Question 1

Who is subject to the EU AI Act?

Accepted Answer

Providers who place an AI system on the EU market and deployers who use one under their own authority, plus importers and distributors. Most companies are deployers of vendor systems and providers of the tools they build in house, which means both sets of obligations can apply at once.

Question 2

When do the main obligations apply?

Accepted Answer

The regulation entered into force on 1 August 2024. Prohibited practices and AI literacy duties applied from 2 February 2025, general-purpose model obligations and the governance layer from 2 August 2025, the bulk of the high-risk regime from 2 August 2026, and high-risk AI embedded in regulated products from 2 August 2027.

Question 3

What is the difference between a provider and a deployer?

Accepted Answer

A provider develops the system or has it developed and puts it on the market under its own name. A deployer uses it professionally. Fine-tuning a model, rebranding a tool or substantially modifying its purpose can move you from deployer to provider, which is where most unpleasant surprises come from.

Question 4

What are the sanctions?

Accepted Answer

Up to 35 million euro or 7 percent of worldwide annual turnover for prohibited practices, up to 15 million or 3 percent for most other breaches, and up to 7.5 million or 1 percent for supplying misleading information to authorities, with lower ceilings for SMEs.

Question 5

How does this connect to the GDPR?

Accepted Answer

They stack. The AI Act governs the system as a product, the GDPR governs the personal data inside it. In practice one file serves both: the same inventory, the same lawful-basis analysis, the same oversight evidence feed a DPIA and the AI Act documentation.

Question 6

Do we need an external consultant, or can legal handle it?

Accepted Answer

Legal can own the interpretation. What usually stalls is the technical evidence: logging, accuracy claims, evaluation, oversight design. I sit between the two and produce the artefacts that make the legal position defensible.

Question 7

Do you come on site in Milan or elsewhere in Lombardy?

Accepted Answer

Yes. Inventory workshops and oversight design work far better in the room, in Milan or anywhere in Lombardy. Documentation and review cycles continue remotely.

EU AI Act Compliance for Companies | Kevin Escoda