The EU AI Act: What It Is and What Companies Need to Do

What it is and who it applies to

The regulation entered into force on 1 August 2024 and applies in phases. It covers providers, meaning those who develop or place an AI system on the market, and also deployers, meaning organisations that use it in their activity, as well as importers and distributors. It has extraterritorial effect: it applies to companies outside the EU if they place systems on the European market or if the system's outputs are used in the EU.

The dates to know

• 1 August 2024: entry into force.
• 2 February 2025: the bans on unacceptable practices and the AI literacy obligation (Article 4) apply.
• 2 August 2025: the obligations for general-purpose AI models and the governance rules apply.
• 2 August 2026: general date of application. Among other things, the Article 50 transparency obligations apply (chatbots, generated content, deepfakes); generative systems already on the market before that date have until 2 December 2026 to mark their output.
• 2 December 2026: two new bans introduced by the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) apply: systems that generate realistic intimate images of a person without their consent and systems that generate child sexual abuse material.
• High risk: the Digital Omnibus postponed the obligations to 2 December 2027 for the Annex III use cases (such as employment, education, credit) and to 2 August 2028 for systems embedded in regulated products (Annex I).

The rules were amended recently and may change again: always check the consolidated text on EUR-Lex before deciding.

What companies need to do, in practice

• Map: take an inventory of the AI systems you develop or use, including generative tools employees use.
• Classify: for each system, establish the risk level and your role (provider or deployer).
• Rule out bans: check that no use falls under the prohibited practices.
• Train: build your staff's AI skills, as Article 4 requires.
• Govern: assign responsibilities and set up human oversight, documentation and rules for choosing suppliers.

What are the penalties

Maximum fines are EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for breaches of other obligations and EUR 7.5 million or 1% for supplying incorrect information to authorities. For SMEs and, since the Digital Omnibus, small mid-cap companies, the lower of the two amounts applies.

Where to start

The first step is always the inventory: you cannot classify or govern what you do not know. A simple register with the system, its purpose, supplier, data used, people involved and internal owner is already an excellent foundation, useful whatever the final deadline.