Key facts
- What it is: Regulation (EU) 2024/1689, the EU’s risk-based legal framework for developing, deploying, and using AI.
- In force: 1 August 2024, with obligations applying in phases through 2028.
- Who it applies to: Providers placing AI systems or general-purpose AI (GPAI) models on the EU market, plus certain providers and deployers outside the EU where the system’s output is used in the Union.
- Who enforces it: National market surveillance authorities together with the EU AI Office.
- Maximum penalty: Up to €35 million or 7% of worldwide annual turnover, whichever is higher.
How the EU AI Act Works
AI has outpaced the guidance needed to govern how it is built, deployed, and monitored. The Act closes that gap with a risk-based system: the greater the potential harm of an AI system, the stricter the obligations on its provider and deployer.
Extraterritorial reach. The Act applies beyond the EU’s borders. It covers providers placing AI systems or GPAI models on the EU market, and certain providers and deployers established outside the EU whose system’s output is used in the Union.
Two-tier enforcement. Enforcement is coordinated between national market surveillance authorities and the EU AI Office. The structure will feel familiar to any organization already navigating GDPR compliance.
Implementation Timeline
The Act is being implemented in phases. The AI Omnibus simplification package, in force since 27 July 2026, extended the deadlines for high-risk systems.
| Date | What applies |
| 1 August 2024 | The Act enters into force |
| 2 February 2025 | Prohibited practices and AI literacy requirements |
| 2 August 2025 | GPAI model obligations |
| 2 August 2026 | Transparency requirements and enforcement powers |
| 2 December 2026 | New Article 5 prohibitions on AI-generated non-consensual intimate imagery and child sexual abuse material (added by the AI Omnibus) |
| 2 December 2027 | Most use-based high-risk systems under Annex III, including biometrics, employment, and migration |
| 2 August 2028 | High-risk systems embedded in regulated products, such as medical devices |
Risk Categories Under the EU Artificial Intelligence Act
The Act separates AI systems into four tiers based on the potential harm they pose, and treats GPAI models as a separate category.
Unacceptable Risk
Banned practices include social scoring, manipulative or exploitative AI, and real-time remote biometric identification in public spaces for law enforcement, subject to narrow exceptions.
High-Risk
Systems used in key sectors, including employment, education, and credit scoring. They face strict obligations covering risk management, data governance, technical documentation, human oversight, and conformity assessment.
Limited Risk
Examples include chatbots and AI-generated content. They carry transparency requirements, including disclosure that users are interacting with AI or that content is AI-generated.
Minimal Risk
Most AI applications. They are not subject to specific obligations under the Act.
General-Purpose AI (GPAI) Models
Foundation models underpin many downstream applications. Obligations cover technical documentation and copyright compliance, and in some cases additional safety testing and incident reporting.
EU AI Act vs. Related Regulations
The AI Act is often confused with other AI-related regimes. The main difference is what each one regulates.
| EU AI Act | GDPR | Cyber Resilience Act | NIST AI RMF | |
| Regulates | AI systems and GPAI models | Processing of personal data | Products with digital elements | Management of AI risk |
| Applies to | Providers and deployers of AI | Controllers and processors | Manufacturers, importers, distributors | Any organization (voluntary) |
| Nature | EU regulation | EU regulation | EU regulation | Voluntary framework |
| Core question | “Is this AI system safe, transparent, and accountable?” | “Is personal data lawfully protected?” | “Is the product secure throughout its lifecycle?” | “How do we identify and manage AI risk?” |
These regimes can apply at the same time. An AI-powered web application that processes personal data may fall under the AI Act and GDPR, and potentially the CRA.
Why the EU AI Act Matters
- Financial penalties: Fines depend on the infringement’s nature, gravity, and duration.
- Up to €35 million or 7% of global annual turnover for the most serious violations, such as deploying banned AI practices.
- Up to €15 million or 3% for certain breaches involving operators or notified bodies.
- Up to €7.5 million or 1% for supplying incorrect, incomplete, or misleading information.
- Lower fixed maximums apply in certain cases, for example €1.5 million and €750,000 for EU institutions and bodies.
- Global reach: Organizations outside the EU are in scope if their AI output is used in the Union.
- Deadlines are staggered, not suspended: The Omnibus delayed most high-risk obligations, but prohibited practices, GPAI obligations, and transparency requirements are not on the delayed timeline.
- Familiar enforcement model: National authorities plus the EU AI Office mean organizations should expect active, GDPR-style oversight.
EU AI Act Risks in the Browser
The Act regulates AI across many use cases, and many reach users through browser-based applications. The AI may run on a server, but client-side components often present outputs, collect inputs, deliver transparency notices, and enforce user-facing controls.
- Transparency happens in the browser. Article 50 requires certain AI systems to tell users they are interacting with AI. In web applications, this usually appears as client-side UI elements, notices, labels, and disclosures, so the integrity of those controls matters for compliance.
- Decisioning logic is often exposed. Fraud checks, personalization engines, and eligibility screening sometimes place scoring logic in client-side code to reduce latency. Attackers can inspect, reverse-engineer, or manipulate that logic, which may undermine the robustness, accuracy, and oversight controls expected of high-risk systems.
- GPAI integrations widen the attack surface. Organizations that integrate third-party GPAI models through client-side SDKs or browser API calls can expose API keys, prompts, model configuration, or other sensitive information in front-end code.
- Bot and fraud-detection AI is a direct target. Systems used in fraud detection, credit assessment, and employment-related decisions are the ones most likely to be probed by bots and automated attackers trying to manipulate outcomes.
- Model integrity becomes a compliance concern. When models or decisioning components are distributed to browsers, mobile apps, or edge devices, they become vulnerable to tampering, model extraction, and unauthorized modification. This can undermine the robustness and cybersecurity expectations the Act places on certain regulated AI systems.
The Act does not specifically require code obfuscation, tamper detection, or webpage monitoring. These are practical measures that can support its broader documentation, transparency, oversight, and cybersecurity expectations.
Best Practices for EU AI Act Readiness
- Classify your AI systems. Map every system to a risk tier and identify whether you act as a provider, a deployer, or both.
- Build an AI inventory. Record which models, vendors, and use cases are in production, including third-party GPAI integrations.
- Track phased deadlines. Keep prohibited practices, GPAI, transparency, and high-risk dates on a single compliance calendar.
- Invest in AI literacy. Ensure staff who build and operate AI systems understand their obligations.
- Protect transparency controls. Make sure AI disclosures, labels, and notices delivered in the browser cannot be removed or altered without detection.
- Keep sensitive logic and secrets out of the client. Avoid exposing API keys, prompts, and model configuration in front-end code, and protect any scoring logic that must run client-side.
- Defend against bots and automation. Harden fraud-detection and decisioning AI against probing and manipulation.
- Add runtime protection. Use code obfuscation, runtime tamper detection, and webpage integrity monitoring to reduce the risk of inspection, tampering, and unauthorized modification.
- Document and review. Keep technical documentation and evidence of your controls current as the Act’s obligations phase in.
Related Resources
Solutions by Jscrambler
Jscrambler’s Unified Client-Side Security Platform helps protect client-side AI logic with LLM-resilient code obfuscation and runtime tamper protection, reducing the risk of inspection, extraction, and unauthorized modification. Additionally, Jscrambler monitors the third-party scripts and embedded AI agents running in the browser and detects unauthorized changes. Neither product alone makes an organization compliant with the EU AI Act.
Frequently Asked Questions
What is the EU AI Act?
The EU AI Act is the first comprehensive legal framework governing the development, deployment, and use of artificial intelligence. It applies a risk-based approach, with stricter obligations for higher-risk systems.
When does the EU AI Act apply?
The Act entered into force on 1 August 2024 and applies in phases. Prohibited practices and AI literacy apply from 2 February 2025, GPAI obligations from 2 August 2025, and transparency requirements and enforcement powers from 2 August 2026.
Have the high-risk rules been delayed?
Yes. Following the AI Omnibus, which came into force on 27 July 2026, most use-based high-risk systems under Annex III now apply from 2 December 2027, and high-risk systems embedded in regulated products from 2 August 2028.
Does the EU AI Act apply to companies outside the EU?
Yes. It applies to providers placing AI systems or GPAI models on the EU market, and to certain providers and deployers outside the EU where the system’s output is used in the Union.
What are the four risk tiers?
Unacceptable risk (banned), high-risk (strict obligations), limited risk (transparency requirements), and minimal risk (no specific obligations). GPAI models sit in their own category.
What are the penalties for non-compliance?
Fines can reach €35 million or 7% of global annual turnover for the most serious violations, €15 million or 3% for certain other breaches, and €7.5 million or 1% for supplying incorrect, incomplete, or misleading information.
Does the EU AI Act require client-side security measures like code obfuscation?
Not specifically. However, many AI systems are delivered through browser-based applications, and protecting client-side code integrity can support the Act’s transparency, robustness, and cybersecurity expectations.