|
|

The EU AI Act applies to any organization that develops, places on the market, or uses AI systems that affect the EU.

It covers:

• EU-based companies using or developing AI
• Non-EU companies whose AI systems are marketed or used in the EU

In practice, most startups and SMEs using AI — even via third-party tools or APIs — are within scope.

The distinction is based on who controls the system:

• Provider: develops an AI system (or has it developed) and places it on the market or puts it into service under its name
• Deployer: uses an AI system in the course of its business or activities

A company can be both a provider and a deployer, depending on the AI system.

The AI Act follows a risk-based approach, with four main categories:

1. Unacceptable risk – AI practices that are prohibited
2. High risk – AI systems subject to strict regulatory requirements
3. Limited risk – AI systems subject mainly to transparency obligations
4. Minimal or no risk – AI systems largely unregulated

An AI system is considered high-risk if it is used in sensitive or regulated areas as defined in Annex III (such as employment, creditworthiness, education, biometric identification, or access to essential services, etc), or a safety component of a regulated product (e.g. medical devices, elevators, toys, etc).

Under the EU AI Act, General-Purpose AI (GPAI) models are AI models that:

• Are trained with a high degree of generality,
• Are capable of performing a wide range of different tasks, and
• Can be integrated into or adapted for multiple downstream applications, including high-risk use cases.

Typical examples include large language models (LLMs) and other foundation models that can be reused or fine-tuned across different products and services.

Enforcement is carried out by:

• National market surveillance authorities in each EU Member State
• The European AI Office at EU level
• Sector-specific regulators, where applicable

The AI Act applies in stages:

• The first provisions, covering prohibited AI practices and AI literacy, entered into force in February 2025
• Rules for general-purpose AI (GPAI) entered into force in August 2025
• Other obligations — most notably those for high-risk AI systems — were initially scheduled to apply from August 2026
• As of February 2026, these timelines are subject to a European Commission proposal under the Digital Omnibus, which would formally delay certain obligations; the proposal is currently under negotiation between the EU co-legislators

The EU AI Act establishes a tiered system of administrative fines:

• Up to €35 million or 7% of total worldwide annual turnover (whichever is higher) for:
  • Prohibited AI practices
  • Non-compliance with data governance obligations related to high-risk AI
• Up to €15 million or 3% of total worldwide annual turnover for:
  • Non-compliance with other obligations for high-risk AI systems
  • Breaches of GPAI-related obligations
• Up to €7.5 million or 1.5% of total worldwide annual turnover for:
  • Supplying incorrect, incomplete, or misleading information to authorities

Lower caps apply to SMEs, but fines remain material and enforceable.

SenecAI provides AI Act compliance consultancy for EU startups and SMEs, including:

• Inventory and evaluation of AI systems
• AI readiness checks
• Practical compliance roadmaps
• Documentation preparation
• Assistance with conformity assessment
• Liaising with the EU AI Office and other authorities
• Policy monitoring
• Trainings & workshops

Getting started is simple:

1. Book a short introductory call
2. We assess how your organization uses AI
3. You receive an initial AI Act readiness snapshot
4. If relevant, we propose clear next steps