What the AI regulation means for companies that use AI: four risk classes, your obligations as a deployer, AI literacy under Article 4 and the timeline. Plus a self-assessment that roughly classifies your use case in a few questions.
The AI Act does not regulate the technology itself but how it is used. What matters is what an AI system is used for and whom it affects. An agent that reads incoming invoices is treated differently from a system that sorts job applicants.
The regulation also distinguishes between roles. Providers develop an AI system, or have it developed, and place it on the market under their own name. Deployers use a system under their own authority in a professional context. Most small and mid-sized businesses are deployers. However, if you substantially modify a system or use it for a new purpose, you can slip into the provider role yourself.
For most office automations, the classification is straightforward. What matters is to make it deliberately and record it before a system is built.
The examples are simplified. Whether a system falls into a class depends on its exact purpose and on the exceptions in the regulation.
- Level 4
Prohibited
Practices the EU considers incompatible with fundamental rights. They may not be used since February 2025.
- Subliminal manipulation and exploiting vulnerabilities
- Social scoring
- Emotion recognition in the workplace and in education
- Untargeted scraping of facial images
- Level 3
High risk
Permitted, but with extensive obligations on risk management, data, documentation, human oversight and logging.
- Selecting and assessing applicants and employees
- Creditworthiness of private individuals
- Access to education and public benefits
- Safety components of regulated products
- Level 2
Transparency obligations
People must be able to tell that they are talking to an AI or that content was artificially generated.
- Website chat and phone assistants
- Automatically sent replies
- Artificially generated images, videos and voices
- Published AI texts without editorial review
- Level 1
Minimal risk
By far the largest share of office applications. No specific obligations under the AI Act, apart from AI literacy.
- Incoming invoices and pre-coding
- Extracting and filing documents
- Pre-sorting the inbox with approval
- Internal assistant for manuals
Think of a specific process you want to support with AI. Then answer up to seven questions with yes or no. Your answers stay in your browser.
Question 1
Is the system meant to influence people subliminally, exploit vulnerabilities, rate people by their social behaviour or recognise the emotions of employees?
This covers things like manipulative techniques, social scoring or emotion recognition in the workplace. Article 5 lists such practices as prohibited, with few exceptions.
Keyboard: Y for yes, N for no, Backspace to go back
Article 26 sets out a number of obligations for deployers of high-risk systems. The most important ones in brief:
- 01
Use as intended
Use the system as the provider specifies in the instructions for use, and take appropriate technical and organisational measures.
- 02
Human oversight
Assign oversight to people who have the necessary competence, training and authority.
- 03
Watch the input data
Where you control the input data, make sure it is relevant and sufficiently representative for the purpose.
- 04
Monitor operation
Monitor operation, inform the provider and authorities about risks or serious incidents, and suspend use if necessary.
- 05
Keep the logs
Keep automatically generated logs, insofar as they are under your control, for an appropriate period, at least six months under the regulation.
- 06
Inform
Inform employees and their representatives before use in the workplace, and inform affected people when the system is used in decisions about them.
Public bodies and certain private deployers, for example when assessing creditworthiness or carrying out risk assessments in life and health insurance, must additionally carry out a fundamental rights impact assessment. For systems with transparency obligations, on the other hand, it is usually enough to point out clearly and in good time that an AI is involved.
Regardless of the risk class: if you use AI, you must make sure the people involved know what they are doing.
Since 2 February 2025, Article 4 has required providers and deployers to take measures so that their staff and other people working with AI systems on their behalf have a sufficient level of AI literacy. The regulation prescribes neither a certificate nor a fixed number of hours. It depends on the task, prior knowledge and the purpose of use.
For Article 4, too, there are proposals at EU level to reframe the obligation (as of November 2026). Regardless of that, trained staff are the best safeguard against mistakes in everyday work.
- Basics: what the system in use can and cannot do
- Recognising typical errors such as hallucinations
- Rules on which data may be entered
- Who approves, and when a person decides
- Documenting training briefly, with date and content
- Refreshing it for new systems or tasks
The dates according to the wording of the regulation. Later deadlines are subject to change, as of November 2026.
1 August 2024
Entry into force
Regulation (EU) 2024/1689 enters into force. It applies directly in all member states, but its individual parts apply in stages.
2 February 2025
Prohibitions and AI literacy
Prohibited practices under Article 5 may no longer be used. The AI literacy obligation under Article 4 has applied since then as well.
2 August 2025
General-purpose AI models
Obligations for providers of large language models, plus rules on supervision and penalties. For companies that only use such models, little changes directly.
2 August 2026
Most of the remaining rulesMay be postponed
Under the original timeline, the transparency obligations under Article 50 and the obligations for high-risk systems in Annex III apply from this date. At the end of 2025 the EU proposed postponing parts of them. Check which deadlines are binding at the time of your project.
2 August 2027
High risk in regulated productsMay be postponed
Under the original timeline, high-risk systems that are safety components of regulated products under Annex I follow. Later dates are under discussion here as well.
Does the AI Act also apply to small and mid-sized companies?
Yes. The regulation does not distinguish by size but by role and risk. There are some reliefs for SMEs, for example on fines and regulatory sandboxes, but no general exemption.
Are we a provider or a deployer?
If you use an AI system under your own authority in a professional context, you are a deployer. A provider develops a system, or has it developed, and places it on the market under its own name. If you substantially modify a system or change its purpose, you can become a provider yourself.
Is it enough to allow ChatGPT or Claude in the company?
For using general-purpose language models in the office, the main requirement is AI literacy under Article 4. Data protection and confidentiality come on top. Clear rules on what may be entered should therefore come first.
What about the GDPR?
The GDPR continues to apply regardless of the AI Act. A use case with minimal risk under the AI Act may still need a legal basis, a data processing agreement or a data protection impact assessment.
What are the consequences of violations?
The regulation provides for tiered fines, the highest for prohibited practices. The amount depends on the type and severity of the violation, and lower caps apply to SMEs. Enforcement lies with national authorities.
In the process audit we classify each use case under the EU AI Act and document the obligations. Two days for €890 net, fully credited if you go ahead.