--- title: EU AI Act Compliance: Requirements, Risks, and What to... description: A compliance guide walks through the EU AI Act's staged enforcement timeline (general-purpose AI rules since August 2025, high-risk system requirements from... canonical: https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: EU AI Act Compliance: Requirements, Risks, and What to Document | daily.dev og:description: A compliance guide walks through the EU AI Act's staged enforcement timeline (general-purpose AI rules since August 2025, high-risk system requirements from... og:url: https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig og:image: https://api.daily.dev/og/posts/SLJotIyIG.png og:image:alt: EU AI Act Compliance: Requirements, Risks, and What to Document og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EU AI Act Compliance: Requirements, Risks, and What to Document **[Teleport](https://daily.dev/sources/teleport)** · 15 min read · 0 upvotes · 0 comments ## Summary A compliance guide walks through the EU AI Act's staged enforcement timeline (general-purpose AI rules since August 2025, high-risk system requirements from August 2026, embedded high-risk AI from August 2027) and explains what a conformity assessment requires: risk management documentation, dataset provenance and versioning, Annex IV technical documentation, automatic logging, human oversight measures, and post-market monitoring. It details common compliance gaps across development, integration, open-source licensing, deployment, and procurement phases, plus specific evidence requirements for agentic AI systems including traceability, explainability, and copyright compliance under Article 53. The piece is published by Teleport, which weaves in product-relevant recommendations around cryptographic identity and behavior monitoring for AI agents. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When do the main EU AI Act requirements for high-risk AI systems take effect? The bulk of the EU AI Act, including strict requirements for high-risk AI systems under Annex III and transparency obligations for AI-generated content, takes effect in August 2026. Rules for general-purpose AI models, requiring technical documentation and copyright compliance, became applicable in August 2025. Regulations covering high-risk AI embedded in regulated products under Annex I extend to August 2027. _daily.dev helps compliance and engineering teams track regulatory deadlines like these as they approach._ ### When does a downstream company become the legal provider of a modified general-purpose AI model under the EU AI Act? A downstream actor becomes the provider of a modified GPAI model when fine-tuning or modification causes a significant change in the model's generality, capabilities, or systemic risk. The Commission presumes this occurs when training compute for the modification exceeds one-third of the original model's training compute, or one-third of 10^23 FLOPs if the original compute is unknown; this presumption is rebuttable with evidence. _Teams fine-tuning foundation models can track evolving compliance thresholds like this via daily.dev._ ### Are open-source AI models exempt from EU AI Act compliance obligations? Not automatically. The free and open-license exemption does not apply to general-purpose AI models with systemic risk, defined as models trained with cumulative compute exceeding 10^25 FLOPs, which face full compliance obligations regardless of license type, ensuring open-source models with significant societal impact still undergo rigorous evaluation. _Developers evaluating open-source models for production use can follow regulatory nuances like this on daily.dev._ ## Similar posts on daily.dev - [EU AI Act Guide 2025: AI Security and Compliance Rules](https://daily.dev/posts/eu-ai-act-guide-2025-ai-security-and-compliance-rules-xlytomopx) · Netguru · 0 upvotes · 0 comments - [What Does EU AI Act Compliance Require?](https://daily.dev/posts/what-does-eu-ai-act-compliance-require--fxpo6vqo8) · Docker · 0 upvotes · 0 comments - [EU AI Act Compliance Starts With AI Governance \| Kovrr](https://daily.dev/posts/eu-ai-act-compliance-starts-with-ai-governance-kovrr-ozfuxzqug) · Security Boulevard · 0 upvotes · 0 comments - [AI governance: 11 laws, frameworks, and assurance schemes—and 3 jobs they serve.](https://daily.dev/posts/ai-governance-11-laws-frameworks-and-assurance-schemes-and-3-jobs-they-serve--enkpdmse3) · WunderGraph · 0 upvotes · 0 comments - [The 2026 Data Mandate: Is Your Governance Architecture a Fortress or a Liability?](https://daily.dev/posts/the-2026-data-mandate-is-your-governance-architecture-a-fortress-or-a-liability--cmdzgiroe) · Towards Data Science · 2 upvotes · 0 comments --- Tags: [#big-data](https://daily.dev/tags/big-data), [#compliance](https://daily.dev/tags/compliance), [#agentic-ai](https://daily.dev/tags/agentic-ai), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"EU AI Act Compliance: Requirements, Risks, and What to Document","url":"https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig"},"datePublished":"2026-08-23T12:21:51.783Z","dateModified":"2026-08-24T07:08:08.583Z","description":"A compliance guide walks through the EU AI Act's staged enforcement timeline (general-purpose AI rules since August 2025, high-risk system requirements from...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"big-data,compliance,agentic-ai,ai-governance","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"EU AI Act Compliance: Requirements, Risks, and What to Document"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/eu-ai-act-compliance-requirements-risks-and-what-to-document-sljotiyig#faq","mainEntity":[{"@type":"Question","name":"When do the main EU AI Act requirements for high-risk AI systems take effect?","acceptedAnswer":{"@type":"Answer","text":"The bulk of the EU AI Act, including strict requirements for high-risk AI systems under Annex III and transparency obligations for AI-generated content, takes effect in August 2026. Rules for general-purpose AI models, requiring technical documentation and copyright compliance, became applicable in August 2025. Regulations covering high-risk AI embedded in regulated products under Annex I extend to August 2027. daily.dev helps compliance and engineering teams track regulatory deadlines like these as they approach."}},{"@type":"Question","name":"When does a downstream company become the legal provider of a modified general-purpose AI model under the EU AI Act?","acceptedAnswer":{"@type":"Answer","text":"A downstream actor becomes the provider of a modified GPAI model when fine-tuning or modification causes a significant change in the model's generality, capabilities, or systemic risk. The Commission presumes this occurs when training compute for the modification exceeds one-third of the original model's training compute, or one-third of 10^23 FLOPs if the original compute is unknown; this presumption is rebuttable with evidence. Teams fine-tuning foundation models can track evolving compliance thresholds like this via daily.dev."}},{"@type":"Question","name":"Are open-source AI models exempt from EU AI Act compliance obligations?","acceptedAnswer":{"@type":"Answer","text":"Not automatically. The free and open-license exemption does not apply to general-purpose AI models with systemic risk, defined as models trained with cumulative compute exceeding 10^25 FLOPs, which face full compliance obligations regardless of license type, ensuring open-source models with significant societal impact still undergo rigorous evaluation. Developers evaluating open-source models for production use can follow regulatory nuances like this on daily.dev."}}]} ```