The EU AI Act establishes a risk-based framework for artificial intelligence. It sets obligations for different actors and uses, with requirements phased in over time. This guide explains the structure in plain English and points you to the official sources.
Last reviewed: 8 November 2026. The AI Act was amended by the Digital Omnibus on AI in July 2026. Dates and requirements below reflect the current official EU implementation guidance available at the time of review.
What is the EU AI Act?
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the European Union’s legal framework for AI. It takes a risk-based approach: the obligations depend on the role an organisation plays, the AI system and its intended use.
It is not simply a rule for companies that build AI. Organisations that deploy AI systems as part of their own activities can also have responsibilities. Businesses may have several roles across different systems.
Does it apply to your business?
It may apply if your organisation develops, places on the market, puts into service or uses AI systems in the EU, or if you provide or use AI systems whose outputs are used in the EU. The exact scope depends on the facts, including your role, where the system is placed on the market or used, and any relevant exclusions.
Start by mapping the AI systems your organisation builds, buys or uses. Include general-purpose assistants, embedded AI features, recruitment or customer tools, analytics, coding assistants and systems supplied to customers.
INTERACTIVE TOOL / EU AI ACT
Which AI Act roles apply to your organisation?
Answer these questions for one AI system, product or project. You may have more than one role — and your role can differ across systems. The result is an initial classification to help you identify what to investigate next.
This tool provides general information and an indicative result, not legal advice or a formal determination. It does not assess whether the system is prohibited, high-risk or subject to transparency duties. Those are separate assessments. Always verify the facts against the current Regulation and obtain specialist advice where appropriate.
The risk-based approach
Uses that the Act bans, subject to the precise legal definitions and exceptions.
Specific systems subject to requirements such as risk management, data governance, documentation and human oversight.
Disclosure or marking obligations apply in defined situations and to particular actors.
Often no additional obligations under the Act risk tiers, though other rules and duties may still apply.
A SEPARATE QUESTION / YOUR ROLE
This is a simplified supply-chain illustration, not a mandatory sequence. One organisation may hold several roles, depending on what it does with each system.
General-purpose AI model obligations are a separate, cross-cutting part of the Act. The risk tier and the organisation’s legal role must be assessed independently.
Prohibited practices
Certain AI practices are prohibited because they pose unacceptable risks. The prohibitions have applied since February 2025, with additional prohibitions introduced for December 2026.
High-risk systems
Specific systems used in sensitive areas, or as safety components in regulated products, are subject to more extensive requirements. The application dates have been extended under the 2026 amendments.
Transparency obligations
Some AI interactions and AI-generated or manipulated content carry transparency requirements, including disclosures and marking in specified circumstances.
General-purpose AI
Providers of general-purpose AI models have specific obligations, including documentation, information-sharing and, for models with systemic risk, additional evaluation and mitigation requirements.
Many low-risk uses are not subject to the Act’s high-risk obligations. However, other laws and organisational responsibilities may still apply.
Key implementation dates
| Date | What happens |
|---|---|
| 2 February 2025 | Definitions, AI literacy provisions and the initial prohibited-practice rules apply. |
| 2 August 2025 | Governance provisions and obligations for general-purpose AI models apply. |
| 2 August 2026 | Most remaining provisions, including applicable transparency requirements, begin to apply. |
| 2 December 2026 | Additional prohibitions apply; a transition deadline applies to certain pre-existing synthetic-content systems under Article 50(2). |
| 2 December 2027 | Rules for high-risk AI systems classified under Article 6(2) and Annex III apply. |
| 2 August 2028 | Rules for high-risk AI systems covered by Article 6(1) and Annex I apply. |
These dates are a summary, not a substitute for checking the relevant transitional provisions and the exact classification of a system.
AI literacy: an immediate organisational consideration
Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of staff and other people operating or using AI systems on their behalf. The measures should take account of people’s technical knowledge, experience, education and training, the context of use and the people affected by the systems.
Following the 2026 amendment, the obligation does not require an organisation to guarantee a specific level of AI literacy for every individual. It remains important to take proportionate, considered measures and to be able to explain the approach taken.
For many growing businesses, a sensible starting point is role-based education, clear acceptable-use guidance, practical examples and a way for employees to raise questions.
A practical starting checklist
- Identify the AI tools and systems used across the organisation, including unsanctioned or informal use.
- Record the purpose, supplier, business owner and groups of people affected by each system.
- Understand whether your organisation is a provider, deployer, importer, distributor or another actor for each use case.
- Screen intended uses against prohibited practices and the high-risk categories.
- Review data protection, confidentiality, cybersecurity, intellectual property and procurement implications.
- Set clear rules for employee use and provide role-appropriate AI literacy measures.
- Assign ownership for monitoring regulatory changes and reviewing the inventory.
Official sources and further reading
- European Commission AI Act Service Desk — implementation timeline
- AI Act Service Desk — Article 4: AI literacy
- European Commission — AI Act policy and regulatory framework
- Regulation (EU) 2024/1689 — official legal text
Important: Lucentreg provides general educational information, not legal advice or a determination that a particular organisation or AI system complies with the law. Applicability and obligations depend on the facts. Seek qualified legal advice where you need a legal assessment.
