Progress Software Completes Acquisition of Domo's AI and Data Platform Business. Learn more
Made AI boring. Now let's make it practical.
Made AI Boring established the why. The Agentic AI Maturity Model establishes the how-far. Practical AI is the how-now — defensible answers, governed and measured. The EU AI Act is the deadline that makes all three urgent.
Direct answer
The EU AI Act is the world's first horizontal regulation for artificial intelligence. It establishes a risk-based framework, commonly described as four tiers, transparency obligations, conformity and incident-reporting duties, and penalties of up to €35 million or 7% of total worldwide annual turnover, whichever is higher, for breaches of the prohibited-practice rules in Article 5.
The dates that matter now:
Why This Page Matters
The EU AI Act has done something quietly profound: it has moved enterprise AI from a marketing conversation into a procurement conversation, and from a procurement conversation into a board conversation.
For five years, governance was the slide that nobody read. From August 2026, governance is the slide the regulator reads first.
This page is for three audiences who keep meeting at the same table for different reasons:
We have built this page in layers so each audience can read down to the depth they need.
THE 90-SECOND EXPLAINER
The EU AI Act treats AI systems the way other safety-critical sectors are already treated. The higher the risk an AI system poses, the higher the obligations on the people who provide it and the people who deploy it.
timeline: dates that matter
| Date | Milestone | What It Means |
|---|---|---|
| 1 Aug 2024 | Act entered into force | The clock started |
| 2 Feb 2025 | Prohibited practices apply | Article 5 ban becomes operational |
| 2 Aug 2025 | GPAI obligations apply (new models) | Transparency, copyright and systemic-risk obligations live |
| 2 Aug 2026 | Commission enforcement powers over GPAI model providers activate · Article 50 transparency obligations apply | From this date the European Commission may fine providers of general-purpose AI models under Article 101. The Article 99 penalty framework applicable to other operators has applied since 2 August 2025. Neither date moved in the Digital Omnibus on AI |
| 2 Dec 2026 | End of transitional period for Article 50(2) machine-readable marking · two new Article 5 prohibitions apply | Article 50 has applied since 2 August 2026. Regulation (EU) 2026/1744 provides a transitional period to 2 December 2026 for the Article 50(2) machine-readable marking of synthetic content in respect of systems placed on the market before 2 August 2026. The two new Article 5 prohibitions also apply from this date |
| 2 Dec 2027 | High-risk standalone systems (Annex III) must comply | Employment, education, justice, biometrics, critical infrastructure |
| 2 Aug 2028 | High-risk embedded systems (Annex I) must comply | Medical devices, machinery, toys, regulated products |
Regulation (EU) 2026/1744 (the Digital Omnibus on AI) amends the AI Act. It was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It defers the high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) and adds two prohibited practices that apply from 2 December 2026. The GPAI enforcement date and the Article 50 transparency dates did not move.
Penalty bands
The EU AI Act sets the administrative-fine framework applied by Member State authorities to operators and notified bodies.. The 'whichever is higher' mechanic is what makes these fines material at enterprise scale.
| Tier | Violation | Maximum fine |
|---|---|---|
| Tier 1 | Prohibited AI practices (Article 5) — including the two prohibitions added by Regulation (EU) 2026/1744, which apply from 2 December 2026 | €35M or 7% turnover |
| Tier 2 | High-risk non-compliance · Article 50 transparency violations · other obligations of providers, importers, distributors and deployers | €15M or 3% turnover |
| Tier 3 | Supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request | €7.5M or 1% turnover |
| Article 101 (separate regime) | Providers of general-purpose AI models — imposed by the European Commission, not Member State authorities | €15M or 3% turnover |
Under Article 99(6), for SMEs including start-ups each fine is capped at the lower of the percentage or the fixed amount. Regulation (EU) 2026/1744 adds a parallel 'lower of' protection for small mid-cap enterprises.
five problems the act creates for enterprises
The Act does not just create new compliance work. It exposes structural weaknesses in how most enterprises have built AI so far.
Regulators have stopped asking 'what is your AI policy' and started asking 'show me your control working in production.' In our experience the questions tend to cluster around a small number of themes. The list below is our own summary and does not correspond to any specific provision of the Act: what data was accessed and was access permitted, what policy was enforced at runtime, which model and version was used, what retrieval context and reasoning trace led to the output, who approved the deployment, what changed since the last audit, and — the killer question — if you re-ran the same scenario tomorrow, would the system produce the same answer, and if not, why not.
Most AI architectures cannot answer those questions because the architecture was never asked to. Logs exist for the model. Logs exist for the data. Logs do not exist for the meaning that connected the two, or for the policy that bounded the answer.
Procurement teams in regulated industries are now writing conformity-ready language into RFPs. We have seen requests for conformity-ready documentation reach vendors before the requesting organisation's own architecture teams have scoped the same requirement internally.
Regulatory accountability generally rests with the entity that is itself regulated, and commentators have noted that it tends to escalate to accountable senior management. Contractual allocation of risk between a customer and its vendors does not change who a regulator holds responsible. Where a particular obligation sits will depend on each party's role under the Act as provider, deployer, importer or distributor.
The Agentic AI Maturity Model is built around a hard truth from compounding maths: when an agent takes four steps and each has even an 8% error rate, workflow success is around 72%. At 22% per-step error, it falls to 37%. These are illustrative arithmetic examples rather than measured product results. Where an AI system is in scope, the Act's requirements attach to the system and its intended purpose rather than to a single model output.
THREE OPPORTUNITIES INSIDE THE REGULATION
For organisations that prepare properly, the Act is a forcing function for the kind of AI work that creates lasting value.
Where organisations are customising agents faster than they can govern them, being able to demonstrate governance is itself a wedge. Buyers in regulated industries are increasingly asking providers for evidence, and boards are more likely to fund AI work that can be audited.
The Practical AI conversation moves from 'trust me, this will save money' to 'here is the cost per defensible answer, here is the evidence we can produce if we are asked, here is the audit trail.' The economic argument finally has a measurable unit.
Organisations that build proportionate controls as autonomy increases — from assistive AI, through contextual, coordinated, and agentic AI, to governed autonomy — are in our view better placed to meet the obligations that apply to them. The Agentic AI Maturity Model is a Progress framework. It is not derived from, endorsed by, or recognised under the Act, and progressing through it does not of itself establish compliance.
THE PRACTICAL AI POSITION: DEFENSIBLE ANSWERS AS THE UNIT OF VALUE
The Practical AI campaign argues that the unit of value in this new world is not the number of AI use cases shipped, the number of agents deployed, or the number of models in production. It is the cost per defensible answer. A defensible answer is one the business would trust, explain, govern, and act on. It is the answer an organisation can evidence and explain if it is audited or challenged. It is the answer that the board can underwrite.
A defensible answer has five things behind it:
This is the foundation the Progress Data Platform is built to support. Four capability layers on one platform, intended to help customers build AI they can evidence and explain.
HOW THE PROGRESS DATA PLATFORM ADDRESSES THE EU AI ACT
The Progress Data Platform is designed to support, at the architectural layer, a number of the operational capabilities that organisations commonly need in order to meet obligations that apply to them. It is intended to reduce reliance on documentation maintained separately from the system. It is not a compliance product, and the table below is a general illustration rather than a statement that any listed capability satisfies any specific legal requirement.
| Operational capability commonly needed | PDP Capability Area | What This Looks Like in Practice |
|---|---|---|
| Technical documentation · Lineage · Traceability | Multimodal data foundation | Designed so that retrievals and answers can carry provenance from source through enrichment to output, subject to configuration |
| Risk classification · Semantic enrichment · Controlled vocabularies | Semantic enrichment layer | Supports applying customer-defined classification tags at scale, in consistent language. Risk classification under the Act remains the customer's own determination |
| Policy enforcement · Deterministic guardrails · Conformity decision logic | Policy and rules layer | Supports rules that are explicit and versioned, enforcement of those rules at runtime, and generation of records of that enforcement |
| Serious-incident workflow · Reporting deadlines · Human oversight | Agentic orchestration capability | Supports an orchestrated workflow with checkpoints, to help customers meet the tiered deadlines |
| Risk management across the lifecycle | Progress Data Platform, Integrated | Supports continuous rather than point-in-time control monitoring |
The Progress Data Platform is one product with four capability layers, designed to help lower the cost per defensible answer across the Agentic AI Maturity Model. Which obligations apply to a customer, and whether they are met, depends on the customer's role under the Act, its configuration and use of the platform, and matters outside Progress's control. Progress makes no representation or warranty that use of the Progress Data Platform will result in compliance with the EU AI Act or any other law. Nothing in this section is a contractual commitment or varies any agreement between Progress and any customer.
THE AGENTIC AI MATURITY MODEL AND THE ACT
The Agentic AI Maturity Model describes the journey most enterprises are on, whether they have named it or not. The Act has implications at every stage:
| Stage | Definition | The Audit Conversation It Triggers |
|---|---|---|
| 1 · Assistive AI | Chatbot-style outputs, mostly human-driven execution | Article 50 transparency obligations, which apply by reference to the type of system and output rather than to a 'limited risk' tier. Did users know they were talking to AI? |
| 2 · Contextual AI | RAG-style grounding in enterprise information | Retrieval quality, source attribution, whether the answer can be reconstructed from cited evidence |
| 3 · Coordinated AI | AI participates in workflows across systems | Orchestration logs, system-to-system control, whether each step is observable |
| 4 · Agentic AI | Multi-step reasoning; action-taking; tool use | Policy enforcement at runtime — did autonomous behaviour stay inside the rules? |
| 5 · Governed autonomy | Policy-aware, observable and explainable | The conversation moves from defence to demonstration. The organisation can show, rather than argue, that the system is in control. |
In practical terms: it does not matter which stage you are at. It matters whether your governance posture matches the autonomy you have granted. In our view a Stage 4 deployment with Stage 2 governance carries elevated risk. The stages are a Progress framework and have no status under the Act.
READINESS CHECKLIST: TEN QUESTIONS TO ASK NOW
Use this checklist with your AI governance leads. The questions are a prompt for internal discussion. They are not a compliance assessment, and there is no scoring threshold of this kind in the Act or in any regulatory guidance.
This page is part of the Practical AI campaign from Progress. The Practical AI campaign argues that the unit of value for enterprise AI is the cost-per-defensible answer, and that the EU AI Act has made that unit a regulatory requirement, not a marketing metric.
Legal Disclaimer
The information on this page is provided for general informational and educational purposes only. It does not constitute legal advice and should not be relied upon as such. AI governance and compliance obligations vary by jurisdiction, sector, organization and use case. Organizations should consult qualified legal, compliance and technical advisors before implementing any AI governance framework or interpreting regulatory requirements. Nothing on this page reflects the internal AI governance posture, policies or compliance status of Progress Software Corporation or any of its affiliates.
If you are working through how to move AI from pilot to production in a way you can explain and evidence to your board, your auditor or your customer, this is the conversation worth having now.
A Governed AI Assessment is a structured 60-minute session against the five domains of the Progress AI Governance Model — data, context, model, output, and workflow. The session produces a technical and architectural view of your highest-stakes AI workflow. It is a commercial and technical discussion only. It is not a legal, regulatory or compliance assessment, it does not constitute legal advice, and it does not create any advisory or professional relationship. Organisations should take their own legal advice on their obligations under the EU AI Act.