EU AI Act
European Union · Law or regulation · Partly applicable
- European Union
- Transparency
- Automated decisions
© 2026 Medoya LLC
Powered by voilamia
AI Regulation Tracker
Understand how AI, privacy, resilience, and product rules can overlap.
Resources › AI Regulation Tracker › European Union
Overview · United States · European Union · Canada · Standards & Frameworks
December 2, 2026
EU AI Act · Transition end
December 2, 2027
EU AI Act · Application date
December 11, 2027
Cyber Resilience Act · Application date
August 2, 2028
EU AI Act · Application date
AI deployments connected to the EU can engage several regulatory regimes. The relevant requirements depend on the intended use, provider or deployer role, personal-data processing, sector, and product classification. This page highlights selected rules and their different application dates.
In each entry, “What this means for your AI deployment” and “Evidence you may need” describe assessment work Medoya suggests. They do not mean that every listed test or document is expressly required by the cited law.
This resource provides general information about selected regulations and technical considerations. It is not legal advice or a determination that a particular system complies. Check the linked official sources and obtain advice for your circumstances.
Assess what an agent can access and do, test relevant attack paths, and document findings and limitations.
Examine how a vendor's product fits the intended use, including data flows, deployment options, available evidence, and open questions.
Review trust boundaries, permissions, human approvals, logging, and recovery arrangements before deployment or expansion.
Read each date together with its affected systems and organizations. A date for one category of AI system or one transparency duty does not establish the timetable for every EU deployment.
Jurisdiction: European Union · Type: Law or regulation (EU regulation, as amended) · Status: Partly applicable
Topics: Transparency, Automated decisions · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Providers, deployers, and other operators within the Act's territorial and material scope.
Summary. Requirements depend on role, intended use, and system classification. The AI Omnibus, Regulation (EU) 2026/1744, entered into force on July 27, 2026 and revised specified high-risk application dates.
Key dates
What this means for your AI deployment. Document classification and role; assess relevant transparency, oversight, and security arrangements.
Evidence you may need. Classification rationale, system documentation, notices, test records, and monitoring responsibilities.
Scope and limitations. Classification follows Article 6 and Annexes I and III, so healthcare use alone does not establish high-risk classification. Confirm the intended purpose, applicable category, and exceptions. This entry highlights selected provisions.
Official sources (checked October 29, 2026)
Related services: AI Architecture Review & Design · AI Agent Security Review
Jurisdiction: European Union · Type: Law or regulation (EU regulation) · Status: Applicable
Topics: Privacy, Healthcare, Automated decisions · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Controllers and processors within the GDPR's territorial scope.
Summary. AI processing of personal data needs an appropriate legal basis; health and other special-category data require an additional applicable condition. Article 22 addresses solely automated decisions with legal or similarly significant effects, subject to exceptions and safeguards. A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk to individuals.
Key dates
What this means for your AI deployment. Map personal data across inputs, retrieval, outputs, embeddings, and logs. Review vendor reuse, retention, deletion, access, and relevant human involvement.
Evidence you may need. Data-flow maps, processing-role records, vendor terms, retention controls, and a DPIA where required.
Scope and limitations. Applicability is not determined only by an organization's headquarters. Article 22 does not cover every AI-assisted decision.
Official sources (checked October 29, 2026)
Related services: AI Vendor Assessment · AI Architecture Review & Design
Jurisdiction: European Union · Type: Law or regulation (EU regulation) · Status: Applicable
Topics: Financial Services, Cybersecurity · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Financial entities within scope; designated critical ICT third-party providers have a separate oversight regime.
Summary. DORA addresses ICT risk management, incident handling, resilience testing, and third-party risk. AI services can be part of the technology and supplier arrangements that financial entities must assess.
Key dates
What this means for your AI deployment. Understand dependencies, service disruption, containment, recovery, and the ability to replace or exit a provider.
Evidence you may need. Dependency inventories, vendor reviews, resilience-test records, incident procedures, and exit arrangements.
Scope and limitations. Supplying an AI service to a financial institution does not automatically make a vendor a designated critical ICT provider. Determine the applicable role and contractual expectations.
Official sources (checked October 29, 2026)
Related services: AI Vendor Assessment · AI Architecture Review & Design
Jurisdiction: European Union · Type: Law or regulation (EU regulation) · Status: Partly applicable
Topics: Cybersecurity · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Manufacturers and other economic operators of products with digital elements within scope.
Summary. The CRA, in force since December 10, 2024, addresses product cybersecurity and vulnerability handling. Manufacturer reporting obligations for actively exploited vulnerabilities and severe security incidents apply from September 11, 2026. The main requirements apply from December 11, 2027.
Key dates
What this means for your AI deployment. Determine product scope, identify components and dependencies, and establish vulnerability handling, updates, and reporting responsibilities.
Evidence you may need. Scope analysis, component inventory, security assessment records, and vulnerability-response and update plans.
Scope and limitations. Products covered by the EU medical-device and in-vitro diagnostic regulations are excluded; that exclusion does not extend to all healthcare software. Coverage of remote processing and cloud services depends on the statutory product definition.
Official sources (checked October 29, 2026)
Related services: AI Agent Security Review · AI Architecture Review & Design
Medoya reviews AI agent behavior, vendor evidence, and architecture within an agreed technical scope. We document findings, limitations, and practical next steps so your team can decide what to change and what needs further review.
Select an entry to read its scope, dates, evidence examples, and official sources below.
European Union · Law or regulation · Partly applicable
European Union · Law or regulation · Partly applicable
European Union · Law or regulation · Applicable
European Union · Law or regulation · Applicable