EU AI Act Compliance: Track the Risk Tiers and Phased 2025-2027 Deadlines Without Missing a Change

Respect the prohibited-practice red lines (Article 5)

Certain uses are banned outright, including untargeted scraping of facial images to build recognition databases, social scoring by public authorities, manipulative or exploitative AI, and (with narrow exceptions) real-time remote biometric identification in public spaces. These prohibitions have applied since 2 February 2025.

Meet the high-risk system requirements

AI used in areas such as recruitment, credit scoring, education, critical infrastructure and law enforcement (Annex III), and AI embedded in regulated products (Annex I), must implement a risk management system, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity, plus conformity assessment and registration.

Provide transparency for limited-risk systems (Article 50)

Users must be told when they are interacting with an AI system (for example a chatbot), and AI-generated or manipulated content such as deepfakes and synthetic media must be disclosed and, where applicable, machine-readable as AI-generated.

Comply with general-purpose AI (GPAI) model obligations

Providers of GPAI models must maintain technical documentation, publish a summary of training content, and have a policy to respect EU copyright law. GPAI models posing systemic risk carry additional duties including model evaluation, systemic-risk assessment and mitigation, and serious-incident reporting.

Ensure AI literacy across staff (Article 4)

Providers and deployers must take measures to ensure a sufficient level of AI literacy among staff and others operating AI systems on their behalf, taking account of their technical knowledge, experience and the context of use. This duty applies from 2 February 2025.

Maintain documentation, oversight and post-market monitoring

High-risk providers must keep technical documentation and automatically generated logs, set up a post-market monitoring system, and report serious incidents to the relevant authorities; deployers must follow instructions for use and assign competent human oversight.

Be ready for enforcement and significant penalties

The Regulation sets tiered fines: up to EUR 35 million or 7% of total worldwide annual turnover for prohibited-practice breaches, up to EUR 15 million or 3% for most other obligation breaches, and up to EUR 7.5 million or 1% for supplying incorrect information, subject to the higher or lower figure as specified.

Weekly-monitors the EU institutions and trackers relevant to you (for example the Official Journal, the European Commission and the AI Office) and drafts a source-linked digest of changes, so if the Digital Omnibus is adopted, guidance lands, or a delegated act moves a deadline, you see it with the citation attached. Where a change hits a policy you have published, Watcher prepares DOCX track-changes redlines for your counsel to review.

Scores your uploaded AI governance policies, acceptable-use rules and notices against the AI Act corpus and shows where each obligation is missing, partial or covered, with a gap score, so you can prioritise the high-risk and transparency requirements that need work.

Builds your compliance profile by crawling your website and classifying your published policies, giving a starting picture of where AI-related obligations may touch your business. Your counsel reviews and edits the profile so scope decisions stay with qualified people.

Gives you the registers and workflow to evidence the work: a risk register with a 5x5 matrix for AI risk assessment, a controls library mapped to obligations, DPIA and incident records, vendor and asset registers, plus a review and approval workflow and dashboards so accountability is documented.

Scores vendor and third-party risk and reconciles your privacy notice against your registers, useful where AI systems process personal data or rely on external model and data providers that need to be tracked.