HomeAI Act
EU AI Act The AI Act, briefly explained for companies.
The EU's AI regulation, known internationally as the EU AI Act, governs how AI is developed and used. For most companies the obligations are manageable, and some already apply today. Here you find what affects you and where to start.
As of October 2026, checked against the text of the regulation. General information, not legal advice.
The key points in brief
- The AI Act, Regulation (EU) 2024/1689, has been in force since 1 August 2024 and applies directly in all Member States. The Member States mainly regulate supervision and penalties.
- It classifies AI by risk: some uses are prohibited, high-risk AI is subject to strict requirements, and transparency obligations apply to chatbots and AI content. Most uses remain without special requirements.
- Since 2 February 2025 the prohibitions (Art. 5) and the obligation to ensure AI literacy (Art. 4) have applied.
- Since 2 August 2026 the transparency obligations apply, for example for chatbots and deepfakes (Art. 50).
- The Digital Omnibus, Regulation (EU) 2026/1744, postponed the obligations for high-risk AI to December 2027 and August 2028 in July 2026 and reworded Art. 4.
Who the Act applies to
The Act distinguishes mainly two roles. Providers develop an AI system, or have one developed, and place it on the market or put it into service under their own name. Deployers use an AI system under their own authority (Art. 3 no. 3 and 4).
Anyone in a company who uses AI programs for texts, analyses or customer enquiries is, as a rule, a deployer. There is no size threshold. Only purely private use is excluded (Art. 2(10)). Companies outside the EU are also covered if the output of their AI is used in the EU (Art. 2(1)).
Four levels by risk
-
Prohibited
For example social scoring, manipulative techniques or emotion recognition in the workplace (Art. 5). These prohibitions have applied since 2 February 2025.
-
High risk
For example AI that selects job applications, evaluates performance or checks creditworthiness (Art. 6 with Annex III). Strict obligations from 2 December 2027.
-
Transparency
Chatbots must identify themselves as AI, and deepfakes and certain AI texts must be labelled (Art. 50). Since 2 August 2026.
-
Low risk
Draft texts, summaries, translations, reading out documents. Here the Act mainly requires AI literacy in the team.
Checklist What companies should do now.
Five steps as a guide to the obligations that already apply today.
-
Get an overview
Which AI programs does your team use, for what and with which data? A simple list is enough to begin with.
-
Classify
For every use, clarify which level it falls into and whether your company acts as deployer or provider.
-
Build AI literacy
Training that fits employees' tasks and programs, and a short note on who learned what and when (Art. 4).
-
Set rules
A short AI policy: which programs are approved, which data must not go in, who helps with questions.
-
Label and plan ahead
Make chatbots recognisable as AI, label realistic AI images and allow for the December 2027 deadline for high-risk uses.
General guidance. Which obligations apply in detail depends on your use.
Get in touchPenalties and fines
The fine ranges are set out in Art. 99. In each case the higher amount applies, for SMEs the lower one (Art. 99(6)).
- Prohibited practices: up to EUR 35 million or 7 % of worldwide annual turnover.
- Infringements of other obligations, for example those of deployers (Art. 26) or the transparency obligations (Art. 50): up to EUR 15 million or 3 %.
- False or incomplete information given to authorities: up to EUR 7.5 million or 1 %.
For AI literacy under Art. 4 the Act names no fine range of its own. Penalties are set by the Member States, which since the Digital Omnibus expressly take the interests of SMEs into account (Art. 99(1)).
How we support you
-
AI consulting
Together with you we get an overview, classify your uses and write a short AI policy. More on AI consulting.
-
Implementation with a sense of proportion
When we build AI solutions for you, we plan labelling, human approval and traceability in from the start. More on process automation.
General information, not legal advice.
Frequently asked questions about the AI Act
Does the AI Act also apply in Austria and Switzerland?
In Austria it applies directly, as in all EU Member States. Switzerland is not a member of the EU. But Swiss companies are covered if they offer AI systems in the EU or the output of their AI is used in the EU (Art. 2(1)). The same applies to companies in the United Kingdom.
What is the Digital Omnibus on AI?
Regulation (EU) 2026/1744 amends the AI Act. It was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. It postpones the obligations for high-risk AI, rewords the obligation to ensure AI literacy, brings relief for SMEs and small mid-cap companies and, from 2 December 2026, new prohibitions.
How do the AI Act and the GDPR relate to each other?
Both apply side by side. The AI Act leaves the GDPR unaffected (Art. 2(7)). Anyone who processes personal data with AI still needs a legal basis and must comply with the other data protection obligations.
Do we need a permit to use AI?
For low-risk AI there is no obligation to obtain a permit, notify or register. AI literacy under Art. 4 applies and, depending on use, the transparency obligations under Art. 50.
Is there relief for SMEs?
Yes. For fines the lower amount applies to SMEs in each case (Art. 99(6)), they get priority access to AI regulatory sandboxes (Art. 62), and the Commission and the Member States are to support them in building AI literacy (Art. 4(2)).
Is an AI certificate mandatory?
For companies that use AI, no. For AI literacy too the Act prescribes no certificate. A conformity assessment is needed only by providers of high-risk AI (Art. 43).
Would you like to know what the AI Act means for your company?
Tell us how your team uses AI today. We will reply personally, free of charge and without obligation.