What is the EU AI Act, and does it apply to Canadian companies?
By Nick Jang, founder of MINERVA Studio ·
The short answer
The EU AI Act, Regulation (EU) 2024/1689, is the European Union’s law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages: bans on prohibited practices since February 2025, rules for general-purpose AI models since August 2025, transparency duties since August 2026, and, after the 2026 Digital Omnibus, obligations for stand-alone high-risk systems such as credit scoring from 2 December 2027. It reaches companies outside the EU, including Canadian ones, when their AI is placed on the EU market or its output is used in the EU.
The four risk tiers
| Tier | Examples | What applies |
|---|---|---|
| Prohibited | Social scoring that leads to unjustified harm, manipulative techniques that cause harm, untargeted scraping of facial images, emotion recognition at work or school (with exceptions). | Banned. |
| High-risk | Creditworthiness assessment and credit scoring of individuals, risk assessment and pricing in life and health insurance, recruitment, access to essential services; AI in regulated products. | Risk management, data governance, documentation, logging, transparency to deployers, human oversight, accuracy and robustness, conformity assessment, registration. |
| Limited risk (transparency) | Chatbots, AI-generated or manipulated content, deepfakes. | People must be told they are dealing with AI, and synthetic content marked. |
| Minimal risk | Spam filters, most internal analytics. | No new obligations; voluntary codes encouraged. |
General-purpose AI models, such as large language models, have their own chapter: documentation and copyright duties for all providers, and extra duties for models with systemic risk.
When the EU AI Act applies
The Act entered into force on 1 August 2024. In July 2026 the EU adopted the Digital Omnibus on AI, which pushed back the high-risk deadlines. The dates now stand as follows:
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices; AI literacy duties. |
| 2 August 2025 | General-purpose AI model obligations; governance and penalties framework. |
| 2 August 2026 | Transparency duties under Article 50 (a grace period to 2 December 2026 for marking content from systems already on the market). |
| 2 December 2027 | High-risk systems listed in Annex III, including credit scoring and life and health insurance pricing. |
| 2 August 2028 | High-risk AI that is part of products covered by EU product law (Annex I). |
Check the Official Journal for the final text of the Omnibus before relying on a date; secondary summaries of it differ on smaller points.
Does the EU AI Act apply to Canadian companies?
It can. Like the GDPR, the Act reaches beyond the EU. It applies to:
- Providers that place an AI system or general-purpose model on the EU market or put it into service in the EU, wherever they are established;
- Deployers of AI systems located in the EU;
- Providers and deployers outside the EU where the output of the AI system is used in the EU.
Some concrete cases. A Canadian bank that scores only Canadian applicants with its own model is outside the Act. The same bank’s EU subsidiary using AI to score borrowers there is inside it, for that use. A Canadian AI vendor selling a credit-scoring product to European lenders is a provider of a high-risk system, and needs to meet the provider duties, conformity assessment included. The UK isn’t in the EU and has its own approach, but a UK firm serving EU customers gets caught the same way.
What it means for banks and insurers
Two Annex III uses matter most in financial services: AI that evaluates the creditworthiness or credit score of individuals (AI used to detect fraud is excluded), and AI used for risk assessment and pricing in life and health insurance. For those, a provider must run a risk management system, govern training data, keep technical documentation and logs, design for human oversight, meet accuracy and robustness requirements and pass conformity assessment. A deployer, such as a bank using a vendor’s system, must use it as instructed, assign human oversight, monitor it, keep logs and, in some cases, carry out a fundamental rights impact assessment.
Banks in the EU are supervised for much of this by their existing financial supervisors. For a Canadian group, the practical point is that the same inventory, risk rating, documentation and human oversight that OSFI E-23 expects carry most of the weight here too. MINERVA includes an EU AI Act high-risk rule pack beside the E-23 pack, so one record can be read against both.
Penalties
Fines reach up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices; up to €15 million or 3% for most other breaches; and up to €7.5 million or 1% for supplying incorrect information to authorities, with lower caps for small and medium enterprises.
Related questions
Is the EU AI Act in force?
Yes. It entered into force on 1 August 2024 and applies in stages; prohibited practices, AI literacy, general-purpose AI rules and transparency duties already apply.
When do the high-risk rules apply?
After the 2026 Digital Omnibus, from 2 December 2027 for stand-alone high-risk systems in Annex III and 2 August 2028 for AI in regulated products.
Is credit scoring high-risk under the EU AI Act?
Yes. AI used to evaluate the creditworthiness or establish the credit score of natural persons is listed in Annex III, except AI used to detect financial fraud.
Does the EU AI Act apply to the UK?
Not as UK law. It applies to UK companies when they place AI on the EU market or its output is used in the EU.
Does Canada have a law like the EU AI Act?
Not yet. Canada’s proposed Artificial Intelligence and Data Act died in January 2025. See who regulates AI in Canada.
Sources
- EUR-Lex — Regulation (EU) 2024/1689 (the AI Act)
- European Commission — AI Act
- Gibson Dunn — EU AI Act Omnibus agreement: postponed high-risk deadlines
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.