Does the EU AI Act apply to companies outside Europe?

Yes. The AI Act applies to any provider placing an AI system on the EU market and any deployer located within the EU. It also covers systems whose output is used within the EU, regardless of where the provider is based. Like GDPR, it has extraterritorial reach.

What counts as a "high-risk" AI system?

High-risk systems fall into eight categories defined in Annex III: biometrics, critical infrastructure, education, employment, essential service access, law enforcement, migration, and justice. The European Commission estimates only 5-15% of AI systems qualify (CEPS, 2024). Common examples include AI hiring tools, credit scoring, and automated insurance underwriting.

What is the AI literacy obligation and is it already active?

Yes — Article 4 has been enforceable since February 2, 2025. All providers and deployers must ensure staff has sufficient AI literacy — meaning formal understanding of how AI systems work, their limitations, and associated risks. The requirement applies regardless of your system's risk classification.

How much does EU AI Act compliance cost?

Bringing a single high-risk AI product into compliance can cost up to EUR 400,000 for SMEs starting from scratch — including quality management setup (EUR 193,000-330,000) and annual maintenance (EUR 71,400), according to CEPS. That's roughly 17% overhead on AI spending.

How do AI Act fines compare to GDPR fines?

AI Act penalties are steeper. The maximum fine for prohibited practices is EUR 35 million or 7% of global turnover — nearly double GDPR's EUR 20 million or 4% ceiling. Cumulative GDPR fines have reached EUR 7.1 billion since 2018 (DLA Piper, 2026).