The EU AI Act for companies: what you must do

The EU AI Act applies to every company that uses AI, not only to those that build it. We walk you through the timeline, the risk levels and the obligations and help you meet them.

In shortThe AI Act (Regulation (EU) 2024/1689) is the EU law on artificial intelligence. It applies to every company that uses AI. Most companies use minimal-risk AI, for example for writing, translation or analysis, and mainly need to train their people (AI literacy), keep an overview of the tools they use and an AI policy, and protect personal data under the GDPR. Stricter rules apply to AI in recruitment, employee evaluation or credit scoring. The obligations phase in from 2 February 2025 to 2 August 2028.

AI Act timeline

The AI Act has been in force since 1 August 2024, but its obligations phase in gradually. The Digital Omnibus amendment moved the dates for high-risk systems.

FromWhat applies
2 Feb 2025Bans on unacceptable practices and the duty to support people's AI literacy (Article 4).
2 Aug 2025Rules for providers of general-purpose AI models, such as the models behind ChatGPT, Claude or Gemini.
2 Aug 2026Most rules, including transparency (Article 50). Authorities can supervise and fine.
2 Dec 2027High-risk systems, for example AI in recruitment, employee evaluation or credit scoring.
2 Aug 2028AI built into products covered by EU product safety legislation.

Four risk levels

Obligations depend not on the tool but on what you use it for. The same chatbot can be minimal risk for writing emails and high risk for screening candidates.

  1. Unacceptable risk: banned

    Manipulating people, social scoring, emotion recognition at work and in schools, or untargeted scraping of facial images into databases.

    ExampleSoftware that reads employees' mood from cameras or calls. Banned since 2 February 2025.

  2. High risk: strict rules

    AI in recruitment, in decisions on promotion or dismissal, performance evaluation, credit scoring or access to education.

    ExampleA tool that sorts CVs. The company must ensure human oversight, keep logs and inform the people affected.

  3. Limited risk: transparency

    Chatbots, deepfakes and AI-generated content. People must be able to tell they are talking to AI or that AI made the content.

    ExampleA website chatbot says up front that it is AI. A video with a synthetic voice of a real person is labelled.

  4. Minimal risk: basic duties

    Everyday work with AI: writing, translation, summaries, analysis or spam filters. AI literacy and the GDPR apply.

    ExampleA salesperson writes emails with Copilot. Training, an approved tool and a policy are enough.

Deployer or provider?

The AI Act distinguishes between using AI and building and supplying it. Most companies are deployers.

  1. Deployer

    A company that uses an AI system in its work, for example ChatGPT, Copilot or AI in its accounting software.

    ExampleDuties: AI literacy, use according to the instructions, transparency and, for high-risk use, human oversight and logs.

  2. Provider

    A company that develops an AI system and places it on the market or puts it into service under its own name.

    ExampleWatch out: a deployer becomes a provider when it substantially modifies a high-risk system or puts its own brand on it.

What every company that uses AI must have

This applies even if you have not officially introduced AI and people use it on their own. In practice you need:

  1. Trained people. The company must help everyone who works with AI know how to use it and what its risks are, according to their role. In force since February 2, 2025 (Article 4 of the AI Act). Keep records of the training.
  2. An overview of the AI you use. A list of tools and what they are used for, including shadow AI. The purpose determines the risk: AI in hiring or employee evaluation has stricter rules.
  3. An AI usage policy. Which tools are approved, what must not go into AI and who is responsible for what. Without it, you cannot show that you manage the risks.
  4. Personal data protection. Under the GDPR, the company is responsible for data put into AI, even when an employee did it through a private account. You need tools with a data processing agreement that do not train on your data.
  5. Transparency. When a customer talks to AI or sees content that AI created or altered, they must be able to tell in the cases the AI Act sets out. Recognizing employees' emotions, for example, is prohibited.

We take care of itThe AI tool inventory, the AI usage policy, training with records, approved tools and the setup of data and access rights. You get documentation you can show in an inspection.

Checklist: are you ready?

If you answer no to any of these, you have catching up to do.

  • We know which AI tools people in the company use, including private accounts.
  • We have approved tools with a data processing agreement that do not train on our data.
  • We have an AI usage policy and people know it.
  • People who work with AI are trained and we keep records of it.
  • We know whether we use AI in recruitment, in evaluating people or in another high-risk use.
  • Customers can tell when they are talking to a chatbot or seeing AI-generated content.
  • It is clear who in the company is accountable for AI and approves new tools.
  • We know what to do when sensitive data leaks into AI or AI makes a mistake.

Want the AI Act covered?

We take an inventory of your AI, write the policy, train your people and hand you the documentation for an audit.

I want to meet the AI Act

EU AI Act FAQ

Are we a deployer or a provider under the AI Act?

If you only use AI, for example ChatGPT, Copilot or AI in off-the-shelf software, you are a deployer. You are a provider when you develop an AI system and place it on the market or put it into service under your own name. A deployer also becomes a provider when it substantially modifies a high-risk system or puts its own brand on it.

Does the AI Act cover writing emails with ChatGPT?

Yes, but only with the basic duties. Writing, translation or summaries are minimal risk. AI literacy under Article 4 and the GDPR apply: people should be trained, the tool approved, and company and personal data put into AI only where that is allowed.

We use AI in recruitment. What must we do?

AI in recruiting and selecting employees is a high-risk use. From 2 December 2027 the company must use the system according to the supplier's instructions, assign human oversight to a trained person, keep automatic logs for at least 6 months, inform employees beforehand and inform the people AI helps decide about. It is wise to start preparing earlier.

Do we have to label AI-generated text and images?

Sometimes. Deepfakes, meaning realistic images, video or audio of people or events, must always be labelled. Text published to inform the public on matters of public interest is labelled unless it has gone through human editorial review. A chatbot must tell people they are dealing with AI unless that is obvious. Ordinary marketing copy reviewed by a person does not need a label.

Does the AI Act apply to small companies?

Yes, the AI Act has no exemption by company size. Small and medium-sized companies pay the lower of the two fine thresholds and get priority access to regulatory sandboxes. The basic duties, AI literacy, an overview of tools, a policy and the GDPR, apply to everyone.

How do we show that we comply with the AI Act?

With documentation: a register of the AI tools you use and their purpose, an AI usage policy, training records, data processing agreements with suppliers and, for high-risk use, records of human oversight and of informing people. The AI Act does not require a certificate from deployers.

Cookie settings

Necessary cookies keep the website working. With your consent we also use analytics cookies (Google Analytics) that help us improve the website.

Necessary

Always active

Website language, spam protection of the contact form (Google reCAPTCHA) and storing your cookie choice.

Website visitor statistics using Google Analytics.