The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. Bans on prohibited practices took effect in February 2025, obligations for general-purpose AI models followed in August 2025, and most of the remaining provisions were scheduled for August 2026. The Commission has since proposed moving some high-risk deadlines later, so the calendar is still worth checking against the current text.
For an operator, the calendar matters less than the shape of the obligation. Most of the Act is about being able to show your work: what the system was for, what data it used, who could override it, and what happened when it made a call.
Identity is where most operations meet the Act
Biometric systems are the clearest case. The Act treats remote biometric identification (picking a person out of a crowd) very differently from biometric verification, where the only purpose is to confirm that a person is who they claim to be. The second is carved out of the high-risk list for biometrics. A hotel check-in that matches a guest's face to the passport they are holding is verification. A camera that scans a lobby for known faces is identification.
That distinction is an engineering choice before it is a legal one. A system designed to answer "is this the person on this document?" produces a narrow, explainable decision with consent captured at the moment it is made. A system designed to answer "who is this?" needs a watchlist, a database and a much harder justification. ENTRIX is built as the first kind on purpose.
What operators should have in place
Whatever category a system falls into, four things make the Act manageable:
- A stated purpose for each system, written down before deployment, so scope creep is visible.
- A human with authority to override, named in the workflow rather than implied.
- Logs that reconstruct individual decisions: inputs, the rule or model version applied, the outcome and who acted on it.
- Consent and retention rules per site, because the same product runs under different obligations in different places.
None of that requires waiting for a deadline. It is the same substrate an operator needs to answer a guest complaint, an insurer or an internal investigation. The Act simply makes the absence of it expensive.
