The Act sorts AI uses into unacceptable, high-risk, limited-risk, and minimal-risk buckets, with escalating obligations: risk management, data governance, transparency, human oversight, and post-market monitoring. General-purpose model providers have their own layer of duties.
Penalties reach 7% of global turnover. It applies extraterritorially: if your model or system is used in the EU, you are in scope.