Artificial intelligence is moving from experiment to everyday tool. With the AI Act, the European Union has created a legal framework for that shift. The regulation entered into force in August 2024 and applies in phases. For organisations that develop or use AI, the question is no longer whether it applies, but how.

A risk-based approach

The AI Act does not regulate AI as a technology, but specific uses of it. The higher the risk to people’s health, safety or fundamental rights, the stricter the rules.

  • Unacceptable risk: practices such as social scoring and certain forms of manipulation are prohibited.
  • High risk: AI used in areas such as recruitment, education, creditworthiness, critical infrastructure and access to public services must meet strict requirements for risk management, data quality, documentation, transparency and human oversight.
  • Limited risk: systems such as chatbots must make clear that people are interacting with AI, and certain AI-generated content must be recognisable as such.
  • Minimal risk: most applications, such as spam filters or internal search, can be used freely, although good practice still applies.

What already applies

The bans on unacceptable practices and the obligation to ensure sufficient AI literacy among staff have applied since February 2025. Rules for general-purpose AI models followed in August 2025. The original timeline set August 2026 for most remaining obligations, including many high-risk systems, with some product-related rules following in 2027. The EU has since proposed adjusting parts of this timeline, so check the current status for your specific situation.

Provider or deployer?

Your obligations depend on your role. Providers develop an AI system or place it on the market; deployers use an AI system under their own authority. Most organisations are deployers: they use AI built by others. Deployers of high-risk systems must, among other things, use the system according to its instructions, assign human oversight to competent staff, monitor its operation and, in some cases, carry out a fundamental rights impact assessment.

Five practical steps

  • Make an inventory of the AI systems you develop and use, including AI features in existing software.
  • Classify each use case by risk and determine whether you act as provider or deployer.
  • Invest in AI literacy, so staff understand the possibilities and limitations of the tools they use.
  • Set up governance: who decides on new AI use, who monitors it and how incidents are handled.
  • Align with existing obligations such as the GDPR, because many AI applications also process personal data.

Compliance as a mark of quality

The AI Act is sometimes seen as a brake on innovation. In our experience, the opposite is often true. The requirements for documentation, testing and human oversight are simply good engineering practice. Organisations that build them in from the start develop AI solutions that are more reliable, easier to explain and more readily accepted by the people who use them.

Want to know what the AI Act means for your organisation? Read more about our approach to AI & automation or visit our trust center.

This article provides general information and is not legal advice.