What the EU AI Act requires, and what it costs to get wrong
This page is written for the people who carry the exposure rather than the people who run the models. It explains the obligations, the penalties and the evidence a regulator expects. It is useful whether or not you ever buy anything from us, which is the point of publishing it.
Nothing here is legal advice. It is a plain reading of the legislation with links to the text, so you can check every statement against the source.
Evidence / Two distinct questions
Is it intact? Is it still applicable?
Follow a signed record through a source change and see why integrity and current validity need separate checks.
Select an illustrated object to inspect its role.
01 / 03
The record still matches its fingerprint.
Integrity checks detect tested changes to a record. An intact signature links the record to the signed content.
Published local integrity checksAuthenticity does not establish scientific correctness, complete dependencies or current authority.
Selected dates, not a universal clock.
The Act does not automatically apply to every company using AI. Scope depends on your activity, role, location and where the output is used.
Read the scope and penalty note
These are selected application milestones, not a finding that the Act applies to your organisation. Penalties vary by breach and entity size; Article 99 is the source for the enforcement framework. EcoKure records configured controls and evidence, but does not interpret the law or certify compliance.
Source version: 2026-07-27 consolidated Act · reviewed 2026-10-14. Sources: European Commission AI Act timeline · Amended Article 113.
What non-compliance costs
Article 99 sets three tiers. The figures are the higher of a fixed amount or a percentage of worldwide annual turnover. Turnover is revenue, not profit, which is why the numbers are larger than people expect.
| Tier | Ceiling | What triggers it |
|---|---|---|
| Prohibited practices | €35 million or 7% | Breach of Article 5, the practices the Act bans outright. |
| Most other obligations | €15 million or 3% | Breach of the Act's other obligations, including the transparency duties. |
| Misleading information | €7.5 million or 1% | Supplying incorrect, incomplete or misleading information to authorities. |
Article 99(6) works in the opposite direction for small and medium enterprises: the fine is the lower of the fixed amount and the percentage, not the higher. If you are an SME, use the lower figure. Quoting the headline maximum at your own board is not a stronger argument, it is a less credible one.
The part that catches people
Most organisations can answer "do we disclose that this is AI". Far fewer can answer the three questions underneath it, and those are the ones an auditor asks second.
Why was this allowed?
A model returns a probability. An auditor wants a reason. A confidence score of 0.94 does not say which rule was applied, so the evidence you are asked for does not exist as a by-product of running the system.
The evidence changed. What does that affect?
A reference record, a protocol version or a source dataset is superseded. Which earlier decisions are now invalid? Most teams cannot say, so they redo everything or redo nothing. One is expensive and the other is dangerous.
The rules changed. What does that affect?
Guidance is updated. Which of your assessments, approvals and running workflows were built on the superseded version? Work usually continues on the old rule until somebody notices, and that somebody is often the auditor.
What we do about it, briefly
EcoKure sits after your model and decides what is allowed to proceed. Every decision returns a categorical verdict, allow, block, review or abstain, with the reason recorded and signed. When your evidence or your rules change, the affected work is identified and held, and the work that is unaffected stays valid instead of being redone.
The output is an evidence pack you can hand to an auditor and they can verify offline, against a published key, without our source code and without contacting us.
What we do not claim
We cannot guarantee compliance
Compliance is determined by a regulator, not by a vendor. Any supplier who offers you guaranteed compliance is either misunderstanding the obligation or hoping you will not ask what indemnity sits behind the word. We produce evidence. Deciding whether that evidence satisfies the obligation is your counsel's call and ultimately your regulator's.
We do not interpret the law
We do not tell you what a rule means, and we are not a substitute for legal advice, a GRC platform or your quality system. We govern the computational consequences of a decision and a change, which is a narrower job, and the one that currently has no evidence trail.
We do not mark or watermark content
Article 50(2) requires machine-readable marking of synthetic content in the cases it covers. EcoKure does not provide that and has no plans to build it. It is a different technology — provenance signalling embedded in the artefact itself — and it needs a specialist provider such as a C2PA implementation.
What we do is the layer beside it: record that the marking step ran, on which artefact, under which control version, and who signed it off. If you need the marking itself, you need a second supplier, and you should hear that from us before you hear it from your counsel.
Sources: the consolidated Act and the Commission's own guidance. We link to the text rather than paraphrasing it, because a briefing you cannot check against the source is a sales document wearing a briefing's clothes. Consolidated AI Act text · Commission AI Act timeline · Commission transparency guidance
Where it sits in what you already run
Nothing is replaced. The runtime deploys in your own account, so the only thing crossing the seam is a decision request one way and a verdict with its evidence coming back.
What one decision actually does
The same runtime and the same evidence contract as every other pathway. What changes is the control pack and the workflow.