models such as large language models and generative AI systems.
The next major milestone will take place in August 2026, when most of the regulatory requirements for high risk AI systems will come into full effect. These include detailed technical documentation, risk management frameworks, bias testing, monitoring and control mechanisms, and in some cases formal conformity assessments.
Many systems already in use today may fall into this category. These include AI systems used in recruitment and candidate screening, credit scoring and insurance risk evaluation, machine learning based medical diagnostics, and large scale facial recognition systems. For organizations relying on such technologies, this means reassessing development, deployment, and governance practices.
The law also introduces a strict enforcement regime. Serious violations, such as the use of prohibited AI systems, can lead to fines of up to 35 million euros or 7 percent of global annual turnover. Non compliance with requirements for high risk systems may result in penalties of up to 15 million euros or 3 percent of turnover. Even less severe violations, such as providing incorrect information to regulators, may result in fines of millions of euros. Compliance is therefore not only a regulatory issue, but a significant business risk.
A Risk Based Approach to Regulation
The AI Act is built on a risk based approach. Rather than applying the same rules to all AI systems, it classifies them based on their potential impact on individuals and society. Systems considered to pose an unacceptable risk are banned entirely. These include applications that may violate fundamental rights or enable intrusive forms of surveillance.
High risk systems are allowed but subject to strict requirements. These include systems used in hiring decisions, credit scoring, healthcare, and critical infrastructure, as well as those used in the public sector.
Other systems are classified as limited or minimal risk and are subject mainly to transparency obligations, such as informing users when they are interacting with an automated system.
What Organizations Need to Do
One of the central requirements of the regulation is the ability to assess and manage risks associated with AI systems. Organizations must determine which category each system falls into and ensure compliance with the relevant requirements.
Data governance is another key aspect. The regulation sets clear expectations regarding the quality of training data. Organizations must demonstrate that their data is accurate, relevant, and representative, and that mechanisms are in place to identify and mitigate bias. In addition, organizations are required to maintain full documentation of data sources and how they are used throughout the model lifecycle.
Alongside data governance requirements, the regulation also mandates transparency and technical documentation of the model itself. AI systems can no longer operate as a “black box”. Organizations must document development processes, training and testing procedures, architectural decisions, and monitoring mechanisms. This documentation forms the basis for demonstrating compliance and may be required for regulatory assessments.
In the case of high risk systems, formal conformity assessments may be required, and in some cases a CE marking must be obtained to confirm compliance with European standards.
Moving Toward Responsible AI
The broader implication of the EU AI Act is a shift toward Responsible AI. Organizations can no longer focus solely on technological advancement. They must integrate innovation with data governance, cybersecurity, risk management, and regulatory compliance.
Companies that begin mapping their AI systems, establishing governance frameworks, and implementing proper documentation and oversight processes today will be better positioned when the regulation comes fully into effect.
At Matrix, we support organizations in designing and implementing AI solutions that combine innovation with compliance with international regulations. We help organizations unlock the business value of AI while ensuring transparency, security, and effective risk management, particularly in sensitive sectors such as healthcare, financial services, and the public sector.
For more information about our AI solutions and to get in touch, please visit our AI page.
