The EU AI Act: which obligations can be verified and how to check their application

Regulation (EU) 2024/1689—known as the AI Act—establishes a common framework for artificial intelligence systems in the European Union. But describing it as a law that “enters into force” all at once can be misleading: its obligations apply on different dates and depend on the system concerned and the role each organisation performs. The first step in understanding a news report or assessing an obligation is to identify the specific article, rather than relying on a general headline. The European Commission’s official overview presents the framework as a set of risk-based rules for developers and deployers in relation to specific uses of AI. A general description is useful for orientation, but it cannot determine the outcome for every individual case.

The reference legal text is the Regulation published on EUR-Lex. To verify a claim, consult its articles and transitional provisions rather than relying solely on summaries or third-party interpretations. The Commission also provides an information page about the AI Act, which can help readers find their way around, although an explanatory page does not replace the provisions themselves. This article distinguishes between what official sources say and the practical conclusions that can be drawn from them. It does not present a recent amendment as fact when the available sources do not substantiate one. When checking a reported requirement, readers should therefore separate the text of the law from commentary about it and note which version of the legal text is being consulted.

The Regulation’s architecture does not treat all uses of AI in the same way. The Commission describes a risk-based approach for developers and those who deploy systems, linked to specific uses. For that reason, saying “my company uses AI” is not enough to establish whether a particular obligation applies: it is necessary to identify the system, the context in which it is used and the role played by the organisation. A general-purpose tool is not automatically subject to the same requirements as every system used in a regulated activity, and the product’s marketing label does not, by itself, settle its classification. The relevant question is not simply whether AI is present, but how the system is used and which provisions govern that use.

An initial check should separate at least these questions: Does the organisation develop or put the system into service, or does it use the system in its activities? What function does the AI perform, and who receives or uses its outputs? Does the rule being cited apply to that use, or to a different class of systems? The answer cannot be inferred just because a provider advertises its product as compliant with the law. Legal classification depends on the facts and the applicable provisions. Where a system contributes to decisions with significant consequences, or where its classification is unclear, review by a professional may be necessary. This guide is not legal advice, and it cannot replace an assessment of the particular system, its purpose and the organisation’s responsibilities.

The Regulation’s phased application means that any calendar should be read carefully. In its official information on transparency for AI-generated content, the Commission states that the obligations in Article 50 apply from 2 August 2026. The same page clarifies that the code of practice discussed alongside that information is voluntary, whereas the legal transparency obligations in the article are requirements of the Regulation. This distinction matters: joining a voluntary instrument is not the same as being subject to the legal obligation that the instrument is intended to help fulfil. It is also important not to mistake a date linked to one set of provisions for a single start date for the entire Regulation.

To check a date, locate the cited article or transitional provision on EUR-Lex and compare it with the Commission’s official page explaining implementation. Also check whether the source refers to entry into force, an application date, a transition period or a deadline: those terms do not necessarily mean the same thing. The consolidated text linked on EUR-Lex has an identifiable version date and should not automatically be confused with the original text published in the Official Journal. A date taken in isolation does not show that every obligation in the Regulation is already enforceable against every actor. If a news report announces a postponement or change, find the legal act that would establish it before treating the claim as confirmed. A careful check should establish both what date is stated and which provision, actor and activity that date concerns.

Article 50 is a good example of why broad generalisations should be avoided. The Commission explains that its transparency obligations include, among other things, marking and detecting AI-generated content and labelling deepfakes and certain generated publications. According to that source, they apply from 2 August 2026. This example should not be turned into a universal rule that all generated content must always carry the same visible label: the scope depends on the categories and conditions set out in the Regulation. A reliable account therefore needs to distinguish the various obligations within the article rather than reduce them to a single statement about labelling.

The Commission presents the code of practice as a tool to help providers and users of generative AI systems comply with relevant obligations. It also states that adherence to the code is voluntary and that the legal obligation is found in Article 50. In practical terms, a company can use the code as an implementation reference, but it should not interpret participation—or non-participation—as an automatic answer about whether it complies. The decisive question is what the article requires in the particular case and what evidence can demonstrate compliance. The code may help explain how an organisation approaches implementation, but it does not replace checking the legal provision that applies to the system and the content at issue.

A useful documentary review can be carried out in four steps:

1. Identify the exact claim. Is it about a date, a system category, a provider or a professional user?
2. Open the primary source. Consult the Regulation on EUR-Lex and locate the article cited; use the Commission’s page to understand its implementation.
3. Check the scope. Establish what the system does, the context in which it is used and the role of each actor.
4. Find the cited act or guidance. If a recent amendment is claimed, check that an official text supports it and verify its date and scope.

The available research supports the risk-based approach and the date that the Commission attributes to the Article 50 transparency obligations. It does not, however, provide enough evidence to claim that the general timetable has recently changed or to give a complete list of every obligation currently in force by sector and operator type. The prudent conclusion is limited: each rule must be checked in the text of the Regulation, and the AI Act should not be treated as a uniform obligation. For specific business decisions, particularly when the system’s classification is open to debate, a contextual legal assessment will be needed. Readers should also be careful not to infer a general change from information about a single article, code or implementation measure.