EU AI Act
EU AI Act: what companies need to know now
With the EU AI Act, Europe has a uniform legal framework for artificial intelligence for the first time. The regulation entered into force in 2024 and applies in stages. It affects not only developers of AI systems but also companies that use AI in their daily work, known as deployers.
The risk-based approach
The AI Act classifies AI systems by their risk:
- Prohibited practices, such as social scoring or certain manipulative systems
- High-risk systems, for example in recruitment, credit scoring or critical infrastructure
- Systems with transparency obligations, such as chatbots or generated content
- Minimal risk for most other applications
AI literacy as an obligation
Since February 2025, the prohibitions and the AI literacy obligation have applied: providers and deployers must ensure that their staff are sufficiently trained in using the AI systems they operate. This affects practically every company that uses generative AI assistants, for example.
Staggered deadlines
Obligations for general-purpose AI models have applied since August 2025, and most other rules, including many requirements for high-risk systems, from August 2026. Longer transition periods apply to certain high-risk systems in regulated products. The exact timeline should be checked for each individual case.
First steps towards AI governance
- An inventory of all AI systems in use, including those in standard software
- A risk classification of every use case
- Usage policies and training for employees
- Alignment with data protection and information security
Building lean AI governance early lets companies keep using AI productively while staying on the safe side.