EU AI Act: what companies need to know now

The AI Act is the EU's first comprehensive law on artificial intelligence. It does not regulate the technology as such but its use: the greater the risk an AI system poses to health, safety and fundamental rights, the stricter the requirements. As a regulation it applies directly in every Member State; national law only settles accompanying questions such as competent authorities and penalties.

The key concept is the AI system in Article 3(1): a machine-based system that operates with varying levels of autonomy and infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions. Conventional software with fixed, hand-coded rules is usually outside the definition; language models, image recognition and learning recommender systems are inside it.

The Act distinguishes roles. Providers develop an AI system, or have it developed, and place it on the market under their own name. Deployers use an AI system under their own authority, for instance a company running a language assistant in customer service. There are also importers, distributors and authorised representatives. Anyone who substantially modifies a third-party system or markets it under their own name can become a provider themselves (Article 25).

The risk-based approach is the heart of the regulation. It decides whether a company has only baseline duties or must build a full quality and risk management system.

Article 113 states that the regulation enters into force on the twentieth day following publication in the Official Journal. It was published on 12 July 2024 and therefore entered into force on 1 August 2024. As a rule it applies from 2 August 2026, with three exceptions spelled out in the text.

Most companies do not develop AI; they use it. For them the main duty since February 2025 is Article 4: a sufficient level of AI literacy among staff. They must also avoid prohibited practices — a tool that recognises employees' emotions is in principle banned in the workplace.

Deployers of high-risk systems carry the duties of Article 26 once those rules apply: use in line with the instructions for use, human oversight by competent people, monitoring of operation, keeping automatically generated logs for at least six months, and informing affected workers and their representatives before workplace use. Certain deployers, such as public bodies, must also carry out a fundamental rights impact assessment under Article 27.

Article 50 governs transparency: anyone who generates deep fakes or publishes AI-generated text on matters of public interest must, as a rule, disclose this. Providers of chatbots and of systems generating synthetic content have their own labelling duties.

Article 99 tiers the fines: up to EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3 percent for breaches of certain other obligations, such as those of deployers under Article 26 or the transparency duties under Article 50; and up to EUR 7.5 million or 1 percent for supplying incorrect information to authorities. For SMEs the lower of the two amounts applies. Member States lay down the details of enforcement.

The AI Act sits alongside other laws rather than replacing them. Where an AI system processes personal data, the GDPR continues to apply — for instance the restriction on solely automated decisions with legal effect (Article 22 GDPR). In German workplaces, co-determination rights apply when AI is capable of monitoring conduct or performance. Product liability and contract law remain unaffected.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.