What does the EU AI Act require of a business that uses AI?

Does the AI Act apply to your business?

Regulation (EU) 2024/1689, known as the AI Act, separates two roles. A provider develops an AI system, or puts one into service under its own name. A deployer uses an AI system under its authority, in a professional setting (Article 3).

As soon as your employees use an AI tool for work, your company is a deployer. That covers an assistant like ChatGPT, Claude or Copilot used to draft or translate, software that screens job applications, and a chat assistant on your website. The European Commission itself uses the example of employees writing ad copy or translating with ChatGPT.

A company can also become a provider without meaning to: by putting a system into service under its own name, or by turning a tool to a high-risk use (Article 25). Ask every vendor who holds which role.

What does Article 4 require on AI literacy?

Since February 2, 2025, providers and deployers have had to look after the AI literacy of their staff and of anyone using AI on their behalf. The point is that people know what the tool does, what it can get wrong and how to use it in their own job.

Regulation (EU) 2026/1744, the "Digital Omnibus on AI", took effect on July 27, 2026 and rewrote this article. The obligation stays, in a lighter form: companies take measures to support the development of AI literacy, without having to guarantee any specific level for any individual. In November 2025 the Commission had proposed shifting this duty onto member states; the adopted text leaves it with companies.

According to the Commission's Q&A, updated October 20, 2026, no particular training is mandated and no certificate is required. It recommends starting from the company's role, the tools it uses and their risks, then tailoring the effort to each person's level. Companies can keep an internal record of what they did. National authorities have been enforcing this since August 2, 2026.

An AI acceptable use policy, which says which tools to use, for what and with which data, is often the first of these measures. Training can be part of it: getting AI training funded by your OPCO explains how.

Which uses of AI are banned?

Since February 2, 2025, Article 5 has banned certain practices, whatever the company's role. These are the ones a small or midsize business might run into:

• Inferring the emotions of employees at work, or of students, except for medical or safety reasons.
• Scoring people on their social behavior or personality, then treating them unfavorably in an unrelated context or out of proportion.
• Manipulating people, or exploiting a vulnerability (age, disability, social or economic situation), in a way that causes them significant harm.
• Sorting people by their biometric data to infer their political views, union membership, religion or sexual orientation.
• Building a facial recognition database by scraping images from the internet or CCTV footage without a specific target.
• From December 2, 2026, a ninth ban added by the omnibus: generating realistic intimate images of an identifiable person without consent, or child sexual abuse material.

Which uses are high-risk, and when do the rules apply?

Annex III of the regulation lists high-risk uses. Five of them come up most in small and midsize companies. The omnibus pushed the related obligations back to December 2, 2027, from August 2, 2026. For AI built into products that are already regulated (machinery, toys, medical devices), they apply from August 2, 2028.

• Hiring: placing targeted job ads, screening or filtering applications, evaluating candidates.
• Managing staff: deciding on promotions or terminations, assigning tasks based on behavior or personality, monitoring and evaluating performance.
• Credit: assessing an individual's creditworthiness or credit score, except for fraud detection.
• Life and health insurance: assessing a person's risk and setting their premium.
• Education and training: deciding on admissions, evaluating learning outcomes.

What must a company using a high-risk system do?

The delay isn't an exemption: a résumé-screening tool picked today will have to meet these rules on December 2, 2027. Article 26 requires deployers to:

• use it according to the provider's instructions;
• assign human oversight to people who have the competence, training and authority to step in;
• where they control the input data, make sure it is relevant to the intended purpose;
• monitor how it runs, report a risk or serious incident, and suspend use if needed;
• keep the logs under their control for at least six months;
• inform worker representatives and affected employees before putting it into service at work;
• tell people when they are subject to a decision made or assisted by the system;
• carry out the GDPR impact assessment where one is required, using the information the provider supplies.

Which transparency rules have applied since August 2, 2026?

Article 50 has applied since August 2, 2026, with no delay. It splits the duties between provider and deployer:

• Chat assistants: people must know they're talking to an AI, unless it's obvious. This duty falls on the provider; if you put such an assistant into service under your own name, check who carries it.
• Generated content: the provider marks generated images, audio, video and text so that a machine can detect them. A tool already on the market before August 2, 2026 has until December 2, 2026.
• Deepfakes: a deployer that publishes realistic images, audio or video that were generated or altered must say so.
• Text published to inform the public on matters of public interest: the deployer discloses that AI produced it, unless a person reviewed it and holds editorial responsibility for it.
• Emotion recognition or biometric categorization, where still allowed: the deployer informs the people exposed to it.

What are the key dates?

The timeline as it stands on November 5, 2026:

• August 1, 2024: the regulation enters into force.
• February 2, 2025: banned practices and AI literacy.
• August 2, 2025: rules for general-purpose AI models, which apply to the companies that develop them.
• July 27, 2026: the Digital Omnibus (Regulation (EU) 2026/1744) takes effect, with the new wording of Article 4.
• August 2, 2026: general application, transparency rules, oversight and penalties by national authorities.
• December 2, 2026: ninth ban; end of the marking grace period for generative tools already on the market.
• December 2, 2027: high-risk uses in Annex III (hiring, staff management, credit, insurance, education).
• August 2, 2028: AI built into regulated products (Annex I).

What are the penalties?

Article 99 sets fines of up to €35 million or 7% of worldwide annual turnover for a banned practice, and up to €15 million or 3% for breaching deployer or transparency obligations. For a small or midsize company, the cap is the lower of the two amounts.

Enforcement sits mainly with each member state's market surveillance authorities. The Commission's AI Office oversees general-purpose AI models.

What does a custom AI agent change?

An agent alone won't make a company compliant, but the way it's built can make these rules easier to live with day to day:

• Cited sources: every answer points to the documents it came from. Your team sees where a claim comes from, catches mistakes and learns the limits of the tool by using it.
• Human approval: the agent prepares the work (a reply, a quote, a document) and a person at your company approves it before it goes out. The regulation requires this kind of human oversight for high-risk uses; you build the habit from the first agent.
• Data kept on your side: your files stay in your folders, read-only. What the agent retains is encrypted with a key unique to your company, on servers in France with the database in the European Union.
• A known use: each agent does one task you chose. You know which AI does what, which is the first line of your inventory.

What about the choice of model?

You choose the model: Claude, models from OpenAI, or Mistral if you prefer a French model. They run in Europe, with no retention of your data.

Hosting and encryption are covered on the page "Where does our data go with enterprise AI?". What an agent is, and how to deploy one, is in the guide to AI agents for business.

What should be on the CEO's checklist?

Ten points to go through with your team:

• List the AI tools in use across the company, including the ones employees picked up on their own, and what each is for.
• Check that no use falls under the banned practices, starting with analyzing employees' emotions.
• Spot the high-risk uses (hiring, staff evaluation, credit, insurance) and plan for December 2, 2027.
• Ask every vendor whether it is the provider, whether you are the deployer, and what instructions it supplies.
• Plan an AI literacy effort suited to each role, and keep a record of it.
• Write an acceptable use policy: which tools, for what, with which data.
• Keep a human review on anything that commits the company: quotes, replies to clients, contracts.
• Tell customers when they're talking to an AI, and disclose when realistic images, audio or video you publish were generated.
• Know where your data goes, whether the vendor can train on it, and what your GDPR assessment says.
• Reread the timeline every six months: it has already moved once.

Frequently asked

Does the AI Act apply to a small business that only uses ChatGPT?

Yes, for AI literacy: a company whose employees use an AI tool at work is a deployer, and has to take measures so they know how to use it and where its limits are. Everything else depends on the use: banned, high-risk, subject to transparency, or not specifically regulated.

Is AI training mandatory for employees?

No particular training is mandated and no certificate is required, according to the European Commission. The company has to take measures to support its staff's AI literacy, suited to how it uses AI, and can keep an internal record of what it did.

What did the Digital Omnibus change in 2026?

Regulation (EU) 2026/1744, in force since July 27, 2026, softened Article 4 on AI literacy, pushed high-risk obligations back to December 2, 2027 (Annex III) and August 2, 2028 (Annex I), and added a ban that applies from December 2, 2026. Transparency rules were not delayed: they have applied since August 2, 2026.

Is August 2, 2026 still the key date?

It is the date of general application, of the transparency rules and of the start of enforcement. High-risk obligations, originally due on that date, were moved to December 2, 2027.

Is a custom AI agent a high-risk system?

Not in itself: it depends on what it is used for. An agent that sorts email, prepares quotes or finds documents isn't listed in Annex III. An agent that screens job applications or evaluates employees is.

Do you have to register your AI tools anywhere?

A private company that uses a tool doesn't have to register it in the EU database. Registration applies to providers of high-risk systems and to public authorities that use them.

Who enforces the AI Act?

Each member state's market surveillance authorities, since August 2, 2026. The Commission's AI Office oversees general-purpose AI models.