What is the EU AI Act?
By Joey van Vliet, founderUpdated
In short
The AI Act is the European Union’s law on AI systems (Regulation (EU) 2024/1689). It classifies AI by risk. A few practices are banned, high-risk applications face strict requirements, systems that talk to people or generate content have transparency rules, and everything else counts as minimal risk. The rules apply both to those who build AI and to those who use it.
Also known as: EU AI Act, Artificial Intelligence Act, Regulation (EU) 2024/1689
The four risk levels
The AI Act doesn’t treat all AI the same way. The more serious the possible consequences for people, the stricter the rules.
- Prohibited: a small number of practices are banned because the risk to people is too great.
- High risk: AI in areas the law names explicitly, such as recruitment, access to education, credit scoring and access to essential services, and AI in products already covered by EU safety rules. These face requirements on risk management, data quality, logging and human oversight, among other things.
- Transparency: systems that interact directly with people or generate content. People need to know, for example, that they’re talking to an AI system (Article 50).
- Minimal risk: everything else, such as summarising a public report or drafting an email you check yourself. Here, your own policy largely decides what’s allowed.
What counts as high risk is covered under high-risk AI system. There are also rules for general-purpose AI models, the models behind tools such as ChatGPT and Claude. Those are aimed mainly at the makers of the models, not at businesses using the tools.
Provider or deployer?
What the AI Act asks of you depends mostly on your role. A provider develops an AI system and places it on the market under its own name. A deployer uses a system someone else built. If you use ChatGPT, Copilot or AI features in existing software, you’re usually in that second role.
That still comes with obligations. You use the system according to the instructions, take measures to support AI literacy among your people (Article 4), arrange human oversight where required and, in certain cases, disclose that AI is involved (Article 50). High-risk applications bring further duties. The heaviest requirements sit with the provider.
The AI Act and the GDPR
The GDPR is about personal data. The AI Act is about the AI system itself: what it does, how much risk that carries and which safeguards go with it, even when no personal data is involved. If you use AI on CVs, customer files or staff data, both apply. They overlap on transparency, human oversight, recording what happens and agreements with suppliers.
When does what apply?
The regulation entered into force in 2024 and applies in phases. The provisions on prohibited practices and AI literacy came first, then those for general-purpose AI models, then the requirements for high-risk applications. The phasing has been debated and the timetable has since been amended. Check the current dates in the consolidated text on EUR-Lex before you plan anything.
Why it matters in practice
A common misconception: that the AI Act only applies to companies that build AI themselves. Every organisation that uses AI is affected. The opposite misconception exists too: that anything involving AI is heavily regulated. For most SME applications, it isn’t.
Start with a list of where AI is already being used, including the tools nobody asked for. Ask two questions about each one: does personal data go into it, and does the outcome lead to a decision about someone? Then arrange AI literacy and record the agreements in an AI policy. If you use AI in recruitment, ask your supplier in writing whether the system is classified as high-risk. The steps are set out in the AI Act and GDPR: what you need to sort out.
This is a general explanation, not legal advice. Source: Regulation (EU) 2024/1689 on EUR-Lex.
Frequently asked questions
Does the AI Act apply to SMEs?
Yes. The regulation has no general exemption for small businesses. What you need to do depends on your role and on the risk of the application. For most SMEs, it comes down to AI literacy, transparency where needed and extra care with AI that helps make decisions about people, such as in recruitment.
What is the difference between the AI Act and the GDPR?
The GDPR protects personal data and applies as soon as you process it, including with AI. The AI Act sets requirements for the AI system itself, depending on the risk, even when no personal data is involved. If you use AI on data about people, both apply.
When does the AI Act apply?
The regulation entered into force in 2024 and applies in phases. Prohibited practices and AI literacy came first, then the rules for general-purpose AI models, then the requirements for high-risk applications. The timetable has since been amended. Use the consolidated text on EUR-Lex as your source, not a summary from a year ago.
