The EU AI Act is the first comprehensive law regulating artificial intelligence. It applies in stages and affects companies that develop or use AI systems in the EU.
This overview is general information, not legal advice.
Risk-based approach
- Prohibited practices: for example manipulative systems or social scoring – banned.
- High-risk systems: AI used in areas like recruitment, credit scoring, critical infrastructure or certain products. Strict requirements apply: risk management, data governance, documentation, human oversight, accuracy and robustness.
- Limited risk / transparency obligations: for example chatbots must make clear that users are interacting with AI, and certain AI-generated content must be labelled.
- Minimal risk: most everyday AI applications (spam filters, recommendations) with no specific obligations.
General-purpose AI models
Providers of large AI models have their own obligations, such as documentation and copyright-related transparency.
Providers vs. deployers
- Providers develop AI systems and place them on the market.
- Deployers use AI systems in their business.
Most companies using AI tools are deployers, with lighter but real obligations – for example using high-risk systems according to instructions and ensuring human oversight. Companies must also take measures to ensure sufficient AI literacy of staff working with AI.
Practical steps
- Inventory the AI systems you use or build.
- Classify them by risk category.
- Check obligations for each system and role.
- Ensure transparency, for example labelling chatbots.
- Document purpose, data and oversight.
- Train staff on responsible AI use.
- Combine with GDPR requirements where personal data is involved.
Timeline
Obligations apply in phases over several years; prohibited practices and AI literacy came first, other requirements follow. Check the current status for your systems.
We design AI solutions with transparency, documentation and human oversight in mind, making compliance easier.