The EU AI Act applies to AI systems placed on the EU market, put into service there, or whose outputs are used in the EU, wherever the company is based. Applicability is decided per system and per use case.
Start with three questions. Does the system meet the Act's definition of an AI system? Is it placed on the EU market or put into service there? Are its outputs used in the EU? If the answers are yes, the Act applies, whether the company sits in the EU, in Switzerland, or elsewhere. Swiss companies with EU customers are one of the most common cases.
Next, check whether the use is prohibited under Article 5. Certain social scoring practices and manipulative techniques are banned outright. Then check the scope exclusions, for example systems developed or used exclusively for military, national security, or pure scientific research purposes.
Finally, identify the organization's role, since a provider and a deployer carry different obligations. Because the answer depends on the system, its purpose, and the role held, applicability should be documented for each system rather than assumed once for the whole company.
The Certified EU AI Governance Professional course covers this screening on Day 1: defining system boundaries, screening for prohibited practices, and determining the organization's role, so the result is written down and can be defended to an auditor.
Many teams stall on the provider or deployer question and never write the answer down. Record the system boundary and the organization's role for each use case before drafting any compliance plan, because both decide which obligations apply.
“Settle whether the Act applies before anything else; every later decision depends on that answer.”
This ISO/IEC 42001 Lead Auditor training prepares audit, risk, and compliance professionals to assess Artificial Intelligence Management Systems (AIMS) in a structured, defensible way. The course focuses on planning, conducting, and closing ISO/IEC 42001 audits in real organizational environments, addressing governance, ethical use of AI, risk management, and regulatory expectations shaping 2024–2025. Participants learn to interpret ISO/IEC 42001 requirements from an auditor’s perspective, evaluate objective evidence, and formulate audit conclusions that stand up to certification scrutiny and executive review.
View courseThis Lead AI Risk Manager training prepares professionals to design, operate, and defend an AI risk management program aligned with regulatory and governance expectations. The course focuses on practical risk identification, decision traceability, and defensible mitigation strategies across the AI.
View courseThis ISO/IEC 42001 Lead Implementer course trains professionals to design and deploy an Artificial Intelligence Management System that stands up to regulatory, ethical, and operational scrutiny.
View courseA provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority. One organization can hold both roles for different systems.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. Bans on prohibited AI have applied since 2 February 2025; governance and general-purpose AI (GPAI) obligations since 2 August 2025; the transparency rules since 2 August 2026; and, since the Digital Omnibus on AI (Regulation (EU) 2026/1744), the Annex III high-risk rules apply from 2 December 2027. High-risk systems embedded in already-regulated products have until 2 August 2028.
Often, yes. Switzerland is not in the EU, but the EU AI Act has extraterritorial reach: it applies to Swiss providers and deployers whose AI systems are placed on the EU market or whose outputs are used within the EU (Art. 2). Swiss firms serving EU customers must comply, and Switzerland is separately preparing domestic AI rules aligned with the Council of Europe AI Convention.
Providers of high-risk AI systems must prepare technical documentation before the system is placed on the market, following the content set out in Annex IV, and keep it up to date. The documentation shows how the system meets the requirements for high-risk AI.
The course suits compliance and AI governance leads, legal counsel and data protection officers, technical AI teams, and consultants or executives who must show defensible AI governance. Each role works through a different part of the AI Act.
The EU AI Act sorts AI systems into four levels: unacceptable risk (prohibited), high risk, limited risk with transparency duties, and minimal risk. A system is high risk if it is a safety component covered by EU product legislation or falls under a use case listed in Annex III.
A fundamental rights impact assessment (FRIA) is a documented evaluation of how a high-risk AI system could affect people's fundamental rights before it is deployed. Under Article 27, it applies to certain deployers, including public bodies and private entities providing public services.
Browse all FAQs →
Full knowledge base
Necessary cookies are always active. You can accept, reject non-essential cookies, or customize your preferences.