Last reviewed:
What is the AI Act? Definition and business implications
The AI Act is European Regulation 2024/1689, the world's first legal framework to classify AI systems by risk level and to impose differentiated obligations: prohibition for unacceptable uses, strict requirements for high-risk systems, transparency for the rest.
The AI Act (EU Regulation 2024/1689) entered into force on 1 August 2024, with a progressive application until 2028. The "Digital Omnibus on AI" (Regulation (EU) 2026/1744, in force since 27 July 2026) pushed back part of the timeline and added two prohibitions. The text classifies AI systems into four risk levels. Unacceptable risk (banned since February 2025): social scoring, behavioural manipulation, real-time biometric identification in public spaces and, from 2 December 2026 (added by the Omnibus), systems designed to generate non-consensual intimate imagery or child sexual abuse material. High risk: AI systems in recruitment, education, justice, credit, insurance, public services (Annex III, applicable from 2 December 2027) and AI built into already-regulated products (Annex I, applicable from 2 August 2028). These systems require detailed documentation, testing, European registration, human oversight. Limited risk: transparency obligations (article 50, applicable since 2 August 2026): informing users they are interacting with AI, disclosing generated content. Minimal risk: no specific obligation. Foundation model (GPAI) providers have their own obligations since August 2025: documentation of training sources, copyright compliance policy, evaluation of systemic risks for the most powerful models. Finally, article 4 requires every organisation that provides or deploys AI to take measures to develop its staff's AI literacy.
Concrete example
A 800-employee French mid-cap uses an AI tool to filter candidate CVs for hiring. Under the AI Act, this system falls into the “high risk” category (annex III, point 4 of the regulation). From 2 December 2027 (a deadline pushed back by the Digital Omnibus, originally set for 2 August 2026), the company (or its provider, depending on the responsibility split) must have detailed technical documentation of the system, a conformity assessment, an effective human oversight mechanism, and a registration declaration in the European database. Non-compliance exposes to sanctions of up to 15 million euros or 3% of worldwide turnover, whichever is higher.
A second case, more frequent than one might think: a customer-service chatbot. A French insurance company deployed a GPT-powered chatbot in 2025 to answer recurring questions from policyholders (claims filing, pricing, products). The chatbot is not classified as "high risk", but it falls into the AI Act's "limited risk" category (article 50, applicable since 2 August 2026): a transparency obligation, users must be clearly informed they are interacting with an AI. A banner such as "Virtual assistant: you are chatting with an AI" is enough to meet Article 50, as long as the chatbot takes no part in a decision classified as high-risk (granting credit, pricing life or health insurance, recruitment). Offering a human operator on request remains good practice, not an obligation. Cost: a few dev hours + one sentence of communications policy. This is the most common case in 2026, and the most often overlooked.
Comparison
| Category | Typical examples | Main obligations | Entry into force / max penalty |
|---|---|---|---|
| Unacceptable risk | Social scoring, subliminal manipulation, emotion recognition at work or school, real-time biometrics in public spaces (with narrow exceptions), systems generating non-consensual intimate imagery | Complete ban on placing on the market or use in the EU | Since 2 February 2025 (new Omnibus prohibition: 2 December 2026); up to €35M or 7 % of global turnover |
| High risk | CV filtering, credit scoring, biometric control, medical devices, critical infrastructure, education, justice | Risk management system, quality data, technical documentation, human oversight, robustness, transparency, EU database registration | 2 December 2027 (Annex III) or 2 August 2028 (already-regulated products), dates set by the Digital Omnibus; up to €15M or 3 % of global turnover |
| Limited risk (transparency) | Chatbots, deepfakes, AI-generated content; informing people exposed to a permitted emotion recognition or biometric categorisation system (categorisation that infers sensitive data is prohibited) | Clearly inform users they are interacting with an AI or that content is AI-generated (article 50) | Since 2 August 2026 (content marking: 2 December 2026 for systems already on the market); up to €15M or 3 % of global turnover |
| Minimal risk | Spam filters, AI in video games, basic recommendation engines (the vast majority of systems) | No specific obligations; voluntary codes of conduct encouraged | No entry-into-force obligation; no specific penalty |
FAQ
When does the AI Act take effect?
Legal entry into force on 1 August 2024, phased application, with a timeline adjusted by the Digital Omnibus (Regulation 2026/1744, in force on 27 July 2026). Bans (unacceptable risk) and the AI literacy obligation (article 4) apply since 2 February 2025. Obligations for foundation models (GPAI) since 2 August 2025. Transparency obligations (article 50) since 2 August 2026, with marking of generated content required by 2 December 2026 for systems already on the market. Annex III high-risk systems (recruitment, education, credit…) from 2 December 2027. High-risk systems built into already-regulated products (medical devices, toys…) from 2 August 2028.
What penalties does the AI Act impose?
Three tiers, each expressed as the higher of a fixed sum or a percentage of global turnover: €35M or 7 % for use of banned systems, €15M or 3 % for breaches of high-risk or GPAI obligations, €7.5M or 1 % for supplying inaccurate information to authorities. For SMEs and start-ups, the lower of the two amounts applies. The 2026 Digital Omnibus extends this rule to small mid-caps, except for prohibited practices, as well as simplified technical documentation.
Am I affected by the AI Act if my AI vendor is American or Chinese?
Yes. The AI Act applies as soon as an AI system is placed on the market or used in the EU, regardless of the vendor's country. As an EU-based "deployer", you are responsible for the obligations that fall on you (transparency, human oversight, informing people) even if the AI comes from OpenAI, Google or Alibaba. Your contracts should provide for the necessary safeguards.
What's the difference between the AI Act and GDPR?
GDPR governs the processing of personal data (purpose, legal basis, informing subjects). The AI Act governs AI systems themselves (risk classification, design obligations, transparency about AI). The two apply in parallel: an AI system processing personal data must comply with both. In practice they complement each other: GDPR alone never covered the specific risks of generative AI.
How do I know if my AI use case is "high risk"?
Annex III of the AI Act lists high-risk uses: biometrics, critical infrastructure, education, employment and HR (including CV screening, employee rating), access to essential services (credit, insurance, welfare), law enforcement, migration and asylum, justice, democratic processes. If your use case falls in one of these categories, or if your AI system is a safety component of an already-regulated product, you are in high risk.
Does the AI Act ban some AI uses outright?
Yes, eight practices are banned by article 5 of the original text, and the Digital Omnibus added two: social scoring by public authorities, subliminal manipulation, exploitation of vulnerabilities of individuals, emotion recognition in the workplace or in schools, biometric categorisation on sensitive traits (origin, orientation), untargeted scraping of faces from the internet or CCTV, predicting offences solely from profiling, real-time biometrics in public spaces (with narrow law-enforcement exceptions) and, from 2 December 2026, systems designed to generate non-consensual sexual or intimate imagery or child sexual abuse material.
See also
Further reading
Regulation (EU) 2024/1689 on artificial intelligence, EUR-Lex
Sources
- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (AI Act). https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744, Digital Omnibus on AI, amending Regulation 2024/1689. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32026R1744
- AI Act, European Commission, official presentation page. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), EUR-Lex. https://eur-lex.europa.eu/eli/reg/2026/1744/oj