EU AI Act Compliance Guide

Gibraltar is not an EU member, but any company deploying, developing, or selling AI systems into the EU market falls under the Act's scope. Many Gibraltar firms in iGaming, finance, and fintech serve EU customers.

Fines can reach up to €35 million or 7% of global annual turnover for prohibited AI practices, €15 million or 3% for high-risk violations, and €7.5 million or 1.5% for providing incorrect information.

Prohibited practices were banned from February 2025. General-purpose AI transparency rules apply from August 2025. Full high-risk conformity obligations roll out through 2026-2027.

AI used in critical infrastructure, education, employment, essential services, law enforcement, migration, or democratic processes is classified as high-risk and requires conformity assessment.

Chatbots fall under "limited risk" and require transparency obligations — users must be informed they are interacting with an AI system.

Social scoring by governments, real-time biometric surveillance in public spaces, AI that manipulates vulnerable groups, and systems that classify people based on biometric data to infer sensitive characteristics.

Technical documentation (Article 11), conformity assessment, risk management system, data governance, logging capabilities, human oversight, and accuracy/robustness/cybersecurity requirements.

High-risk AI systems require conformity assessment before market placement. Some categories require third-party assessment, while others allow self-assessment.

We provide risk classification assessment, technical documentation generation, governance framework design, and ongoing compliance monitoring for Gibraltar firms.