What the EU AI Act means for your AI assistant
Most of the AI Act now applies. For most internal AI assistants the requirements are manageable, but they need to be known. Here is what applies and what you can prepare.
iSearch
Contents
The EU AI Act entered into force in August 2024 and applies in stages. It regulates AI systems according to the risk their use involves. Most of the regulation is aimed at those who develop AI systems, but organisations that use AI in their work have obligations too. The regulation calls them deployers.
This article is an overview and not legal advice. How the regulation applies to you depends on how the assistant is used, and that assessment is best made together with your legal adviser or data protection officer.
The use decides the requirements
The regulation sorts uses of AI into levels. Some uses are prohibited, such as manipulating people’s behaviour or scoring people based on their social behaviour. High-risk uses include AI used in recruitment, in evaluating employees, for access to essential public services and in credit assessment. Such systems face extensive requirements for risk management, documentation, human oversight and logging.
An internal assistant that answers questions from your own procedures and handbooks normally falls outside the high-risk categories. The classification follows the use, though. The same tool can end up in another category if it is used to make or prepare decisions about individuals, for example when shortlisting applicants for a position. So keep an inventory of what your assistants are used for, and review it when new uses are added.
The dates that apply
The prohibitions and the AI literacy requirement have applied since February 2025. The rules for general-purpose AI models have applied since August 2025, and they are aimed mainly at those who build the models. On 2 August 2026 most of the regulation became applicable, including the transparency rules.
The requirements for high-risk systems were also due to apply then, but they have been postponed. Through an amending regulation that entered into force in July 2026, often called the AI omnibus, they now apply from 2 December 2027 for the high-risk areas listed in Annex III of the regulation. For AI that is part of regulated products, they apply from 2 August 2028. The rules may be adjusted again, so check the current dates with the European Commission before you plan.
Transparency and AI literacy
Two requirements affect almost everyone who uses an AI assistant. The first concerns transparency. People should understand when they are interacting with an AI system, unless that is already obvious. Text generated by AI and published to inform the public on matters of public interest must as a rule be labelled, unless a person has reviewed it and taken editorial responsibility. For an internal assistant it is often enough that it clearly presents itself as an assistant, and that you have a routine for reviewing AI-assisted texts before they leave the organisation.
The second concerns AI literacy. Organisations must take measures to support their staff’s knowledge of the AI systems they use, taking into account their role and the context in which the systems are used. The amending regulation softened the requirement, so no specific level has to be guaranteed for each employee. The obligation to work on it remains. In practice it means that people know what the assistant can do, where its limits are and that answers should always be reviewed before they are used.
How it works in iSearch
Your use decides which requirements apply, and you make that assessment yourselves. iSearch is built to make the work with those requirements easier. Every answer shows which documents it is based on, so people can check the content before anything is used. That makes review concrete and gives a natural basis when you train staff in how the assistant should be used.
You choose which documents each assistant reads and who may use it. Role-based access and the four-eyes principle control sensitive changes, and a tamper-evident audit log shows who did what. The whole chain in iSearch can run in your own environment, so questions and documents stay within the organisation.
Read more about source references, permissions in AI and security in iSearch, or book a walkthrough.
Want to see how it would work for you?
We’ll show you iSearch with your own documents.