What is the EU AI Act?

The EU AI Act is the EU's law on artificial intelligence, which regulates AI systems according to how much risk their use involves.

The regulation entered into force in August 2024 and applies in stages. The prohibitions and the AI literacy requirement have applied since February 2025. The rules for general-purpose AI models have applied since August 2025. On 2 August 2026 most of it became applicable, including the transparency rules.

The requirements for high-risk systems have been postponed through an amending regulation from July 2026. They apply from 2 December 2027 for the areas in Annex III of the regulation and from 2 August 2028 for AI in regulated products.

Most of it is aimed at those who develop AI systems. Organisations that use AI have obligations too, and the regulation calls them deployers. An internal assistant that answers from your routines normally falls outside the high-risk categories, but the classification follows the use. The organisation must also work to make sure staff understand the AI systems it uses.

The rules may be adjusted again. Check the current dates with the European Commission before you plan.

How it works

The regulation sorts uses of AI by risk. Some uses are prohibited, such as social scoring and AI that exploits people's vulnerabilities to influence their behaviour. High-risk AI is allowed but faces strict requirements. Some systems mainly carry transparency duties. Most AI in everyday use has no specific requirements at all.

Responsibility is split between roles. Whoever develops a system and places it on the market carries most of the duties. Whoever uses it in their work is responsible for how it is used.

Why it matters

The regulation applies directly in every EU country and touches almost every organisation that uses AI. It also shapes what you can ask of suppliers. A provider of a high-risk system must supply documentation and instructions that let you use it correctly.

What to keep in mind

The transparency rules mean that people must in some cases be told they are dealing with AI, and that some AI-generated content must be labelled.

The regulation does not replace other law. GDPR, employment law and sector rules apply alongside it as usual.

What it means for you

List the AI tools you use and what they are used for. That is the basis for judging which requirements apply.

Common questions

Does the AI Act apply to us if we only use AI?

Yes, in part. An organisation that uses an AI system in its work is called a deployer under the Act. Deployers have fewer obligations than developers, including AI literacy and, in some cases, transparency.

Is an internal AI assistant high-risk?

Normally not. An assistant that answers from procedures and handbooks falls outside the areas in Annex III. If the same tool is used to assess individuals, for example in recruitment, it can become high-risk AI.

When do the requirements apply?

The prohibitions and the AI literacy requirement have applied since February 2025. Most of the Act has applied since 2 August 2026. The high-risk requirements apply from 2 December 2027 or 2 August 2028, depending on the type of system.

How does the AI Act relate to GDPR?

They apply side by side. The AI Act deals with AI systems and their risks. GDPR applies whenever personal data is processed, with or without AI.

Sources: Regulation (EU) 2024/1689 on EUR-Lex Amending Regulation (EU) 2026/1744 on EUR-Lex

Related terms

All terms Updated 2026