The EU AI Act — the European Union’s Artificial Intelligence Regulation — is the world’s first comprehensive AI regulation. It entered into force in 2024 and applies progressively in several phases. For companies that develop or use AI systems, knowing the rules before the deadlines arrive is the difference between a planned adaptation and a reactive one.
This article isn’t legal advice. It’s a practical guide to which categories of AI the regulation covers, what it specifically requires, and the actual implementation timeline.
The logic of the regulation: rules in proportion to risk
The EU AI Act doesn’t ban AI or impose the same obligations on every system. It classifies AI systems by risk level and regulates them proportionately: the greater the potential risk to people, the more obligations.
Prohibited AI: Systems the regulation bans outright because their risk is unacceptable. This includes biometric categorization to infer sensitive characteristics (ethnic origin, political opinions, sexual orientation), social scoring of citizens by public authorities, and certain uses of real-time facial recognition in public spaces. These systems can’t be used under any circumstances.
High-risk AI: Systems that require conformity assessments, technical documentation, mandatory human oversight, and registration in the EU database. The sectors and uses covered are: critical infrastructure, education and vocational training, employment (recruitment, performance evaluation), essential services (credit, insurance, social benefits), law enforcement, border and migration management, the administration of justice, and AI systems in regulated products (medical devices, industrial safety).
Limited-risk AI: Systems with transparency obligations — users must know they’re interacting with an AI. Chatbots, image generation systems, and deepfake content fall into this category.
Minimal-risk AI: The vast majority of business AI applications — spam filters, recommendation systems, productivity tools. No obligations beyond existing legislation.
Who does it apply to?
It applies to any company that places AI systems on the EU market or uses them in the European Union, wherever the company is based. This has important consequences: if a European company uses a US-built AI system that falls into a high-risk category, the European company (as the system’s deployer) has compliance obligations.
The implementation timeline
The regulation applies in phases: first the bans on unacceptable AI, then general-purpose AI models such as GPT or Claude, then high-risk systems — the most complex part of the regulation — and finally AI systems in regulated products such as machinery or medical devices. The official text of the regulation, the European Commission’s AI Office, and the national market surveillance authorities are the reference sources for the exact deadlines in force.
What affects most companies: limited risk
For companies that use chatbots, virtual assistants, or generative AI tools in contact with customers, the main obligation is transparency: users must know they’re interacting with an AI system, not a person.
This obligation seems obvious, but it has design implications: chatbot interfaces must clearly identify themselves as AI, automatically generated emails must not be presented as written by a person, and voice AI systems on customer service calls must identify themselves at the start of the conversation.
What affects companies with high-risk AI
If a company uses AI systems for recruitment decisions, performance evaluation, credit scoring, or managing access to public services, it falls into the high-risk category, with significant obligations:
- Technical documentation: Describe the system, its capabilities, limitations, and performance in enough detail for its conformity to be assessed.
- Risk management: A systematic process for identifying and mitigating risks throughout the system’s lifecycle.
- Data governance: Training data must be relevant, representative, and free of inappropriate bias.
- Human oversight: High-risk systems must be designed to allow effective human oversight, intervention, and correction.
- Registration: Registration in the EU database of high-risk AI systems.
What’s still unclear
The EU AI Act leaves room for interpretation in important areas. Classifying systems that sit on the border between risk levels — whether a given system is high-risk or limited-risk — isn’t always obvious. The European AI Office and national market surveillance authorities will keep publishing interpretive guidance. The network of notified bodies (the conformity assessment bodies) is still being built.
What is clear is that systems built with technical documentation from the start, with risk management processes and built-in human oversight, will find it much easier to demonstrate conformity when the high-risk obligations kick in.
Frequently asked questions
Are SMEs exempt in any way? The regulation includes some specific provisions for SMEs and startups, especially access to regulatory sandboxes for AI. But there are no general exemptions: if a system is high-risk, the obligations apply regardless of company size.
What happens if we don’t comply? The maximum penalties are substantial — proportional to the company’s global turnover, with the highest tiers reserved for the use of prohibited AI. These are maximum fines, not typical cases, but they show how seriously the European regulator takes the matter.
Where do I start if I want to assess our compliance? The first step is to inventory the AI systems your company uses or plans to use and classify them by risk category. The specific obligations follow from that classification. The guidance published by the European Commission and national supervisory authorities is the starting point for that exercise.