What is the EU AI Act?

The quickest way to understand the AI Act is to notice what it copies. It is not built like the GDPR, which follows personal data wherever it travels. It is built like the rules for lifts, medical devices and toys: before a product reaches the market, somebody must establish that it is safe, write down how, and stand behind it.

That has two consequences. The obligation attaches to the system and its intended purpose rather than to the data, so an AI system that touches no personal data can still be heavily regulated if it sits inside a power grid or screens job applicants. And the duties are front-loaded: risk management, documentation, testing and oversight design must mostly exist before go-live.

The reach is extraterritorial. The Act binds providers that place an AI system on the EU market, wherever they are established, and deployers established in the Union. It also catches parties outside the EU when the output is used inside it. A model trained in California and running in Singapore is in scope the moment its output lands on a European desk.

Where the two meet they stack rather than replace each other. The overlaps and the real differences are in EU AI Act vs. GDPR.

In July 2026 the European Union adopted Regulation (EU) 2026/1744, the Digital Omnibus on AI, which pushed the high-risk obligations back by sixteen months because the harmonised standards, notified bodies and conformity assessment capacity needed to meet them were not ready. It entered into force on 27 July 2026, deliberately ahead of the general application date.

Large language models sit awkwardly in a use-based framework, because the use is decided later by somebody else. Chapter V therefore regulates the model instead of the application. It has applied since 2 August 2025 and the Digital Omnibus left it alone, so this is the one part of the timeline that has not shifted.

Every provider of such a model must keep technical documentation, give downstream developers what they need to comply, respect EU copyright law including the text and data mining reservation, and publish a sufficiently detailed summary of its training content. Free and open-source providers are exempt from the first two unless their model carries systemic risk. Above a training compute threshold of 10²⁵ floating point operations systemic risk is presumed, adding state-of-the-art evaluation and adversarial testing, risk mitigation, serious incident reporting and cybersecurity protection. That captures a small group of frontier developers, and compliance can be shown through the General-Purpose AI Code of Practice, signed by more than twenty providers by August 2026.

Two dates matter. Models on the market before 2 August 2025 have until 2 August 2027 to comply. And since 2 August 2026 the Commission's AI Office can enforce: request documentation, run its own evaluations, demand mitigation, restrict or withdraw a model from the EU market, and fine up to 15 million euros or 3 percent of worldwide turnover. The Omnibus also gave it exclusive supervision over systems built on a general-purpose model by the same provider. More in What is GPAI?

The percentages are of total worldwide annual turnover for the preceding financial year, and the authority takes whichever figure is higher. For small and medium-sized enterprises the rule inverts and the lower figure applies. National authorities fine AI systems; the Commission fines general-purpose model providers under Article 101.

The Digital Omnibus left the tiers untouched but added a proportionality track for small mid-cap companies, under 750 employees with turnover up to 150 million euros or a balance sheet up to 129 million euros. Note where Article 50 sits: a chatbot that does not disclose what it is faces the middle tier today.

Rather than creating one AI regulator, the Netherlands keeps supervision with the authorities that already oversee the relevant product or sector. The draft Uitvoeringswet AI-verordening went into public consultation from 20 April to 1 June 2026. It gives the Autoriteit Persoonsgegevens the coordinating role for prohibited practices and for areas without a sectoral supervisor, assigns the Rijksinspectie Digitale Infrastructuur market surveillance for product-related AI, and leaves regulators such as the AFM, De Nederlandsche Bank and the healthcare and education inspectorates in charge of their own domains.

One consequence is worth knowing. That act was not yet in force in October 2026, so Dutch regulators have no national basis yet for AI Act fines. The gap is in the enforcement machinery, not the obligations: Articles 4, 5 and 50 apply directly, the Commission can already act against model providers, and the Autoriteit Persoonsgegevens can already fine under the GDPR where an AI system processes personal data unlawfully.