The AI Act, answered.

Regulation (EU) 2024/1689 sets EU-wide rules for AI systems and general-purpose AI models. It bans a short list of practices, regulates high-risk uses in detail, adds transparency duties for chatbots and generated content, and puts obligations on model providers. It entered into force on 1 August 2024 and applies in stages.

Providers who place AI systems or models on the EU market or put them into service, deployers who use AI systems under their authority in the EU, and importers, distributors and product manufacturers along the chain. Purely personal, non-professional use is excluded, as are systems used solely for military, defence or national-security purposes and research before market placement.

Yes. It covers providers anywhere in the world who place systems on the EU market, and providers and deployers in third countries when the output of the system is used in the EU. Non-EU providers of high-risk systems must appoint an authorised representative in the Union.

Article 99 sets three tiers. Prohibited practices under Article 5: up to EUR 35 million or 7 % of total worldwide annual turnover, whichever is higher. Breaches of the obligations of providers, deployers, importers, distributors and notified bodies, and of the transparency duties in Article 50: up to EUR 15 million or 3 %. Incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1 %. For SMEs and start-ups the lower of the amount and the percentage applies. Providers of general-purpose AI models can be fined by the Commission up to EUR 15 million or 3 % (Article 101). Member States may add further penalties and non-monetary measures. The penalty rules have applied since 2 August 2025.

1 August 2024: entry into force. 2 February 2025: prohibitions and AI literacy. 2 August 2025: obligations for general-purpose AI models, governance and penalties. 2 August 2026: general application, including the transparency duties in Article 50. 2 December 2026: machine-readable marking for generative AI already on the market, and two new prohibitions. 2 December 2027: high-risk systems under Annex III. 2 August 2028: high-risk systems that are safety components of products under Annex I. The last three dates come from the Digital Omnibus, Regulation (EU) 2026/1744.

Article 5 prohibits manipulative or deceptive techniques that distort behaviour and cause significant harm, exploiting vulnerabilities such as age or disability, social scoring that leads to unjustified detriment, predicting criminal offences from profiling alone, untargeted scraping of facial images to build recognition databases, emotion recognition at work and in education, biometric categorisation to infer sensitive attributes, and real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions.

Two routes. Article 6(1): the system is a safety component of a product covered by the Union harmonisation legislation in Annex I, such as machinery, medical devices or vehicles. Article 6(2): the use case is listed in Annex III, for example biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and the administration of justice. Narrow, preparatory or purely procedural tasks may fall out under Article 6(3) if you document why. High-risk systems need risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, a conformity assessment and registration.

Tell people they are interacting with an AI system unless that is obvious (Article 50(1)). Take measures to build your staff's AI literacy (Article 4). If the bot recognises emotions or categorises people biometrically, inform them (Article 50(3)). If it generates images, audio, video or text that you publish, the labelling rules for deep fakes and public-interest text can apply (Article 50(4)), and the provider of the model must mark output in a machine-readable way (Article 50(2)).

Deployers must disclose deep fakes, that is realistic AI-generated or manipulated media of real people, places, objects or events, and AI-generated text published to inform the public on matters of public interest, unless a human reviewed it and someone holds editorial responsibility. The disclosure must be clear at first exposure and accessible. The Commission publishes free icons for this. Our labelling guide walks through scope, design, placement and code.

A model trained on large amounts of data that can perform a wide range of tasks and be integrated into many systems, such as a large language model. Providers must keep technical documentation, give downstream providers information, publish a summary of training content and have a copyright policy (Article 53). Models with systemic risk carry extra duties on evaluation, incident reporting and cybersecurity (Article 55).

Article 4 requires providers and deployers to take measures to support the AI literacy of staff and others operating AI systems on their behalf, taking into account their role and the context of use. It has applied since 2 February 2025. The Digital Omnibus reworded it in July 2026: it no longer asks for a guaranteed level of literacy, so keeping records of training and guidance is the practical way to show what you did.

Each Member State designates market surveillance authorities for AI systems; the Commission's AI Office supervises general-purpose AI models, and the European Artificial Intelligence Board coordinates. Authorities can request documentation, order corrective action, withdraw systems from the market and impose the fines described above.

No. The scan is an evidence-based check of the content you provide against a curated rule catalog. It tells you where you stand and what to fix; it does not replace counsel for binding assessments.

Pages, screenshots and documents are stored in EU object storage only as long as needed to produce the report and are purged automatically after 30 days. We hash IP addresses and never sell data.

Deterministic detectors find visible facts (a chat widget without an AI notice, a missing label). A language model adds observations with quoted evidence. Anything it cannot see is marked unknown and counted in coverage, not in the score.

Only the rules that apply to your role and use case count. Each finding is weighted by the importance of its rule: pass counts fully, partial half, fail zero. Unknowns lower coverage rather than the score. A confirmed prohibited practice sets the score to zero and the rating to critical. Ratings: A from 90, B from 75, C from 60, D from 40, E below.

The scan is free and needs no account. Fixed-price packages that close the gaps it finds are listed on the packages page.

Yes. Upload PNG, JPG, WebP or PDF files, up to 15 MB each and five per scan, or paste plain text. Screenshots go to a vision model; PDFs are converted to text.

The product and the law are available in English and German; scanned content can be in any language.

Notices, policies, documentation templates and training, scoped to what your scan surfaced and delivered as ready-to-ship documents. Every deliverable cites the article it satisfies, and a re-scan with a written sign-off closes the loop.

Ask for a custom scope. A compliance specialist replies within one business day.