What is EU AI Act?
The EU's Artificial Intelligence Act. It bans a short list of AI practices, sets requirements for high-risk AI systems, adds transparency duties for some others, and regulates general-purpose AI models — with the duties falling on each system according to the organisation's role for it.
Providers that place AI systems on the EU market, deployers that use them in the course of their work in the EU, importers and distributors — and a provider or deployer outside the EU where its AI system's output is used in the EU. It applies directly in every member state, Ireland included; it needs no national transposition.
For a provider of a high-risk system, from becoming aware — 10 days in the event of a death, 2 for a widespread infringement or critical infrastructure (Article 73).
A deployer keeps a high-risk system's logs, where under its control, for at least six months unless other law says otherwise (Article 26(6)).
Moved from 2 August 2026 by the Digital Omnibus on AI (Regulation (EU) 2026/1744).
Dates that matter
- 2 February 2025Chapters I and II apply: the general provisions, including the AI literacy duty in Article 4, and the prohibited practices in Article 5.
- 2 August 2025Chapter III Section 4 (notifying authorities and notified bodies), Chapter V (general-purpose AI models), Chapter VII (governance), Chapter XII (penalties) and Article 78 apply, except Article 101 (fines on general-purpose AI model providers).
- 2 August 2026The general date of application. This includes the transparency duties in Article 50 and Article 101. The high-risk rules in Chapter III Sections 1 to 3 do not apply from this date: the Omnibus moved them.
- 2 December 2026The prohibitions the Omnibus inserted in Article 5(1)(ba) and (bb) — non-consensual intimate material and child sexual abuse material — apply. Providers of content-generating AI systems placed on the market before 2 August 2026 must comply with Article 50(2) marking by this date.
- 2 December 2027Chapter III Sections 1, 2 and 3 (except Article 6(5)) apply to AI systems classified as high-risk under Article 6(2) and Annex III — including the deployer obligations in Article 26 and the fundamental rights impact assessment in Article 27.
- 2 August 2028Chapter III Sections 1, 2 and 3 apply to AI systems classified as high-risk under Article 6(1) and Annex I.
What people get wrong
The duties follow the system, and your role for it
The Act does not assess an organisation as a whole. A bank can be the deployer of a credit-scoring model, the provider of a chatbot it built, and a deployer of a general-purpose assistant, with three different sets of duties. That is why the workspace is a register of systems rather than a questionnaire.
High-risk is a list, then a derogation
A system is high-risk if it is a safety component of a product under the EU product-safety laws in Annex I that needs third-party conformity assessment, or if it is used in one of the Annex III areas — biometrics, critical infrastructure, education, employment, essential services and benefits, law enforcement, migration and justice. An Annex III system can fall outside under Article 6(3), if it poses no significant risk of harm on one of four narrow conditions — but never if it profiles people.
The Digital Omnibus moved the high-risk dates
Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk rules to 2 December 2027 for Annex III systems and 2 August 2028 for products. It also rewrote the AI literacy duty and added two prohibitions from 2 December 2026. The Article 49 registration and Article 73 incident duties were not moved; the text does not say how their date combines with the moved classification rules, and the workspace shows that rather than resolving it.
A deployer's fundamental rights impact assessment
Bodies governed by public law, private entities providing public services, and every deployer of credit scoring or life and health insurance pricing assess the impact on fundamental rights before first use, and notify the market surveillance authority of the results. The AI Office has not published its template, so the workspace's record is structured to Article 27(1).
Who supervises it in Ireland
S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, designates sectoral market surveillance authorities by Annex III area — among them the Data Protection Commission, the Central Bank of Ireland, the Workplace Relations Commission, the HSE, ComReg, the CRU and the National Transport Authority — and Coimisiún na Meán for some transparency duties. The Regulation of Artificial Intelligence Act 2026 establishes Oifig IS na hÉireann.
What Vivid Risk does with EU AI Act
A register of the AI systems you use, a guided classification path for each system with the article behind every step, the duties that follow for your role with their citations and start dates, and the records the Act asks a deployer to keep. Serious-incident clocks run in the incident register.
It supports deployers. It lists a provider's duties and does not do the provider workload — technical documentation, a quality management system or conformity assessment. It classifies nothing for you, certifies nothing, and files, registers or notifies nothing with anyone.
Questions
Does Vivid Risk classify our AI systems?
No. For each system it walks through the steps the Act sets out and shows what your answers indicate, with the article behind each step. The classification is your determination; you record it, with your reasoning.
Does Vivid Risk make us AI Act compliant?
No tool can. The workspace keeps your register, your determinations, the duties that follow and your records of meeting them, and counts which duties have a record behind them. Whether you comply is for the market surveillance authority.
Does it file our reports or register our systems?
No. It files, registers and notifies nothing with any authority, provider or person. It records what you sent, to whom and when.
We build AI as well as use it. Does it cover providers?
It lets you record that role and lists a provider's duties with their citations. It does not do the provider workload — technical documentation, a quality management system or conformity assessment.
We are in the UK. Does the AI Act apply to us?
It can. The Act reaches a provider or deployer outside the EU where its AI system's output is used in the EU, and any provider placing a system on the EU market. The free scope check asks about both.
One assessment, every framework
The same answers produce your citations across every framework we cover at once, rather than one questionnaire per regulation.