EU AI Act · Regulation 2024/1689
The EU AI Act is in force. Penalties reach €35M or 7% of global turnover. We don't just advise — we build the governed AI system that enforces compliance in your runtime, starting with a fixed-price readiness audit.
The obligation
You must use AI systems according to their instructions, assign human oversight, ensure input data is relevant, monitor operations, report serious incidents, and retain logs for at least six months (Article 26). These obligations apply to every AI tool your business uses — including SaaS products with embedded AI.
You carry the heaviest obligations: risk management (Art. 9), data governance (Art. 10), technical documentation per Annex IV (Art. 11), automatic logging (Art. 12), transparency (Art. 13), human oversight by design (Art. 14), and accuracy & robustness (Art. 15). High-risk systems additionally require conformity assessment and CE marking.
Financial services, healthcare, insurance, employment, and public sector organisations face additional scrutiny. Annex III covers credit scoring, insurance pricing, HR decisions, and critical infrastructure. Your AI system may be classified as high-risk regardless of how it is marketed.
Your CRM, ERP, or productivity suite likely contains AI features you did not intentionally deploy. Under the AI Act, you are a deployer of those systems and carry the associated obligations. An AI inventory is step one — most organisations find 2–5× more AI systems than they expected.
Timeline
Since 2 February 2025. Subliminal manipulation, social scoring, and untargeted facial recognition are banned. AI literacy obligation for staff is in effect.
Chatbot disclosure, deepfake labelling, and machine-readable marking of synthetic content are enforceable. General-purpose AI model obligations apply. Article 49 registration is in force.
Credit scoring, HR decisions, insurance pricing, critical infrastructure, and other Annex III domains. Full conformity assessment, technical documentation, and CE marking required. (Deferred from Aug 2026 by Regulation 2026/1744.)
AI as a safety component of regulated products (medical devices, machinery, vehicles, etc.). The longest runway, but preparation is measured in quarters.
Our approach
Most organisations approach the AI Act as a documentation exercise — fill in forms, sign off checklists, hope for the best. That does not survive an audit. Compliance must be enforced in the runtime, not just recorded in a binder.
AI inventory, risk classification, gap analysis against Articles 8–15, and a 90-day implementation roadmap.
€500 fixed →02 · GovernDeploy self-hosted models (Ollama, vLLM) or private cloud endpoints via TramAI with guardrails, audit logging, and approval gates.
From €3,500 →03 · IntegrateConnect governed AI to your existing Java, Spring Boot, Node.js, or Python systems with schema validation and observability.
From €3,500 →The enforcement engine
TramAI is an open-source framework that maps directly to EU AI Act obligations. Instead of relying on manual checklists, TramAI makes compliance controls part of the execution path:
Structured, tamper-evident audit logs for every AI execution. Capture inputs, outputs, model version, and human oversight decisions. Retention policies enforced at the runtime level.
Approval gates, human-in-the-loop workflows, and suspension mechanisms. When a decision requires human review, the workflow stops and waits — enforced in code, not in policy documents.
Model routing with sovereignty constraints. Sensitive workloads stay on private models (Ollama, vLLM). Non-sensitive workloads can use cloud APIs. The routing decision is explicit, logged, and auditable.
Schema validation, structured JSON outputs, rate limiting, and failure handling. AI responses are deterministic and verifiable — not free-form text that cannot be audited.
The stakes
€35M
or 7% of global annual turnover for prohibited practices (Art. 99)
€15M
or 3% of global annual turnover for violations of other provisions
€7.5M
or 1% of global annual turnover for providing incorrect information to authorities
In addition to fines, non-compliant AI systems can be withdrawn from the EU market. The EU AI Office and national market surveillance authorities are already enforcing.
Case study
The problem
A Dutch company needed an AI lead-intake agent that qualified sales leads 24/7. But the agent processed personal data and made decisions that required human oversight and a traceable record under the AI Act.
The solution
We built Sofia — a voice and web AI agent on TramAI, with human approval gates, structured audit logging, and private model routing. Every execution is logged and traceable in the execution path.
The result
24/7 lead qualification with a full evidence trail. When a regulator asks "show me the audit log," there is one — generated automatically, not reconstructed after the fact.
Go deeper
Article 26
The six deployer duties and the engineering control behind each.
Article 50
Chatbot disclosure and synthetic-content marking, in force now.
GDPR
Where the AI Act and GDPR meet — one evidence bundle for both.
Article 53
The four provider duties if you build or fine-tune models.
Milan · Italy
Deployer obligations, in Italian — for companies in Milan and across Italy.
Amsterdam · NL
Deployer obligations, in Dutch — for companies in Amsterdam and the Netherlands.
Free · 5 minutes · No email
Answer five questions to see where your company stands against the EU AI Act deployer obligations. Your result is instant, and nothing is stored.
FAQ
Under Article 26, deployers must: use AI systems in accordance with instructions for use, assign human oversight to capable persons, ensure input data is relevant and sufficiently representative, monitor operations and report serious incidents, and retain logs for at least six months. These obligations apply to all AI systems, regardless of risk level.
The classification follows a four-tier risk model: (1) Prohibited — systems using subliminal manipulation, social scoring, or untargeted facial recognition; (2) High-risk — systems in Annex III domains (employment, credit scoring, critical infrastructure, etc.); (3) Limited risk — chatbots and AI-generated content requiring transparency; (4) Minimal risk — all other AI systems. Start by inventorying every AI system in your organisation, including third-party tools and embedded AI features.
Due to the July 2026 amendment (Regulation 2026/1744), high-risk obligations for Annex III systems apply from 2 December 2027, and for Annex I systems from 2 August 2028. However, the general application date is 2 August 2026, and Article 50 transparency obligations (chatbot disclosure, deepfake labelling) are already enforceable. Prohibited practices have applied since 2 February 2025.
Not necessarily. For most small and mid-size organisations, a dedicated team is overkill. What you need is: (1) an AI inventory, (2) risk classification for each system, (3) documented controls matching your risk level, (4) a monitoring process, and (5) evidence trails for audit. Our AI Readiness Audit (€500, 10 business days) covers steps 1-3 and gives you a 90-day roadmap.
A provider develops or has developed an AI system and places it on the market under their own name. A deployer uses an AI system under their authority. Most companies that use AI tools (CRM with AI features, chatbots, internal AI assistants) are deployers. If you build an AI system and sell it, you are a provider. If you build one for internal use, you are both. Provider obligations (conformity assessment, technical documentation per Annex IV) are significantly heavier than deployer obligations.
TramAI is a governed AI runtime for the JVM (Java, Kotlin, Spring Boot) that enforces compliance in code, not just documentation. It provides: model routing with sovereignty constraints (Article 10 — data governance), structured audit logging (Article 12 — logging), human approval gates (Article 14 — human oversight), and deterministic guardrails (Article 15 — robustness). Instead of relying on manual compliance checklists, TramAI makes the compliance controls part of the execution path.
Penalties scale by severity: up to €35 million or 7% of global annual turnover for prohibited practices (Article 99); up to €15 million or 3% for violations of other provisions (including high-risk obligations); and up to €7.5 million or 1% for providing incorrect information to authorities. In addition to fines, non-compliant systems can be withdrawn from the market. The enforcement framework includes the EU AI Office and national market surveillance authorities.
Yes, with the right architecture. The EU AI Act does not prohibit cloud APIs. What it requires is that you can demonstrate: data governance (what data goes to the API and why), transparency (users know they are interacting with AI), human oversight (a human can review and override), and logging (you can trace what the AI did). TramAI provides the governance layer that makes cloud API usage auditable and compliant, while keeping the option to route sensitive workloads to private models.