EU AI Act: Risk Categories, Key Dates and What It Means for Your Vendors
CyberRank Research
The EU AI Act (Regulation (EU) 2024/1689) is the European Union's risk-based law for artificial intelligence: it bans a short list of AI practices, sets strict duties for high-risk systems, adds transparency duties for some others, and leaves most AI largely unregulated. Most organisations meet it through AI they buy rather than AI they build, inside HR software, customer service tools, fraud engines and analytics platforms. CyberRank's AI-use signal (Beta) shows which of your vendors use AI, so you know where to ask AI Act questions first.
TL;DR
- The AI Act sorts AI into four levels: prohibited, high-risk, limited (transparency) and minimal risk.
- Prohibitions and AI-literacy duties have applied since 2 February 2025; general-purpose AI duties since 2 August 2025.
- After the 2026 Digital Omnibus, high-risk duties for Annex III areas apply from 2 December 2027 and for AI in regulated products from 2 August 2028.
- If you use a vendor's high-risk AI, you are a deployer with your own duties: human oversight, monitoring, logs and informing affected people.
- CyberRank's AI-use signal (Beta) shows which vendors use AI and gives candidate risk indications for your team to confirm.
What is the EU AI Act?
The AI Act regulates AI systems by the risk they pose to health, safety and fundamental rights, and it assigns duties to each role in the AI supply chain.
Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages. It reaches organisations outside the EU when they place AI systems on the EU market or when the output of their AI is used in the EU.
How CyberRank helps: risk levels in CyberRank are candidates based on public evidence; your team confirms the level per vendor, because the legal classification depends on how you use the system.
| Risk level | Examples | What the Act requires | How CyberRank helps |
|---|---|---|---|
| Prohibited | ExamplesSocial scoring, manipulative techniques causing harm, untargeted scraping of facial images, emotion recognition at work or school (with exceptions) | What the Act requiresBanned since 2 February 2025 | How CyberRank helpsFlags vendors whose AI use falls in a prohibited candidate area for review (Beta) |
| High-risk | ExamplesAI used in hiring, education, essential services, law enforcement, critical infrastructure and the other Annex III areas; AI safety components of regulated products | What the Act requiresRisk management, data governance, documentation, logging, human oversight, accuracy and security, conformity assessment | How CyberRank helpsMarks a high-risk candidate when the vendor's industry and description match an Annex III area (Beta) |
| Limited risk (transparency) | ExamplesChatbots, AI-generated or manipulated content, emotion recognition outside banned settings | What the Act requiresTell people they are dealing with AI; mark synthetic content | How CyberRank helpsRecords AI use so you can ask about disclosure |
| Minimal risk | ExamplesSpam filters, AI in games, most internal analytics | What the Act requiresNo new obligations; voluntary codes | How CyberRank helpsRecorded as AI use with a minimal-risk candidate level (Beta) |
What are the key AI Act dates after the 2026 Omnibus?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk dates back. Other dates stayed as they were.
The Omnibus also added new prohibited categories. Check the consolidated text with your legal team before relying on a date for a specific system.
How CyberRank helps: it gives you the vendor list to work through before each date, rather than the legal analysis itself.
| Date | What applies | How CyberRank helps |
|---|---|---|
| 2 Feb 2025 | What appliesProhibited practices (Article 5) and AI literacy (Article 4) | How CyberRank helpsProhibited candidate flags point you to vendors worth checking first |
| 2 Aug 2025 | What appliesGeneral-purpose AI (GPAI) model obligations; governance and penalties framework | How CyberRank helpsShows vendors whose public material names a GPAI model or AI features |
| 2 Aug 2026 | What appliesCommission enforcement powers for GPAI; Article 50 transparency duties (generative systems already on the market have until 2 Dec 2026 for content marking) | How CyberRank helpsRecords AI use in the vendor profile for transparency questions |
| 2 Dec 2027 | What appliesHigh-risk duties for Annex III areas | How CyberRank helpsAnnex III candidate areas tell you which vendors need high-risk questions before this date |
| 2 Aug 2028 | What appliesHigh-risk duties for AI in products covered by Annex I EU product law | How CyberRank helpsNot specific to product safety law |
Which areas are high-risk under Annex III?
Annex III lists eight areas where AI is high-risk when used for the purposes it describes.
A system in an Annex III area can fall outside high-risk if it does not materially influence decisions, for example a narrow procedural task. That is why CyberRank treats Annex III matches as candidates, not conclusions.
How CyberRank helps: an Annex III match also increases the weight of AI-related weaknesses in that vendor's risk, so these vendors rise to the top of your review.
| Annex III area | Example vendor use | How CyberRank helps |
|---|---|---|
| Biometrics | Example vendor useRemote identification, biometric categorisation | How CyberRank helpsCandidate match on the vendor's industry and description (Beta) |
| Critical infrastructure | Example vendor useAI safety components in energy, water, transport or digital infrastructure | How CyberRank helpsSame; also shows the vendor's normal security findings |
| Education and vocational training | Example vendor useAdmissions, grading, exam proctoring | How CyberRank helpsCandidate match (Beta) |
| Employment and worker management | Example vendor useCV screening, promotion or termination decisions, task allocation | How CyberRank helpsCandidate match (Beta) |
| Access to essential services | Example vendor useLoan eligibility scoring, public benefits, life and health insurance pricing, emergency call triage | How CyberRank helpsCandidate match (Beta) |
| Law enforcement | Example vendor useRisk assessments, evidence evaluation | How CyberRank helpsCandidate match (Beta) |
| Migration, asylum and border control | Example vendor useApplication assessment, risk screening | How CyberRank helpsCandidate match (Beta) |
| Administration of justice and democratic processes | Example vendor useSupporting judicial decisions, influencing elections | How CyberRank helpsCandidate match (Beta) |
Provider or deployer: whose duties are they?
The provider builds the AI system and carries the conformity duties; the deployer uses it under its own authority and carries oversight, monitoring and information duties.
If you put your own name on a vendor's high-risk system or substantially modify it, you can become its provider.
How CyberRank helps: knowing which bought-in tools use AI is the first step to knowing which role you hold for each one.
| Role | Who it is | Main duties for high-risk AI | How CyberRank helps |
|---|---|---|---|
| Provider | Who it isDevelops the AI system or has it developed and places it on the market under its name | Main duties for high-risk AIConformity assessment, technical documentation, quality management, CE marking, registration, post-market monitoring | How CyberRank helpsLooks for published AI governance and ISO/IEC 42001 certification in the vendor's name, tracked like other certificates in Certificate Compliance |
| Deployer | Who it isUses the AI system under its authority, for example your company using a vendor's hiring AI | Main duties for high-risk AIUse per instructions, assign human oversight, monitor and report incidents, keep logs, inform workers and affected people; some deployers run a fundamental rights impact assessment | How CyberRank helpsTells you which vendors make you a deployer, so you can plan these duties |
| Importer and distributor | Who it isBring a non-EU provider's system into the EU market or resell it | Main duties for high-risk AICheck the provider's conformity and documentation | How CyberRank helpsShows the provider's location and hosting countries |
Does the AI Act apply outside the EU?
Yes, in two ways: a provider anywhere that places an AI system on the EU market is covered, and providers and deployers outside the EU are covered when the AI's output is used in the EU.
An Indonesian software company selling an AI-enabled HR tool to a European customer is therefore a provider under the Act. Personal data used by that AI is also subject to Indonesia's UU PDP at home.
How CyberRank helps: an Indonesian supplier can run CyberRank's free own-organisation assessment (see pricing) to see what its customers will see about its AI use and security.
Why is the AI Act a third-party risk?
AI usually arrives through vendors, and each new AI feature can bring a new risk level, new data flows and new legal duties for you without a new contract.
A CRM adds a generative assistant, an HR platform adds candidate ranking, a security tool adds AI triage. A vendor's model may itself come from another provider, which makes the GPAI provider a fourth party; that dependency chain is the same one described in our article about third-party risk management.
AI also adds security risk on top of compliance risk: prompt injection, data leakage into model training (a route to a data breach) and model supply chain compromise, alongside ordinary weaknesses in the vendor's internet-facing attack surface.
How CyberRank helps: AI use sits in the same profile as the vendor's security rating, breaches and fourth parties, so AI risk is weighed with the rest of the vendor's exposure, alongside the privacy rating.
How do you assess vendor AI under the AI Act?
Find the AI, classify your use with legal, ask high-risk providers for evidence, check personal-data duties, write AI changes into the contract and keep monitoring.
For the discovery step in more depth, see our guide to quantum and AI exposure discovery. Cryptographic readiness is a separate question, covered in our article about quantum security and post-quantum cryptography.
How CyberRank helps: it automates step 1 from public evidence and supports steps 3 and 6 with evidence checks and monitoring.
- Find the AI. List vendors that use AI in the service they provide to you, including features added after the contract.
- Classify your use. For each one, decide with legal whether your use is prohibited, high-risk, limited or minimal, and whether you are a deployer or a provider.
- Ask for evidence. For high-risk candidates, request the provider's instructions for use, conformity information, logging capabilities and human oversight measures. ISO/IEC 42001 is useful evidence only if the certificate or registry entry is in the vendor's own name.
- Check personal data. Where AI makes automated decisions about people, check GDPR Article 22 and UU PDP duties with your DPO.
- Put it in the contract. Notification of new AI features and model changes, incident reporting, logs access and audit rights.
- Monitor. Re-check when vendors add AI features or change models; a one-off review becomes a point-in-time assessment that goes stale.
How does CyberRank show vendor AI use?
CyberRank's AI-use signal is in Beta. It detects AI use from public evidence, gives a candidate AI Act level and lets your team confirm it.
How CyberRank helps: you get a ranked list of vendors to question before 2 December 2027, with the evidence behind each flag.
- Detects AI use from public evidence and records it in the vendor profile.
- Gives a candidate AI Act level (prohibited, high-risk, limited, minimal, or not determined) and, where relevant, the Annex III area that matched.
- Lets your team confirm or change the level, because the classification depends on your use.
- Reports AI governance checks as passed or failed only when public evidence exists, and as "not found" otherwise, rather than guessing.
- Counts ISO/IEC 42001 only as a certificate or registry listing in the vendor's name, not a logo in a website footer.
How does this compare with other security rating providers?
Security rating providers such as SecurityScorecard, Bitsight and UpGuard measure vendor security posture from the outside. None of these ratings, CyberRank's included, is a legal classification under the AI Act; SecurityScorecard, for example, states that its platform does not determine AI Act compliance.
CyberRank takes the same position. Its AI-use signal (Beta) gives candidate levels with the evidence behind them, in the same vendor profile as the security and privacy rating, and your legal team makes the classification.
Where CyberRank does not help
CyberRank does not make a legal classification of any AI system, does not decide whether you or a vendor complies with the AI Act, and does not run conformity assessments, fundamental rights impact assessments or AI incident reporting. It cannot see AI that leaves no public trace, cannot inspect models, training data or prompts, and cannot test a model for bias or accuracy.
Candidate levels are starting points for your legal and risk teams, not conclusions. Treat the dates in this article as a summary; your legal team should confirm them against the consolidated text.
Conclusion
For most organisations the AI Act is a supply chain question: which vendors bring AI into your processes, which of those uses are high-risk, and what that makes you responsible for. The dates are now set, with Annex III high-risk duties from 2 December 2027.
Find the AI, classify your use with legal, ask providers for evidence and build AI changes into contracts and monitoring. CyberRank's AI-use signal (Beta) gives you the first list to work from.
References
Quick answers
Short, direct answers to questions this article raises.
Related questions
Short answers that connect this article with our other guides.
- Quick answerAI and Quantum Questions for Your VendorsEight questions to add to vendor questionnaires on AI use and post-quantum readiness, and how CyberRank checks what vendors expose (Beta).
- Quick answerWhich Vendors Should You Review First?How to rank vendors for review by impact, data, AI use, quantum exposure and the software they ship, and how CyberRank's tiers and heat map help.
- Quick answerHow to Find Hidden Supply Chain RiskWhere supply chain risk hides: software updates, your vendors' suppliers, AI models and vendor cryptography, and how CyberRank brings it into view.
- Quick answerAI and Quantum Vendor Risk Deadlines, 2026–2035The AI Act and post-quantum dates from 2026 to 2035 in one table, what to ask vendors before each, and how CyberRank tracks vendor readiness.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating