The EU AI Act in Plain Terms
The EU AI Act, formally Regulation (EU) 2024/1689, is the first broad law governing how artificial intelligence is built and used. It sorts AI systems by the risk they pose to people, from banned uses to lightly regulated ones, and sets duties for the firms that supply and deploy them. It came into force on 1 August 2024.
The Act reaches Swedish organisations even when the AI is built elsewhere, because it applies once a system’s output is used in the EU. Its fines run higher than GDPR. And, unusually, it writes specific security requirements for AI into law rather than leaving them to best practice.
That last point is why this guide treats the Act as a security topic and not only a legal one. For the first time an AI system can fail an audit or draw a fine because it was not defended against the attacks that target machine learning.
The Four Risk Tiers
The Act does not treat all AI the same. It places every system into one of four tiers by the risk it carries and the tier decides the duties. This risk-based design is the core of the law.
- Unacceptable Risk: A short set of uses is banned outright. These include social scoring, manipulative techniques, scraping facial images from the web or CCTV to build recognition databases, emotion recognition at work or school and most real-time facial recognition in public by police. These prohibitions have applied since 2 February 2025.
- High Risk: Systems used for things like hiring, credit scoring, access to public services, biometric identification, critical infrastructure and medical devices. These carry the heaviest duties from risk management and data governance to human oversight and the security rules in Article 15.
- Limited Risk: Systems people interact with directly such as chatbots and AI-generated or manipulated content. The duty here is transparency. Users must be told they are dealing with AI which applies from 2 August 2026. Providers must also mark AI-generated audio, images, video and text so it can be detected as synthetic, a duty the Digital Omnibus moved to 2 December 2026 for systems already on the market..
- Minimal Risk: Everything else from spam filters to recommendation engines. The Act adds no new duties here beyond the general requirement to keep staff AI-literate.
Most business AI lands in the limited or minimal tiers. The duties that bite hardest and the security rules at the centre of this guide, attach to the high-risk tier.
The Cybersecurity Duties for High-Risk AI and GPAI
Article 15 is where the AI Act becomes a security law. It requires every high-risk AI system to reach an appropriate level of accuracy, robustness and cybersecurity and to hold that level across its whole life. In plain terms a high-risk system must keep working when something or someone, tries to break it.
What makes Article 15 different is that it names attacks specific to machine learning. A high-risk system has to be resilient against unauthorised attempts to change its use, outputs or performance by exploiting weaknesses.
- Data poisoning: Tampering with the training data so the model learns the wrong thing.
- Model poisoning: Tampering with a pre-trained component or model the system is built on.
- Adversarial examples: Inputs crafted to make the model make a mistake it otherwise would not.
- Confidentiality attacks: Attempts to extract the model, its parameters or the data behind it.
- Model flaws: Weaknesses in the model itself that an attacker can exploit.
A firewall does not stop data poisoning. These attacks reach the model and its data, not the network around it, so the controls are different. They include governing where training data comes from, testing the system against adversarial inputs before launch, checking the provenance of any model you pull in and watching for odd behaviour in production.
The Rules for General-Purpose AI
Separately, the Act regulates general-purpose AI, the large models that sit behind many business tools. These rules have applied since 2 August 2025. Every provider of such a model owes transparency and documentation.
A smaller group of the most capable models is treated as carrying systemic risk, presumed once a model is trained with more than 10^25 floating-point operations (FLOPs). Their providers must run adversarial testing, report serious incidents to the EU’s AI Office and ensure an adequate level of cybersecurity for the model and the infrastructure it runs on.
One timing point matters. The general-purpose AI rules and the transparency duties already apply. The Article 15 duties attach to high-risk systems from 2 December 2027 and from 2 August 2028 for AI built into regulated products. The requirement is set, the clock is simply later.
Timeline, Status and Penalties
The Act is live and applying in stages. As of 2026 the bans, the AI-literacy duty, the general-purpose AI rules and the transparency duties are all in force. The heaviest duties for high-risk systems were pushed back in 2026 but are still coming.
In mid-2026 the EU adopted the Digital Omnibus, Regulation (EU) 2026/1744, which came into force on 27 July 2026. It moved the high-risk deadlines to give regulators and standards bodies more time. Stand-alone high-risk systems now must comply by 2 December 2027 and AI built into regulated products by 2 August 2028.
It would be a mistake to read this as a pause. The Omnibus left most transparency duties on their original 2 August 2026 date, though it moved the marking of AI-generated content under Article 50(2) to 2 December 2026 for existing systems. It also added two new bans on AI that generates non-consensual intimate images and child sexual abuse material from 2 December 2026. The parts already in force still apply in full.
The fines are set in Article 99 and are tiered by how serious the breach is.
- Up to €35 million or 7% of global annual turnover for using a banned AI practice whichever is higher.
- Up to €15 million or 3% for breaching other duties including the high-risk requirements and the general-purpose AI rules.
- Up to €7.5 million or 1% for giving authorities incorrect or misleading information.
Smaller caps apply to SMEs and start-ups. National market surveillance authorities enforce most of the Act while the European Commission’s AI Office oversees general-purpose models.
On scope, the Act reaches providers that place AI on the EU market and organisations that deploy it in the EU. It also reaches providers and deployers outside the EU when the system’s output is used here. Most organisations are deployers rather than builders and deployers carry real duties of their own.
Real-World Cases
The Act did not appear from nowhere. Each tier answers harms regulators have already had to deal with and the cybersecurity rules answer attacks researchers have already shown. Three examples make the pattern clear.
Clearview AI and the Scraping Ban
In September 2024 the Dutch Data Protection Authority fined the US firm Clearview AI €30.5 million with up to €5.1 million in further penalties for building a database of billions of facial images scraped from the internet without consent. The regulator also warned Dutch organisations not to use the service.
That fine came under GDPR, before the AI Act applied. The Act now names the practice directly. Untargeted scraping of facial images to build recognition databases is a banned use so here consent is beside the point. The use itself is off the table.
The Dutch Childcare Benefits Algorithm
A few years earlier, a self-learning algorithm used by the Dutch tax authority to flag childcare-benefit fraud treated dual nationality as a risk indicator. Families with a second nationality were marked as more suspicious and investigated harder.
Around 30,000 families were wrongly accused and the Dutch cabinet resigned in January 2021. In 2021 the data protection authority fined the tax authority €2.75 million for the unlawful and discriminatory use of nationality data.
This is the harm the high-risk tier exists to prevent. The duties now required of such a system, from bias testing and data governance to logging and genuine human oversight, are aimed squarely at a case like this.
PoisonGPT and the AI Supply Chain
In 2023 researchers showed how the supply chain itself can be attacked. They surgically edited an open-source model so that it answered one specific question with false information while passing every standard benchmark, then uploaded it to a public model hub under a name almost identical to a well-known project.
The demonstration, logged by the MITRE ATLAS knowledge base, is model poisoning in the sense Article 15 means. Anyone pulling the model by its name alone would have shipped the tampering with it.
The control is provenance. Verify who published a model, prefer signed and verified formats and do not trust a hub listing by its name. A model you did not build is a dependency, and it deserves the same scrutiny as any other.
The AI Act and Your Other Obligations
For most Swedish organisations the hard part is not the AI Act on its own. It is that the Act stacks on laws they already answer to. The same AI system can sit under several regimes at once.
NIS2 and Cybersäkerhetslagen
If you are an essential or important entity, an AI system in your estate falls under both the AI Act and NIS2, brought into Swedish law as Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026. NIS2 Article 21 already requires you to manage the risk of that system and your board is accountable under Article 20.
The reporting duties also overlap. A serious AI incident may trigger the NIS2 cascade to MCF (formerly MSB), a 24-hour early warning followed by a 72-hour notification, as well as the AI Act’s own incident reporting once the high-risk rules apply.
GDPR
Almost any high-risk AI touches personal data which means GDPR applies in parallel. Following GDPR does not make you AI Act compliant and the reverse is also true. In practice a high-risk system often needs a data protection impact assessment under GDPR alongside the conformity assessment the AI Act demands.
DORA
Financial entities have a third layer. AI used in a bank, insurer or other financial firm falls under DORA’s rules on ICT risk and incident management supervised in Sweden by Finansinspektionen, on top of the AI Act.
ISO Standards and the Swedish Authorities
A management-system standard helps you carry all of this. ISO/IEC 42001 for AI, alongside ISO 27001 for information security gives a governance backbone that maps onto many AI Act duties. The Act’s own harmonised standards are still being written which is part of why the high-risk rules were delayed.
In Sweden the supervision is shared. On 12 June 2026 the government named Post- och telestyrelsen (PTS) as the coordinating authority and single point of contact, with the privacy regulator IMY, Finansinspektionen, Läkemedelsverket and Swedac covering their areas. Different laws, different authorities, one organisation answering for all of them.
How to Tell If the Act Applies to You
Before building a compliance programme, place yourself. A few questions settle most of it.
- Are you a provider or a deployer? A provider builds or puts an AI system on the market under its own name. A deployer uses one in its work. Most organisations are deployers and deployers still have duties from using a system as instructed to keeping a human in oversight.
- Is the use high-risk? Check the system’s purpose against the Act’s high-risk list, things like hiring, credit, access to services, biometrics and critical infrastructure. If it is, the full set of duties applies when the high-risk dates arrive.
- Does it interact with people or generate content? If so the transparency duties already apply, whatever the risk tier. People must know they are dealing with AI and synthetic content must be labelled.
Be honest about the grey areas. Classification is genuinely hard at the edges. The harmonised standards that will pin down terms like robustness are not finished and a system can move tiers as you change what it does. When a use sits near the high-risk line, treat it as high-risk until you can show otherwise.
How to Prepare
You do not have to wait for the high-risk deadline to act and the organisations that start now will not be scrambling in 2027. Preparation runs across people, process and technology.
- Inventory your AI. Build and keep a live list of every AI system in use including the tools staff reach for on their own. You cannot govern what you cannot see.
- Classify each system by tier. Record whether each use is prohibited, high-risk, limited or minimal and who the provider and deployer are. The tier sets the workload.
- Train your people. Article 4 already requires AI literacy. Make sure anyone who uses or oversees AI understands what it does and where it fails.
- Put a human in the loop. For any system that affects a person, keep someone able to understand its output and overturn it. This is the single control that answers most high-risk duties.
- Add the Article 15 controls to high-risk systems. Govern your training data, test against adversarial inputs, check model provenance and monitor behaviour in production.
- Get incident reporting ready. Map how an AI failure would be reported and line it up with your existing NIS2, GDPR and DORA duties so one incident does not mean three scrambles.
None of this needs to happen at once. Start with the inventory and the classification because every other step depends on knowing what you run and how risky it is. From there the duties become a plan rather than a surprise.
