The EU AI Act entered into force in August 2024, and its provisions are phasing in through 2027. If your business uses AI tools, sells AI-powered products in the EU, or processes data from EU citizens, this regulation affects you. Even companies based entirely outside Europe need to pay attention because the AI Act, like GDPR before it, is setting the global standard for AI governance.
This guide cuts through the legal complexity and focuses on what business leaders and operations teams actually need to know.
What the EU AI Act Is
The AI Act is the world's first comprehensive legal framework for artificial intelligence. It takes a risk-based approach: the higher the risk an AI system poses to health, safety, or fundamental rights, the stricter the rules that apply.
Think of it as a tiered regulatory system, similar to how the EU regulates medical devices or food safety. Not every AI application faces the same requirements. A spam filter and a hiring algorithm are treated very differently.
The Four Risk Categories
Unacceptable Risk (Banned)
These AI practices are prohibited entirely as of February 2025:
- Social scoring by governments, rating citizens based on behavior
- Real-time biometric surveillance in public spaces (with narrow law enforcement exceptions)
- Emotion recognition in workplaces and educational institutions
- Manipulative AI that exploits vulnerabilities of specific groups (children, elderly, disabled persons)
- Predictive policing based solely on profiling
If your business uses any system that falls into these categories, stop immediately. There are no exceptions or transition periods for prohibited practices.
High Risk
This is the category where most compliance work will happen. High-risk AI systems are those used in:
- Employment: Resume screening, hiring decisions, performance monitoring, promotion decisions
- Education: Student assessment, admissions, plagiarism detection
- Critical infrastructure: Energy, water, transport management
- Law enforcement: Evidence evaluation, crime analytics
- Financial services: Credit scoring, insurance risk assessment, fraud detection
- Immigration: Visa and asylum processing
- Healthcare: AI-assisted diagnosis, treatment planning
High-risk systems must comply with a comprehensive set of requirements including risk management, data governance, technical documentation, transparency, human oversight, accuracy, and cybersecurity.
Limited Risk
Systems with limited risk face primarily transparency obligations. Users must be informed when they are interacting with AI. This includes:
- Chatbots: Must disclose that the user is talking to an AI
- Deepfakes: AI-generated content must be labeled
- Emotion recognition: If used in permitted contexts, users must be informed
Minimal Risk
Most AI applications fall here and face no specific requirements under the Act. This includes spam filters, AI-powered search, recommendation engines, and standard business automation tools. The Act encourages voluntary codes of conduct for minimal-risk systems but does not mandate compliance steps.
Key Compliance Requirements for High-Risk Systems
If you deploy a high-risk AI system, here is what you need to do:
Risk Management System
You must establish a continuous risk management process that identifies, analyzes, and mitigates risks throughout the AI system's lifecycle. This is not a one-time assessment. You need ongoing monitoring and updates.
Data Governance
Training, validation, and testing datasets must meet quality criteria. You need to document data provenance, identify potential biases, and ensure datasets are relevant and representative. If your AI system makes decisions about people, you must be able to explain what data it was trained on and how that data was validated.
Technical Documentation
Before placing a high-risk system on the market or deploying it, you must prepare technical documentation demonstrating compliance. This includes a description of the system, its intended purpose, the development process, data requirements, performance metrics, and risk mitigation measures.
Transparency and Information
Users of high-risk AI systems must receive clear information about the system's capabilities, limitations, and the degree of human oversight required. This means your internal users (like HR teams using an AI screening tool) need to understand what the tool does and does not do.
Human Oversight
High-risk systems must be designed to allow effective human oversight. A human must be able to understand the system's output, decide not to use the system, and override or reverse its decisions. Full automation without meaningful human review is not compliant for high-risk applications.
Accuracy, Robustness, and Cybersecurity
High-risk systems must achieve appropriate levels of accuracy, be resilient to errors, and include cybersecurity measures against unauthorized access or manipulation.
Timeline and Deadlines
- February 2025: Prohibitions on unacceptable-risk AI practices took effect
- August 2025: Rules for general-purpose AI models (like GPT-4, Claude) apply to providers
- August 2026: Most high-risk system requirements become enforceable
- August 2027: Remaining provisions for specific high-risk categories (embedded in regulated products) take full effect
If you deploy high-risk AI systems, August 2026 is your critical deadline. You need a compliance program in place well before that date.
What This Means for Businesses Using AI Tools
If You Use ChatGPT, Claude, or Similar Tools
Using a general-purpose AI chatbot for internal productivity is minimal risk. You do not need to register or certify the tool. However, if you use these tools to make decisions about people (hiring, customer creditworthiness, insurance), the high-risk requirements may apply to your specific use case even though the underlying tool is general-purpose.
The key question is not "what tool are you using?" but "what decisions are you making with it?"
If You Sell AI-Powered Products
If your product includes AI components and serves the EU market, you likely need to classify your system's risk level and comply with the corresponding requirements. This applies even if your company is not based in the EU.
If You Are a Small Business
The AI Act includes some provisions for SMEs, including regulatory sandboxes and lighter documentation requirements. However, the core obligations for high-risk systems apply regardless of company size.
Practical Steps to Take Now
- 1.Audit your AI usage. Create an inventory of every AI tool and application your organization uses, including informal use by individual employees.
- 1.Classify risk levels. For each AI application, determine which risk category it falls into based on its use case, not the technology itself.
- 1.Prioritize high-risk systems. If you use AI in hiring, credit decisions, or other high-risk areas, start your compliance program immediately.
- 1.Update vendor contracts. If you use third-party AI tools for high-risk applications, ensure your contracts include compliance obligations, data governance requirements, and audit rights.
- 1.Train your teams. Everyone who uses AI tools needs to understand basic compliance requirements, especially the transparency and human oversight obligations.
- 1.Establish governance. Designate someone responsible for AI compliance. For larger organizations, this may be a dedicated role or committee.
Penalties
Non-compliance penalties are significant:
- Prohibited practices: Up to 35 million euros or 7% of global annual turnover
- High-risk violations: Up to 15 million euros or 3% of global annual turnover
- Providing incorrect information: Up to 7.5 million euros or 1.5% of global annual turnover
These are maximum penalties. Regulators will consider factors like the severity of the infringement, company size, and good-faith compliance efforts.
The Bigger Picture
The EU AI Act is not happening in isolation. Countries worldwide are developing AI regulation, and many are looking to the EU framework as a model. Companies that build compliant AI practices now will be better positioned as regulation expands globally.
More importantly, the principles behind the Act, including transparency, human oversight, and risk management, are simply good practice. Even if you operate entirely outside the EU, these principles help you use AI responsibly and maintain trust with your customers and employees.
Want to master this? Take our free Risk and Error Management course at Acumen and learn how to build responsible AI practices into your workflow.