AI Act. Obligations, fines, and what your company needs to do.
About a regulation many firms still treat as science fiction. Penalties for prohibited practices have been enforceable since February 2025. For real, not someday.
And again I hear “the AI Act does not apply to us, we do not build AI.” Then it turns out the HR department uses candidate scoring, marketing runs automation based on a model, and customer service has a chatbot. All of these are AI systems within the meaning of the regulation. The AI Act applies to whoever uses AI, not only to whoever builds it.
TL;DR
- Four risk classes: unacceptable (prohibited), high, limited, minimal
- Fines for prohibited practices: up to 35 million euros or 7% of global turnover
- Prohibited practices enforceable since February 2025; most obligations from 2 August 2026
- High-risk obligations: risk assessment, documentation, human oversight, transparency, post-market monitoring
Four risk classes
The AI Act categorises systems by risk. Unacceptable, meaning prohibited: behavioural manipulation, social scoring, mass facial recognition in public spaces. High risk: recruitment, credit scoring, access to essential services, among others. Limited: chatbots and deepfakes with a transparency obligation. Minimal: everything else, no additional requirements.
This is the first step of any implementation: inventory your AI systems and assign a class. Without that you do not know which obligations apply to you.
Fines that make an impression
For applying prohibited practices: up to 35 million euros or 7% of total annual global turnover, whichever is higher. For breaching obligations for high-risk systems the fines are lower, but still in the millions of euros and percentages of turnover. This is GDPR-level and above.
Timelines
This is not the distant future. Bans on prohibited practices have been in force and enforceable since February 2025. Rules for general-purpose AI models entered into force in August 2025. Most provisions relevant to firms deploying high-risk systems start applying from 2 August 2026. There is less preparation time than it feels like.
What actually needs to happen
In order. Inventory AI systems and classify by risk. For high-risk systems: Fundamental Rights Impact Assessment (FRIA), technical documentation, human oversight, transparency toward users, post-deployment monitoring. Plus AI Literacy; genuine team knowledge about what they are actually using.
How to manage this
The foundation is a register: one inventory of AI systems with risk class, FRIA status, and assigned oversight. Everything else follows from the class.
The AI Act module has the AI system register, risk classification, FRIA, and human oversight tracking in one place; and signals flag when a high-risk system has no completed assessment. Not sure if other regulations apply to you too? Check with the Regulatory Checker. Better to have it sorted before August 2026 than during an inspection.
Written by someone on the RealSec team. Want to talk specifics ; get in touch.