Yes — the EU AI Act has explicit extraterritorial reach, similar in principle to the GDPR. The regulation applies to providers of AI systems placed on the EU market, providers and deployers whose AI output is used within the EU, and importers and distributors of AI systems in the EU — regardless of where the company is established.

This means a US-headquartered SaaS company deploying AI features to European customers, or an APAC manufacturer exporting AI-enabled equipment to EU buyers, is fully subject to the Act's obligations. Any global company with EU market exposure should conduct a scoping assessment without delay.

The EU AI Act does not replace GDPR — it layers on top of it. For AI systems processing personal data, both regulatory frameworks apply simultaneously. GDPR's principles of data minimisation, purpose limitation, and lawfulness of processing must be respected in the design of training datasets, model inputs, and automated decision-making systems covered by the AI Act.

Critically, GDPR Article 22 rights regarding automated decision-making have specific interactions with AI Act transparency and human oversight requirements. Data Protection Impact Assessments (DPIAs) under GDPR may also need to encompass AI Act risk management obligations. VISTA InfoSec's integrated approach addresses both frameworks in a single, coordinated compliance programme.

The EU AI Act establishes a three-tier penalty structure. Violations involving prohibited AI practices under Article 5 carry the highest penalties: up to €35 million or 7% of total worldwide annual turnover, whichever is greater. Non-compliance with other obligations for high-risk AI systems carries penalties of up to €15 million or 3% of global turnover. Providing incorrect, incomplete, or misleading information to notified bodies and authorities carries penalties of up to €7.5 million or 1% of global turnover.

For SMEs and startups, penalties are capped at the lower of the percentage-based figure or fixed maximum. Enforcement is delegated to designated national competent authorities in each EU member state, with the European AI Office overseeing GPAI model compliance at EU level.

A General-Purpose AI (GPAI) model is an AI model trained on large amounts of data that can serve a wide range of tasks — including but not limited to large language models (LLMs), multimodal foundation models, and image generation systems. The EU AI Act introduces specific obligations for GPAI model providers in Title VIII, with enhanced requirements for those with systemic risk (generally models trained with computational power exceeding 10²⁵ FLOPs).

All GPAI model providers must maintain technical documentation, comply with copyright law and provide summaries of training data, and publish detailed model cards. Those with systemic risk additionally must perform adversarial testing, report serious incidents to the European AI Office, and implement cybersecurity measures. If your company develops or fine-tunes foundation models, these obligations apply to you from August 2025.

Timelines vary significantly based on the number of AI systems in scope, their risk classification, organisational size, and existing compliance maturity. For organisations with a limited number of high-risk AI systems and a reasonably mature governance infrastructure, VISTA InfoSec typically delivers full compliance readiness within 4–6 months.

More complex engagements — such as those involving multiple Annex III systems, GPAI model obligations, or companies starting from a low baseline — typically require 9–15 months. We always begin with a rapid scoping and gap analysis (typically 4–6 weeks) that produces an accurate timeline estimate specific to your environment before full programme commitment.

An AI provider is the entity that develops an AI system and places it on the market — either by selling it to third parties or putting it into service for their own use. Providers carry the primary compliance burden, including technical documentation, conformity assessment, CE marking, and registration in the EU database.

An AI deployer is an entity that uses a high-risk AI system under its own responsibility — typically an organisation integrating a third-party AI product into its operations. Deployers have their own distinct obligations: implementing human oversight, monitoring system operation in context, reporting incidents, and ensuring the AI system is used only within its intended purpose as specified by the provider.

Many organisations are both providers and deployers simultaneously — particularly SaaS companies that develop AI products while also using third-party AI tools internally. Our scoping work precisely maps your obligations in each role.

The EU AI Act contains a number of provisions specifically designed to reduce the compliance burden on SMEs and startups. These include: regulatory sandboxes operated by national competent authorities providing a supervised environment to develop and test AI systems; simplified documentation requirements for SMEs in some contexts; and proportional enforcement guidance. Penalties are also capped at levels intended to prevent disproportionate impact on smaller organisations.

However, the substantive compliance obligations for high-risk AI systems apply regardless of company size — a startup deploying AI in credit scoring or medical diagnosis carries the same technical and documentation obligations as a large enterprise. Our SME-focused compliance packages are designed to achieve full compliance efficiently within the resource constraints typical of growth-stage companies.