The EU AI Act: who it applies to, how it sorts AI by risk, and the key dates

The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council, signed at Brussels on 13 June 2024 and amended by Regulation (EU) 2026/1744 of 8 July 2026, which was published in the Official Journal on 24 July 2026. It sets common rules for AI systems placed on the market, put into service or used in the European Union. Article 3 defines an AI system as a machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

It is a regulation, so it applies directly in every Member State. Member States set their own penalty rules within the limits of Article 99, which says penalties must be effective, proportionate and dissuasive.

The Regulation does not treat all AI alike. Four groups matter for a business reader.

Prohibited practices. Article 5 bans certain practices outright, for example AI that deploys subliminal or purposefully manipulative techniques that materially distort a person's behaviour and cause significant harm, and some social scoring. Regulation 2026/1744 added points (ba) and (bb) to Article 5(1), which cover AI systems that generate or manipulate intimate or sexually explicit material of identifiable people without their consent, and material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU. Read Article 5 in full for the complete list and the conditions.

High-risk systems. Under Article 6, an AI system is high-risk if it is a safety component of, or is itself, a product covered by the Union harmonisation legislation in Annex I and needs third-party conformity assessment, or if it falls in an area listed in Annex III. Annex III covers eight areas: biometrics; critical infrastructure; education and vocational training; employment and workers' management; access to essential private and public services and benefits; law enforcement; migration, asylum and border control; and administration of justice and democratic processes. Article 6(3) lets an Annex III system fall outside the high-risk group in some cases, for example where it performs a narrow procedural task and does not pose a significant risk of harm.

Transparency duties. Article 50(1) requires providers to design AI systems that interact directly with people so that the people are told they are interacting with an AI system, unless that is obvious.

General-purpose AI models. Article 53 sets duties for providers of these models, starting with technical documentation of the model, its training and testing process and the results of its evaluation.

It depends on your role and on where your systems sit in the risk groups above. A short way to begin is to answer four questions, then take them to your counsel.

Do you provide or deploy AI that reaches the Union market or whose output is used in the Union? Which of your systems are in use, and who owns each one? Does any system fall in a prohibited practice or in an Annex III area? What do your staff know about the systems they use?

Two duties are easy to miss. Article 4, as amended, says providers and deployers of AI systems "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used." It adds that this "obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." For high-risk systems, Article 26 asks deployers to take appropriate technical and organisational measures to use them in line with their instructions for use, and to assign human oversight to people with the necessary competence, training and authority.