What is the EU AI Act?

Overview

The EU AI Act is a risk-based regulation establishing a unified legal framework for artificial intelligence across the European Union. It sets binding obligations for providers, deployers, importers, and distributors, with requirements that scale according to the specific level of risk an application presents.

The regulation has global impact through its extraterritorial reach and can apply to non-EU organizations when an AI system is placed on the EU market, or its output is used within the EU.

To enforce regulatory oversight, the Act classifies AI systems into four risk tiers:

• Unacceptable Risk: Prohibited AI practices that pose clear threats to safety, livelihoods, or fundamental rights.
• High Risk: Permitted AI systems subject to extensive compliance, testing, documentation, and risk management requirements.
• Limited Risk: AI systems subject primarily to transparency obligations, such as disclosing AI-generated content or chatbot interactions.
• Minimal Risk: Default category for many AI applications, carrying few or no mandatory obligations.

The Act also establishes separate requirements for providers of general-purpose AI (GPAI) models, including foundation models, covering documentation and transparency, with additional obligations for models that pose systemic risk.

For software and DevSecOps teams, EU AI Act compliance requires treating technical evidence as part of a broader governance, risk, and compliance (GRC) strategy. Organizations that maintain disciplined software supply chain practices (such as Software Bills of Materials (SBOMs), software provenance, and artifact management) can draw on existing records when producing evidence for audits and regulatory reviews.

What Are the Four EU AI Act Risk Tiers?

The EU AI Act classifies AI systems into four risk categories. The higher the level of risk an AI system presents, the more extensive the compliance obligations.

Unacceptable risk

AI systems that pose an unacceptable risk are prohibited under the Act. These include practices such as social scoring, certain forms of cognitive or behavioral manipulation, and untargeted scraping of facial images to create facial recognition databases.

High risk

High-risk AI systems are permitted but subject to the most stringent requirements. They commonly include AI used in areas such as:

• Critical infrastructure
• Education
• Employment and workforce management
• Essential public and private services
• Law enforcement
• Certain biometric applications

Providers of high-risk systems must implement risk management processes, maintain technical documentation, design for human oversight, and demonstrate accuracy, robustness, and cybersecurity throughout the AI lifecycle, while deployers have separate obligations of their own.

Limited risk

Limited-risk AI systems are primarily subject to transparency requirements. For example, users may need to be informed when interacting with AI systems or when content has been generated or manipulated by AI.

Minimal risk

Many AI applications fall into the minimal-risk category and are not subject to risk-specific obligations under the Act. However, organizations are still encouraged to follow responsible AI and governance best practices.

What Are the Obligations for High-Risk AI Systems?

For engineering teams, the EU AI Act becomes most relevant when building or deploying high-risk AI systems.

Organizations must establish a continuous risk management process covering the full AI lifecycle while maintaining documentation that demonstrates how systems were developed, validated, tested, and monitored. This includes documenting model capabilities, limitations, intended use, and performance.

High-risk systems must also implement appropriate data governance practices, human oversight, logging, accuracy testing, cybersecurity controls, and post-market monitoring. Before entering the EU market, many systems must undergo a conformity assessment to demonstrate compliance with the regulation.

Meeting these obligations requires more than policy documentation. Engineering teams need reliable evidence that links models, software components, datasets, and deployments throughout the development lifecycle.

General-Purpose AI and Foundation Models

The EU AI Act establishes separate requirements for general-purpose AI (GPAI) models, including many foundation models that support generative AI applications.

Providers of GPAI models must maintain technical documentation, provide information for downstream integrators, publish training data summaries, and establish policies addressing EU copyright requirements. Models designated as presenting systemic risk are subject to additional testing, monitoring, and incident reporting obligations.

Organizations integrating third-party foundation models (such as OpenAI GPT, Meta Llama, or open weights from Hugging Face) can also have compliance responsibilities, depending on their role and how they use the model. Teams should evaluate external models before deployment, understand how they were developed, and maintain documentation supporting procurement, risk assessments, and ongoing governance across frameworks like PyTorch or TensorFlow.

Practices such as maintaining an AI Bill of Materials (AIBOM) can help organizations document AI models and dependencies while supporting the transparency requirements introduced by the Act.

EU AI Act Timeline, Enforcement, and Penalties

The EU AI Act is being implemented in phases, giving organizations time to prepare for different requirements. The dates below reflect the Act as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since July 27, 2026.

The regulation also establishes significant financial penalties for non-compliance:

• Up to €35 million or 7% of total worldwide annual turnover, whichever is higher, for prohibited AI practices.
• Up to €15 million or 3% of total worldwide annual turnover, whichever is higher, for most other violations, including high-risk AI and GPAI obligations.
• Up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher, for providing incorrect or misleading information to regulators.

These phased deadlines give organizations time to mature their AI compliance programs, but also reinforce the importance of establishing governance, documentation, and technical controls early.

Aligning With the Broader EU Regulatory Ecosystem

The EU AI Act’s obligations  do not exist in a vacuum; they converge with major EU digital compliance milestones:

• Digital Operational Resilience Act (DORA): Sets strict third-party risk management, ICT operational resilience, and incident reporting requirements for EU financial entities, and has applied since January 17, 2025.
• EU Cyber Resilience Act (CRA): Introduces mandatory cybersecurity and vulnerability reporting requirements for hardware and software products, with reporting obligations for actively exploited vulnerabilities and severe incidents applying since September 11, 2026, and most other obligations applying from December 11, 2027.

Because AI systems can run in financial-sector environments subject to DORA or in products subject to the CRA, security and platform teams can reduce duplicate effort by establishing a single, unified pipeline evidence model that supports software supply chain, vulnerability disclosure, and AI governance requirements.

EU AI Act Compliance Across the Software Supply Chain

For software teams, EU AI Act compliance extends beyond legal policies. It requires maintaining accurate records of how AI systems are built, tested, deployed, and updated throughout the software development lifecycle.

Many of the Act’s requirements, such as technical documentation, risk assessments, and conformity evidence, depend on having reliable software supply chain data. Organizations need visibility into which AI models are in use, where they originated, what software components and datasets they depend on, and which versions are running in production.

Practices such as maintaining an AI Bill of Materials (AIBOM), Software Bill of Materials (SBOM), and software provenance help establish this traceability by documenting AI models, software dependencies, and deployment history.

Organizations should also maintain centralized model inventories, govern AI artifacts throughout their lifecycle, and use artifact management to preserve immutable records that support audits, investigations, and regulatory reporting.

As AI adoption grows, organizations should also establish controls for identifying and managing shadow AI to reduce the risk of undocumented or unapproved AI systems introducing compliance gaps.

Practical Compliance Checklist for DevOps and Engineering

Engineering teams can simplify EU AI Act compliance by integrating governance and documentation into existing software delivery workflows.

Consider the following practices:

• Integrate AI governance and compliance checks into CI/CD pipelines.
• Track model versions, software dependencies, and deployment history throughout the AI lifecycle.
• Maintain documentation such as technical specifications, model cards, risk assessments, and audit logs alongside the associated artifacts.
• Apply policy controls before promoting AI models and software packages into production.
• Clearly define responsibilities across engineering, security, legal, compliance, and product teams.
• Reuse existing controls where possible. Organizations that already maintain SBOMs, software provenance, or secure software development practices (such as the SLSA framework and the Secure Software Development Framework (SSDF) may already satisfy portions of the evidence and traceability requirements introduced by the EU AI Act.

Building these practices into day-to-day development processes helps reduce manual compliance efforts while improving audit readiness as regulatory requirements continue to evolve.

How Does JFrog Help With EU AI Act Readiness?

In our view, EU AI Act readiness benefits from moving beyond static legal spreadsheets into verifiable, binary-level evidence of how AI systems are built, vetted, and deployed across the software supply chain.

JFrog bridges policy and runtime binaries. It enforces controls directly on the artifacts moving through your CI/CD pipelines.

The JFrog Platform supports EU AI Act readiness in developer workflows by applying automated, technical controls across the AI/ML lifecycle:

• JFrog AI Catalog: Serves as a centralized model registry for models from hubs like Hugging Face, with model cards, metadata, and model lineage visibility for security and engineering teams.
• JFrog Curation: Functions as a preventive inline proxy wall at the developer intake boundary, automatically intercepting and blocking open-source packages and Hugging Face models that don’t meet your organization’s policies before they enter local environments or CI/CD pipelines.
• JFrog ML: Helps govern the ML lifecycle by versioning model artifacts within Artifactory and tracking training metadata alongside toolsets like MLflow.
• JFrog Artifactory: Uses DSSE-signed evidence to help build an audit trail that is protected against tampering. This helps show exactly which model version, dataset, and code dependencies were deployed at a given point, providing CISOs with cryptographically verifiable evidence they can use in high-risk AI conformity assessments.
• JFrog Xray & Advanced Security: Extends policy enforcement and binary vulnerability scanning to AI artifacts, detecting security flaws, malicious code, and license violations in third-party model dependencies.
• JFrog AppTrust is your continuous governance layer. It signs every artifact, enforces policy gates, maps ownership, and delivers audit-ready traceability, automatically.

For more information, start a free trial, take a Platform Tour, or set up a one-on-one demo of the JFrog Platform today.