EU AI Act explained: risk levels, deadlines and what your company must do

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's law on artificial intelligence: it bans a short list of AI practices, sets strict rules for high-risk uses such as hiring and credit scoring, and requires transparency for chatbots and AI-generated content. This guide explains the risk levels, the deadlines as amended in July 2026, the fines, and what to do if your company uses or builds AI.

What is the EU AI Act?

The EU AI Act is the European Union's regulation on artificial intelligence, formally Regulation (EU) 2024/1689. It regulates AI by risk: a few uses are banned, high-risk uses must meet strict requirements, some systems must be transparent, and everyday AI such as spam filters gets no new rules. The European Commission calls it the first comprehensive legal framework on AI worldwide.

The law entered into force on 1 August 2024 and applies in stages. It was amended in July 2026 by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which pushed back the high-risk deadlines and changed a few duties. Many articles online still show the pre-amendment dates, so check the date on anything you read.

Three things make the AI Act matter for most businesses:

• It reaches outside the EU. It covers providers placing AI on the EU market wherever they are based, and non-EU providers and deployers whose AI output is used in the EU.
• It covers users, not only builders. A company that uses an AI tool under its authority is a "deployer" with its own duties.
• It stacks on top of GDPR. Personal data rules still apply to every AI tool that touches personal data.

EU AI Act timeline: which rules apply when?

Most of the AI Act has applied since 2 August 2026. The bans and AI literacy started earlier, and the high-risk rules come later after the 2026 amendment. This is the current schedule from the Commission's AI Act Service Desk:

The 2 December 2027 and 2 August 2028 dates replace the original August 2026 and August 2027 deadlines. The Commission says the delay gives companies time to use harmonised standards and other support tools once they exist.

What are the four risk levels in the EU AI Act?

The AI Act defines four levels of risk, and your obligations depend on which level a specific use falls into. The same model can sit in different levels: a chatbot answering shipping questions is low risk, the same model ranking job applicants is high risk.

The nine banned AI practices

According to the Commission, the AI Act prohibits:

1. Harmful AI-based manipulation and deception.
2. Harmful exploitation of vulnerabilities, such as age or disability.
3. Social scoring.
4. Predicting the risk that an individual will commit a crime based on profiling alone.
5. Untargeted scraping of the internet or CCTV footage to build facial recognition databases.
6. Emotion recognition in workplaces and education institutions.
7. Biometric categorisation to infer protected characteristics.
8. Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
9. AI systems that generate non-consensual sexually explicit content or child sexual abuse material, such as "nudification" apps (from 2 December 2026).

What counts as high risk?

An AI system is high-risk when it is a safety component of a regulated product (Annex I) or when it is used in one of the sensitive areas in Annex III. Those areas include biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit and benefits, law enforcement, migration and border control, and the administration of justice. An Annex III system that profiles people is always high-risk. Some Annex III systems that only perform a narrow procedural task can fall outside the high-risk rules, but the provider must document that assessment.

Who has to comply: providers, deployers or both?

The AI Act puts most duties on providers, the organizations that develop an AI system or model and put it on the market or into service under their own name. Deployers are organizations that use an AI system under their authority, and they carry lighter but real duties. Importers, distributors and product manufacturers have their own roles.

Deployers can become providers. Under Article 25, you take on the provider's obligations for a high-risk system if you put your name or trademark on it, make a substantial modification to it, or change the intended purpose of an AI system (including a general-purpose one such as a chatbot) so that it becomes high-risk. Using a general chatbot to screen CVs is the classic way companies drift into that position without noticing.

What does the EU AI Act mean for companies using ChatGPT at work?

A company whose employees use ChatGPT, Claude, Gemini or Copilot for work is a deployer. For ordinary office use such as drafting, summarizing, research and coding, the duties are modest: support AI literacy, label certain published content, and keep high-risk decisions out of general chatbots unless you are ready for the high-risk rules.

AI literacy (Article 4). The original text asked providers and deployers to ensure a sufficient level of AI literacy among staff. The Digital Omnibus softened this: companies must now "take measures to support the development of AI literacy" of staff and others using AI on their behalf, and the text states that this "does not require" guaranteeing any specific level. In practice that means short, role-based training on what the tools do well, where they make mistakes, data handling and human review, plus a record that you offered it. Our guide to responsible AI use covers what that training should include.

Transparency (Article 50). If you publish a deepfake (AI-generated or manipulated image, audio or video that looks real), you must disclose that it is artificial. If you publish AI-generated text to inform the public on matters of public interest, you must disclose that too, unless a person reviewed it and holds editorial responsibility. Everyday business writing such as emails, reports and product copy is not covered.

High-risk uses. Using AI to filter job applicants, evaluate employees, score credit or grade exams falls in Annex III. From 2 December 2027, deployers of such systems must, among other things, follow the provider's instructions for use, assign trained people to human oversight, monitor the system, keep its logs for at least six months, and inform workers and their representatives before using high-risk AI at work, according to Article 26.

Data protection. None of this replaces GDPR. Pasting customer or employee data into a chatbot still needs a legal basis and the right vendor terms; see our guide to AI privacy at work.

What must you do if you build AI features into your product?

If you build a chatbot, assistant or generator on top of a model API and offer it under your name, you are most likely the provider of that AI system. The duties depend on what the feature does, so classify each feature before you ship it.

Use this procedure for every AI feature:

1. Describe the intended purpose in one sentence: who uses it, for what decision or output.
2. Check the bans. If the feature manipulates, scores people socially or reads emotions at work or school, stop.
3. Check Annex III. Does it touch hiring, education, credit, insurance, essential services, biometrics or another listed area? If so, plan for the high-risk requirements by 2 December 2027.
4. Check transparency. A feature that talks to people must tell them they are interacting with AI, unless that is obvious. A feature that generates audio, images, video or text must mark the output in a machine-readable, detectable way (Article 50(2)).
5. Record the decision with the date, the reasoning and who signed it off.
6. Recheck on change. A new use case or customer segment can move a feature into a higher tier.

A disclosure at the start of a chat can be as plain as this:

Hi, I'm an AI assistant for Acme. I can answer questions about orders and returns.For anything else, type "human" and a member of our team will reply.

For a customer-facing bot, our guide to adding an AI chatbot to your website covers handoff and guardrails. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the marking rule. The Commission has published a voluntary code of practice on marking and labelling AI-generated content and guidelines on the transparency obligations to help with this.

What are the rules for general-purpose AI models?

General-purpose AI (GPAI) models are models such as GPT, Claude, Gemini or Llama that can perform a wide range of tasks. Their rules have applied since 2 August 2025 and fall on the companies that train and release the models, not on the businesses that use them.

All GPAI providers must keep technical documentation, give downstream developers the information they need to comply, have a policy to respect EU copyright law, and publish a summary of the content used for training using the Commission's template. Models trained with more than 10^25 floating point operations are presumed to have systemic risk and must also assess and mitigate those risks, report serious incidents and maintain cybersecurity. The voluntary GPAI Code of Practice, published in July 2025, is the main way providers show compliance. The AI Office in the Commission enforces these rules.

For a business using an API, the practical step is to ask your vendor for its AI Act documentation and keep it with your own records.

How big are the fines under the EU AI Act?

Fines depend on the type of breach and are set as a fixed amount or a share of worldwide annual turnover, whichever is higher. For SMEs and start-ups, the lower of the two applies, and member states must consider their economic viability.

Member states set the detailed penalty rules and designate national authorities, which have enforced the Act since 2 August 2026. The AI Office enforces the rules for general-purpose AI models directly.

What changed with the 2026 Digital Omnibus?

The Digital Omnibus on AI simplified the AI Act and delayed its hardest deadlines. The Commission proposed it on 19 November 2025, a political agreement followed on 7 May 2026, and it entered into force on 27 July 2026.

It also strengthened the AI Office's oversight of AI systems built on general-purpose models, opened regulatory sandboxes to more companies, and clarified how the Act fits with product safety laws such as the Machinery Regulation. The final text lists every amended article.

Your EU AI Act checklist for the next 90 days

You can do most of the work for typical business use of AI in a quarter, without outside help. Start here:

1. List every AI tool in use, including the ones staff signed up for themselves, and who uses each one for what.
2. Classify each use with the four-tier table above, and flag anything touching hiring, staff evaluation, credit or education.
3. Run short AI literacy training by role and keep a dated record of who received it. Our AI adoption playbook has a rollout plan.
4. Write a one-page AI use policy: approved tools, data that must never go in, when human review is required, how to label published deepfakes.
5. Add AI disclosures to every chatbot or voice agent your customers talk to.
6. Collect vendor documentation from your model and tool providers.
7. Plan for 2 December 2027 if any use is high-risk: oversight roles, log retention, worker notices, and a check of whether you have become a provider.
8. Put a review date in the calendar. Guidelines and standards keep arriving, and the Commission's AI Act page and Service Desk track them.

If your engineering team runs AI coding agents on EU projects, Orkio runs them on isolated servers in Europe.

Frequently asked questions