What is the EU AI Act?

Since an amendment in July 2026 (Regulation (EU) 2026/1744), the high-risk requirements apply from 2 December 2027 in areas such as recruitment, and from 2 August 2028 for AI in products such as lifts and toys. AI literacy and the prohibitions have applied since 2 February 2025. What that means for your business is in the EU AI Act and the GDPR.

The four risk levels

The AI Act doesn’t treat all AI the same way. The more serious the possible consequences for people, the stricter the rules.

• Prohibited: a small number of practices are banned because the risk to people is too great.
• High risk: AI in areas the law names explicitly, such as recruitment, access to education, credit scoring and access to essential services, and AI in products already covered by EU safety rules. These face requirements on risk management, data quality, logging and human oversight, among other things.
• Transparency: systems that interact directly with people or generate content. People need to know, for example, that they’re talking to an AI system (Article 50).
• Minimal risk: everything else, such as summarising a public report or drafting an email you check yourself. Here, your own policy largely decides what’s allowed.

What counts as high risk is covered under high-risk AI system. There are also rules for general-purpose AI models, the models behind tools such as ChatGPT and Claude. Those are aimed mainly at the makers of the models, not at businesses using the tools.

Provider or deployer?

What the AI Act asks of you depends mostly on your role. A provider develops an AI system and places it on the market under its own name. A deployer uses a system someone else built. If you use ChatGPT, Copilot or AI features in existing software, you’re usually in that second role.

That still comes with obligations. You use the system according to the instructions, take measures to support AI literacy among your people (Article 4), arrange human oversight where required and, in certain cases, disclose that AI is involved (Article 50). High-risk applications bring further duties. The heaviest requirements sit with the provider.

The AI Act and the GDPR

The GDPR is about personal data. The AI Act is about the AI system itself: what it does, how much risk that carries and which safeguards go with it, even when no personal data is involved. If you use AI on CVs, customer files or staff data, both apply. They overlap on transparency, human oversight, recording what happens and agreements with suppliers.

When does what apply?

The regulation entered into force in 2024 and applies in phases. The prohibited practices and AI literacy have applied since 2 February 2025, the rules for general-purpose AI models since 2 August 2025. Regulation (EU) 2026/1744 postponed the high-risk requirements: to 2 December 2027 for areas such as recruitment, education and critical infrastructure, and to 2 August 2028 for AI in products. See the European Commission overview. Check the consolidated text on EUR-Lex before you plan anything.

Why it matters in practice

A common misconception: that the AI Act only applies to companies that build AI themselves. Every organisation that uses AI is affected. The opposite misconception exists too: that anything involving AI is heavily regulated. For most SME applications, it isn’t.

Start with a list of where AI is already being used, including the tools nobody asked for. Ask two questions about each one: does personal data go into it, and does the outcome lead to a decision about someone? Then arrange AI literacy and record the agreements in an AI policy. If you use AI in recruitment, ask your supplier in writing whether the system is classified as high-risk. The steps are set out in the AI Act and GDPR: what you need to sort out.

This is a general explanation, not legal advice. Source: Regulation (EU) 2024/1689 on EUR-Lex.