The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) has been applying in stages since 2025. In July 2026 it was amended by Regulation (EU) 2026/1744 (the “Digital Omnibus”), which moved some dates and simplified some obligations. Below is what applies today to a business that uses AI tools rather than building them.
First: which role do you have
The Act mainly distinguishes the provider, who develops an AI system and places it on the market, from the deployer, who uses it in their work. Most businesses are deployers: they use an off-the-shelf tool or a system someone else built for them. A deployer’s obligations are considerably lighter than a provider’s.
The second thing that matters is what the AI is used for. The Act takes a risk-based approach: most everyday uses, such as drafting text, customer service or reading documents, carry limited obligations.
What already applies
- From 2 February 2025: prohibited practices. Some uses are banned outright, for example recognising employees’ emotions in the workplace (with very narrow exceptions) and social scoring of people.
- From 2 February 2025: AI literacy (Article 4). Organisations using AI systems must take measures to support their staff’s AI literacy. Since the 2026 amendment, they are not required to guarantee a specific level for each individual. The obligation remains, though, and it is wise to be able to show what you have done: a short training session, usage guidelines, rules on what is allowed.
- From 2 August 2026: transparency obligations (Article 50). If a customer is talking to an AI system, they must know it. Content artificially generated or manipulated to look real (deepfakes) must be disclosed, as must AI-generated text published to inform the public, with some exceptions.
What is coming: high-risk systems
The strictest obligations concern high-risk systems. They include systems used for recruitment and candidate selection, evaluating employees, credit scoring of individuals and access to education. After the Digital Omnibus, these obligations apply from 2 December 2027 for stand-alone systems and from 2 August 2028 for systems embedded in regulated products.
If you plan, for example, to use AI to screen CVs or assess employee performance, the design should start now with these requirements in mind: human oversight, documentation, logging, informing employees.
A practical checklist for your business
- List the AI tools in use today, by whom and for what. There are often more than you think.
- Check whether any use touches the prohibited practices or the high-risk categories, especially in HR.
- Tell customers when they are talking to an AI system, and label content where required.
- Train the staff who use AI, and keep a record of what you did.
- Combine all this with the GDPR: the AI Act does not replace data protection obligations; both apply.
The AI Act is not a reason to avoid AI. It is a reason to use it with a plan. When we design AI solutions for clients, compliance is part of the design from day one. See how we approach the move to AI.
This article is for general information and is not legal advice. For your specific case, consult a lawyer.