Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
The era of unregulated AI experimentation is over. Much like the GDPR reshaped data privacy in 2018, the EU AI Act is redefining how organizations build, buy, and deploy artificial intelligence. For executives and privacy officers, the question is no longer whether you need governance, but how quickly you can put it in place.
In short: the EU AI Act sorts AI systems into four risk tiers — unacceptable (banned), high (heavily regulated), limited (transparency required), and minimal (largely unregulated) — and organizations that deploy a high-risk system, not just those that build one, carry real obligations: human oversight by competent staff, input data fit for the system's purpose and, for public bodies and certain credit and insurance uses, a Fundamental Rights Impact Assessment. Buying a high-risk AI tool from a vendor does not transfer those obligations away from the deployer.
Timeline, as of September 2026: the Act entered into force on August 1, 2024. Its prohibitions have applied since February 2, 2025, and its rules for general-purpose AI models since August 2, 2025. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) moved the high-risk obligations back: they now apply from December 2, 2027 for the uses listed in Annex III, such as hiring, credit scoring and education, and from August 2, 2028 for AI in products regulated under the EU product-safety legislation listed in Annex I.
Understanding the risk-based approach
The Act does not treat all AI equally. It sorts systems into four levels of risk, each with a different compliance burden:
- Unacceptable risk (banned): systems that threaten fundamental rights — for example, social scoring, whether by public or private actors, or real-time remote biometric identification in publicly accessible spaces for law enforcement, outside a few narrow exceptions.
- High risk (heavily regulated): the tier that carries the heaviest obligations. It covers AI used in critical infrastructure, employment (hiring algorithms), credit scoring, and education. If your tool screens résumés or assesses creditworthiness for loans, significant obligations apply from December 2, 2027.
- Limited risk (transparency required): systems such as chatbots must clearly tell users they are interacting with a machine.
- Minimal risk: spam filters and video games — largely unregulated.
Your obligations as a 'deployer'
It is tempting to assume that because you buy AI tools from vendors, compliance is the vendor's problem. That is a dangerous misconception. Under the Act, once the high-risk rules apply, a deployer of a high-risk system is responsible for, among other duties:
- Human oversight: assigning oversight to people with the competence, training and authority to review the system's output, intervene, or stop it.
- Input data: where you control the input data, ensuring it is relevant and sufficiently representative for the system's intended purpose. Examining training data for bias is the provider's duty, so ask your vendor for that evidence.
- Fundamental Rights Impact Assessments (FRIA): if you are a public body or a private entity providing public services (other than for critical-infrastructure systems), or you use AI to assess creditworthiness or price life and health insurance, assessing how the tool affects the people subject to it before first use. Where your GDPR data protection impact assessment already covers some of this, the FRIA can cross-refer to it.
How this lines up with Canada's rules
The Act reaches Canadian organizations that place AI systems on the EU market, and those whose AI output is used in the EU (Article 2). At home, the closest counterparts are narrower. The Treasury Board Directive on Automated Decision-Making, last updated June 24, 2025, applies to federal institutions using automated systems to make or support administrative decisions about clients: it requires a published Algorithmic Impact Assessment and, at the two highest impact levels, a human must make the final decision. Quebec's Law 25 requires an organization that makes a decision based exclusively on automated processing of personal information to tell the person, explain the principal factors on request, and let them submit observations to someone who can review the decision. For the full Canadian picture, see AI Made the Decision — Who Has to Explain It?
How Mosaic helps you close the gap
Enforcement is not a future event. The prohibitions have applied since February 2, 2025, and breaching them can draw fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. The transparency rules for chatbots have applied since August 2, 2026. The high-risk deadline moved; it did not disappear. Mosaic runs an expert-led AI gap analysis that identifies the high-risk systems already inside your technology estate, maps them against the EU requirements, and returns a clear status rating and a prioritized remediation roadmap. The work follows our proprietary, standardized methodology, with senior practitioner review on every finding — so the result is defensible in front of a regulator, not just a checklist.