EU AI Act Compliance
The EU AI Act is the world's first comprehensive regulation of artificial intelligence. High-risk AI system obligations became enforceable on August 2, 2026. Organizations deploying autonomous AI agents within the EU — or serving EU users — must classify their AI systems by risk, implement transparency measures, and ensure human oversight for high-risk applications. Zabta maps these requirements to enforceable policies so you can measure and demonstrate compliance now that enforcement is live.
Enforcement timeline
| Date | Milestone |
|---|---|
| August 1, 2024 | EU AI Act entered into force |
| February 2, 2025 | Prohibited AI practices ban takes effect |
| August 2, 2025 | General-purpose AI model rules apply |
| August 2, 2026 | Full enforcement — high-risk AI system requirements, Annex III, Article 50, FRIA |
| August 2, 2027 | Requirements for AI systems that are components of large-scale IT systems |
Risk classification
Banned outright. Includes social scoring by governments, real-time biometric identification in public spaces (with narrow exceptions), manipulation of vulnerable groups, and untargeted scraping to build facial recognition databases.
Permitted with strict requirements. Includes AI used in critical infrastructure, education, employment, access to essential services, law enforcement, migration, and administration of justice. Requires conformity assessments, risk management, data governance, human oversight, transparency, and cybersecurity.
Transparency obligations only. Includes chatbots (must disclose AI nature), emotion recognition systems, biometric categorization, and AI-generated content (deepfakes, synthetic media).
No specific obligations under the EU AI Act. Most AI applications fall here — spam filters, AI-enabled video games, inventory management.
How Zabta maps to EU AI Act requirements
| Requirement | Article | How Zabta addresses it |
|---|---|---|
| Risk classification | Art. 6 | Automatic risk tier assignment in every evaluation response |
| Risk management system | Art. 9 | Policy engine evaluates against known risk categories; compliance dashboard tracks risk posture |
| Data governance | Art. 10 | Policies check for unauthorized data access and processing of personal data |
| Transparency | Art. 13 | Escalation for actions requiring AI disclosure to end users |
| Human oversight | Art. 14 | Escalate decisions route high-risk actions to human reviewers before execution |
| Record-keeping | Art. 12 | Full audit log of every evaluation with decision, policy, citation, and timestamp |
| Conformity assessment | Art. 43 | Compliance dashboard provides per-jurisdiction readiness scoring and gap analysis |
| Incident reporting | Art. 62 | Incident timer tracking — 360 hours standard, 48 hours for widespread harm scenarios |
Activating EU coverage
# In the dashboard: Go to Jurisdictions → Activate "European Union" pack
# Or via API:
import requests
requests.post(
"https://api.zabta.ai/api/v1/jurisdiction-packs/eu/activate",
headers={"Authorization": "Bearer <your_token>"}
)Once activated, every agent evaluation automatically checks against EU AI Act policies in addition to universal policies. The compliance dashboard shows your EU AI Act readiness score.
What happens at enforcement
Since August 2, 2026, the EU AI Act imposes tiered penalties based on the severity of non-compliance:
Prohibited AI practices
Up to €35 million or 7% of global annual revenue
High-risk system requirements
Up to €15 million or 3% of global annual revenue
Incorrect information to authorities
Up to €7.5 million or 1% of global annual revenue
Getting started
- Integrate the Zabta SDK into your agent — SDK Quickstart
- Activate the EU jurisdiction pack from the Jurisdictions page
- Check your compliance dashboard to see your current EU AI Act readiness score and identify gaps
Related