The EU AI Act Explained: What Businesses Need to Know

The EU AI Act is the world’s first broad law regulating artificial intelligence. Its official name is Regulation (EU) 2024/1689. It doesn’t ban AI or regulate all of it equally. It sorts AI uses by risk and puts the heaviest obligations on the uses most likely to harm people.

This guide covers what the Act is, who it applies to, the key dates and what it means for a typical business.

Who does the EU AI Act apply to?

More organisations than most people expect. The Act applies to:

• Providers: organisations that develop an AI system or model and place it on the EU market under their own name, wherever they are based.
• Deployers: organisations that use an AI system in a professional context in the EU.
• Importers and distributors of AI systems in the EU.
• Providers and deployers outside the EU whose AI system’s output is used in the EU.

So a US or UK company whose AI product is used by EU customers is in scope. (Not sure which role you play? See provider vs deployer.)

There are exclusions, including AI used only for military or national security purposes, scientific research and development, and purely personal, non-professional use.

The risk-based approach

The Act sorts AI into four levels:

1. Unacceptable risk: banned outright, for example social scoring.
2. High risk: allowed, but with strict requirements, for example AI used in hiring, credit scoring or critical infrastructure.
3. Transparency risk: allowed, but people must be told, for example chatbots and deepfakes.
4. Minimal risk: no new obligations, which covers most AI in use today.

There are separate rules for general-purpose AI models, the large models behind tools like chatbots.

We cover each level in detail in EU AI Act risk categories explained.

Key dates

The Act entered into force on 1 August 2024 and applies in stages. Some dates were moved by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The dates below include those changes.

• 2 February 2025: banned practices apply, along with the AI literacy duty.
• 2 August 2025: obligations for general-purpose AI model providers apply, along with the governance structure and penalties.
• 2 August 2026: transparency duties apply, such as telling people they’re talking to an AI and disclosing deepfakes. The EU AI Office’s enforcement powers over general-purpose AI model providers also start.
• 2 December 2026: two new bans added by the Omnibus apply (non-consensual sexual deepfakes and AI-generated child sexual abuse material). This is also the last date for providers whose generative AI was already on the market before 2 August 2026 to mark its output as AI-generated.
• 2 December 2027: obligations for high-risk systems listed in Annex III apply, such as AI used in hiring or credit scoring. This was originally 2 August 2026.
• 2 August 2028: rules for high-risk AI built into products covered by other EU safety laws (Annex I), such as medical devices and machinery. This was originally 2 August 2027.

The delay to the high-risk rules gives you more time. It doesn’t remove the work, and the banned practices, AI literacy and transparency duties already apply.

What it means for a typical business

Most businesses are deployers, not providers: they use AI that someone else built. For them the practical to-do list is:

• Check you don’t use banned practices, for example emotion recognition on employees.
• Make sure staff have adequate AI literacy for the tools they use.
• Tell people when they’re talking to AI if you run a chatbot, and label AI-generated content where the Act requires it.
• If you use high-risk AI, for example to screen job candidates, follow the provider’s instructions, assign human oversight, keep logs and inform the people affected.

If you build AI that falls into a high-risk category, the obligations are much heavier: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity requirements, a quality management system and a conformity assessment before launch.

Penalties

Fines are set as a fixed amount or a percentage of worldwide annual turnover, whichever is higher:

• Banned practices: up to €35 million or 7%.
• Most other obligations: up to €15 million or 3%.
• Supplying incorrect or misleading information to authorities: up to €7.5 million or 1%.

For SMEs and start-ups, the lower of the two amounts applies instead. Since the Omnibus, the same lower-of rule also applies to small mid-cap companies for the €15 million and €7.5 million tiers, and authorities must consider these companies’ economic viability when setting fines.

Where to start

1. Build an AI inventory of everything you use or sell.
2. Classify each item by risk level.
3. Work out your role for each one: provider or deployer.
4. Close the gaps that already apply today: banned practices and AI literacy.
5. Plan for the high-risk and transparency obligations on the timeline that applies to you.

Official sources

• EU AI Act, Regulation (EU) 2024/1689: the official text on EUR-Lex
• Digital Omnibus on AI, Regulation (EU) 2026/1744: the July 2026 amendment that moved the high-risk dates
• AI Act Service Desk: the European Commission’s AI Act explorer, compliance checker and FAQs
• European AI Office: the Commission body that supervises general-purpose AI models

More primary sources, with a short note on each, are on our Sources page.

Last reviewed 25 October 2026. Dates and obligations summarised from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI). Updated 25 October 2026: the Omnibus is now in force, so the high-risk dates and the new bans are included. This article is general information, not legal advice.