EU AI Act — roles, tiers, dates, and the Article 25 trap

Regulation (EU) 2024/1689 is the framework every other one in Veritome hangs off. It is statutory, always on, and it is the one the obligation engine derives per system. It is not a programme you switch on: every system you register is classified against it and gets its obligations from it.

What it asks

Obligations attach by role for a given system — provider, deployer, importer, distributor, authorised representative, all defined in Art. 3 — and by risk tier: prohibited practices under Art. 5; high-risk under Art. 6, through Annex III (stand-alone uses) or Annex I (AI as a safety component of a regulated product); transparency duties under Art. 50 by what the system does; everything else minimal, with voluntary codes under Art. 95. General-purpose AI models carry their own duties under Chapter V (Art. 53–55), regulated as models rather than systems. The same company is often the deployer of one system and the provider of another, which is why classification is per system.

The dates that matter

The Act entered into force on 1 August 2024 and applies in stages under Art. 113. The Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved the two high-risk dates and added two prohibitions.

• Art. 5 prohibitions and Art. 4 AI literacy have applied since 2 February 2025.
• GPAI model duties, the governance bodies and the Art. 99 penalty regime have applied since 2 August 2025.
• Art. 50 transparency duties have applied since 2 August 2026.
• The two new Art. 5 prohibitions — Art. 5(1), points (ba) and (bb): AI nudification tools and AI-generated child sexual abuse material — apply from 2 December 2026. The same date is the Art. 111(4) deadline for synthetic-content systems already on the market before 2 August 2026 to meet Art. 50(2).
• The Annex III high-risk obligations that generate almost all of the work apply from 2 December 2027, deferred by the Digital Omnibus. Veritome shows that date and colours nothing red before it.
• AI embedded in Annex I regulated products — the Art. 6(1) route — applies from 2 August 2028, also deferred.

The Article 25 trap

Put your own name or trade mark on a high-risk system already on the market, substantially modify one, or change a system's intended purpose so that it becomes high-risk, and Art. 25(1) makes you its provider — with the provider's full Art. 16 stack, from risk management (Art. 9) to conformity assessment (Art. 43), the declaration (Art. 47), CE marking (Art. 48) and registration (Art. 49). The original provider stops being the provider for that system but must cooperate and hand over what you need (Art. 25(2)). The registration wizard asks the three questions and the engine swaps the obligation set when one is true. See Am I a provider or a deployer?

What it does not give you

No standard gives a presumption of conformity today: no harmonised standard for the Act has been cited in the Official Journal, and the European standard being drafted for it, prEN 18286, is still in the CEN-CENELEC process. When one is cited, Veritome will map to it; until then every certifiable framework in the product is labelled voluntary and means it. An ISO/IEC 42001 certificate is evidence of a management system, not of conformity with the Act.

In Veritome

Register a system → classify it → the engine generates its obligations across the six phases (Classify · Scope · Implement · Assess · Register · Monitor), gated in order. The Obligations register is where the work lives, Documents is where the Annex IV file, the declaration and the rest are produced, and Frameworks is where the other four frameworks are switched on. Every obligation cites its article, and every date comes from the regulatory registry rather than from the screen that shows it.