DESET The EU AI Act: what it means for you
Parts of the Act already apply. The rules for high-risk AI were moved back and now start in December 2027.
High-risk rules apply from December 2, 2027
What is the EU AI Act?
The EU AI Act is the first broad law on artificial intelligence. It sorts AI systems by risk and sets stricter rules the higher the risk. In July 2026 the EU amended it with the "Digital Omnibus", which pushed back the deadlines for high-risk systems.
Who does it affect?
Anyone who builds or uses AI systems on the EU market, wherever the company is based. Chatbots and other systems that talk to people have transparency duties. High-risk systems, such as those used in hiring, credit scoring, education or critical infrastructure, face the strictest rules.
What applies when
- •February 2, 2025 — banned AI practices
- •August 2, 2025 — rules for general-purpose AI models
- •August 2, 2026 — transparency duties, such as telling users they are talking to an AI
- •December 2, 2027 — high-risk systems listed in Annex III (hiring, credit scoring, education, critical infrastructure)
- •August 2, 2028 — high-risk AI built into regulated products (Annex I), such as medical devices and machinery
How DESET AI helps
We cover the security part of the Act:
- •We test your LLM apps for prompt injection and data leaks. The Act requires high-risk systems to hold up against this kind of attack (Article 15).
- •We monitor your apps in production, which supports the post-market monitoring the Act asks for.
- •We give you documentation you can show auditors. It also helps with NIS2 and DORA.