EU AI Act

The Risk-Based Structure#

The Act is the EU's attempt to create a single horizontal regulation for AI rather than relying on sectoral law. It works by sorting AI systems into four risk tiers and applying very different obligations to each:

General-Purpose AI Models#

The Act creates a parallel set of obligations specifically for general-purpose AI (GPAI) models — foundation models, large language models, multimodal models — regardless of how downstream applications are tiered.

Baseline GPAI providers must publish a summary of training data, comply with EU copyright law, and maintain technical documentation. GPAI models with 'systemic risk' (a threshold set on training compute, currently 10^25 FLOPS as of 2026 amendments) carry heavier obligations including model-evaluation reports, incident reporting, and cybersecurity-protection measures for model weights.

Timeline#

The Act entered into force in August 2024. Application is phased so that organisations have time to adapt:

• February 2025 — prohibited practices in force.
• August 2025 — GPAI obligations in force.
• August 2026 — most high-risk system obligations in force.
• August 2027 — full application to high-risk systems embedded in regulated products (medical devices, vehicles).

High-Risk Obligations in Practice#

If you operate a high-risk AI system, the headline obligations are:

• Conformity assessment — internal or third-party, depending on the use case.
• Risk-management system covering the AI lifecycle.
• Data governance — training, validation, and test data must meet quality and bias requirements.
• Technical documentation that allows authorities to assess compliance.
• Logging that allows post-market monitoring and incident investigation.
• Human oversight built into the system design — not bolted on.
• Accuracy, robustness and cybersecurity appropriate to the use case.
• Registration in the EU AI database before market placement.

Extraterritorial Scope#

The Act applies to providers and deployers established in the EU, but also to providers established outside the EU whose AI systems are placed on the EU market, and to providers/deployers whose AI output is used in the EU. UK providers therefore face the same exposure as EU ones if they sell into the bloc — broadly comparable to how GDPR works.

Fines#

Fines tier with the obligation tier:

• Up to USD 39 m or 7% of global annual turnover — prohibited-practice violations.
• Up to USD 17 m or 3% of global annual turnover — most other violations.
• Up to USD 8 m or 1% of global annual turnover — providing incorrect information to authorities.

Where Yobitel Sits#

Yobibyte and the Yobitel marketplace are positioned as deployment infrastructure — we are not the model provider for third-party models on the marketplace. For models we train ourselves, we maintain GPAI documentation under the Act. Customers building high-risk systems on our infrastructure receive the technical artefacts (logging, model lineage, training-data provenance) needed to satisfy their own conformity assessment.