The Act sorts AI into prohibited practices, high-risk systems (Annex I product-embedded and Annex III stand-alone), systems with transparency duties, and general-purpose AI (GPAI) models, with a heavier regime for GPAI models presenting systemic risk. Obligations scale with the tier. Providers of high-risk systems must run a risk management system (Article 9), govern training data (Article 10), maintain technical documentation and automatic logging (Articles 11 and 12), design for human oversight (Article 14), and meet accuracy, robustness and cybersecurity requirements (Article 15), all inside a quality management system and a conformity assessment.
The security obligations in detail
Article 15 is the AI security clause. It requires high-risk systems to be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system-specific vulnerabilities, and names the attack classes to address: data poisoning, model poisoning, adversarial examples and model evasion, confidentiality attacks and model flaws. Where a high-risk system is also a product with digital elements under the Cyber Resilience Act, meeting the CRA's essential cybersecurity requirements is deemed to satisfy Article 15's cybersecurity requirement. Article 73 requires providers to report serious incidents to the market surveillance authority immediately and no later than 15 days after becoming aware, shortened to two days for widespread infringements or incidents involving critical infrastructure and ten days where a death is involved.
For GPAI models with systemic risk, Article 55 adds obligations that read like a frontier safety framework: state-of-the-art model evaluation including adversarial testing, assessment and mitigation of systemic risks at Union level, tracking and reporting of serious incidents and corrective measures to the AI Office, and an adequate level of cybersecurity protection for the model and its physical infrastructure. The General-Purpose AI Code of Practice is the recognised route to demonstrating compliance with these duties.
Application timeline after the Digital Omnibus
The Act entered into force on 1 August 2024. Prohibitions and AI literacy duties applied from 2 February 2025 and GPAI obligations from 2 August 2025. Regulation (EU) 2026/1744, in force since 27 July 2026, deferred high-risk obligations: Annex III systems now apply from 2 December 2027 and Annex I product-embedded systems from 2 August 2028. Article 50 transparency duties were not delayed and apply from 2 August 2026, when the AI Office's enforcement powers over GPAI providers also became exercisable; the Article 50(2) marking duty for systems already on the market applies from 2 December 2026, as do new prohibitions on AI systems that generate non-consensual intimate imagery or child sexual abuse material.
What security teams should do now
Inventory and classify systems against Annex III with the new dates. Treat Article 15 as a control catalogue: map poisoning, evasion, extraction and prompt injection to tested controls and keep the evidence. Build the Article 73 incident pipeline now, because the clock is counted in days and the definitions differ from NIS2 and GDPR. If you supply or deploy a systemic-risk GPAI model, align red teaming, incident tracking and weight security with the Code of Practice's Safety and Security chapter, and implement machine-readable marking for synthetic content ahead of the December 2026 legacy deadline.
Key dates
- 1 Aug 2024Entry into force
- 2 Feb 2025Prohibited practices and AI literacy apply
- 2 Aug 2025General-purpose AI obligations and governance provisions apply
- 27 Jul 2026Digital Omnibus amendment in force
- 2 Aug 2026Article 50 transparency duties apply; AI Office enforcement powers over GPAI providers
- 2 Dec 2026New prohibitions and legacy marking duty apply
- 2 Dec 2027Annex III high-risk obligations apply
- 2 Aug 2028Annex I product-embedded high-risk systems apply