Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, read from the Official Journal text rather than from somebody else's summary of it.
It does not ask how your AI works. It asks what it does to the person in front of it.
You do not have to build anything. Buying a tool and pointing it at your customers puts you in scope.
A company established outside the EU is in scope where the output its system produces is used in the Union.
You put a system on the market under your own name or brand, including one you had built for you, and including one you licensed from a vendor and rebadged.
You use someone else's system in your own work. Most organisations sit here and assume it means they are exempt.
Different systems, different roles. Almost nobody has written down which is which.
Buy a chatbot and put your own name on it and you stop being a deployer. Article 3(3) makes you the provider, with the provider’s duties.
Live now
Eight practices banned outright. Two more from 2 December 2026.
Take measures supporting AI literacy in your people.
Tell people when they are dealing with AI, or with AI-generated content.
Market surveillance. The enforcement machinery itself.
Not yet
2 December 2027
2 August 2028
€35M
or 7% of worldwide turnover
Article 5, banned practices. Article 99(3).
€15M
or 3% of worldwide turnover
Article 50, transparency. Article 99(4).
Set nationally
each Member State decides
Article 4, literacy. Article 99(1).
The higher of the two figures applies, except for SMEs and start-ups under Article 99(6), where the ceiling inverts to the lower, and for small mid-caps under Article 99(6a), which reaches the €15M and €7.5M tiers but not the Article 5 one. The Article 5 tier applies to Article 5 alone and is never combined with another.
Most organisations answer to their national market surveillance authority: the same regime that pulls unsafe products off shelves, extended to AI systems on 2 August 2026.
If you built your system on your own general-purpose AI model, or it sits inside a very large online platform or search engine, you answer to the AI Office in Brussels instead. That is a narrow category, and it is a question most companies have never asked about themselves.
The standard product-safety powers every Member State must give its market surveillance authority. On 2 August 2026 they reached AI systems.
The power to carry out unannounced on-site inspections is written into the market surveillance regulation.
Any premises, land or vehicle you use for the business, to identify non-compliance and obtain evidence.
And inspect it, and reverse-engineer it, to obtain evidence. Regulation (EU) 2019/1020, Article 14(4)(j).
Where the risk is serious enough, order content off your site or a warning displayed to your users, and if you do not comply, require your hosting provider to restrict access to it.
They do not need a complaint. They can open an investigation on their own initiative.
And if you are one of the organisations that falls to the AI Office instead, it can seal your premises and your records, question your staff on the record, charge you the full cost of its own investigation, and impose penalty payments that accrue every day until you comply.
There is no grace letter and no reminder. And where the AI Office enforces, the five-year limitation period on a breach that continues (an unlabelled chatbot that stays unlabelled) does not start running until the day you fix it.
Replaced in full on 27 July 2026. The duty got lighter and the evidence got harder: an obligation of effort has no certificate at the end of it, only the record.
Read the pageFour duties, split between the people who build a system and the people who use one. The split is where most organisations get it wrong.
Read the pageA compliance assessment. We go through what you run, which duties reach it, and what is outstanding. No obligation, and you keep the findings either way.
Book assessment