_1762866128417-DS2_OO1j.png)
The EU AI Act in brief
Regulation (EU) 2024/1689 – the EU AI Act – is the first comprehensive law regulating artificial intelligence. It applies directly in all member states and follows a risk-based approach: the higher the risk an AI system poses to health, safety and fundamental rights, the stricter the obligations. Most everyday business AI applications fall into low risk classes – but some obligations apply to everyone.
It is not only AI developers who are affected. Companies that merely use AI systems – such as a chat assistant, recruiting software with AI features or a vision-based quality inspection system – have obligations as deployers.
The staggered deadlines
| Date | What applies |
|---|---|
| 1 August 2024 | Entry into force |
| 2 February 2025 | Prohibited practices (Art. 5) and AI literacy obligation (Art. 4) |
| 2 August 2025 | Obligations for general-purpose AI models, governance, penalties |
| 2 August 2026 | Most remaining obligations, including high-risk systems under Annex III and transparency obligations (Art. 50) |
| 2 August 2027 | High-risk AI as a safety component of products under Annex I |
What role does your company have?
Obligations depend on your role in relation to each AI system. A company can have different roles for different systems:
| Role | Who? | Typical obligations |
|---|---|---|
| Provider | Develops an AI system or has it developed and places it on the market under its own name | For high-risk: risk management, data governance, technical documentation, conformity assessment, QMS |
| Deployer | Uses an AI system under its own authority in a professional context | AI literacy, use as intended, human oversight, logs, informing employees |
| Importer | Places an AI system from a third-country provider on the EU market | Check conformity before placing on the market |
| Distributor | Makes an AI system available on the market | Check marking and documentation |
Note: anyone who substantially modifies a high-risk system, uses it for a different high-risk purpose or offers it under their own name can become a provider themselves.
The risk classes
| Class | Examples | Consequence |
|---|---|---|
| Prohibited (Art. 5) | Social scoring, manipulative techniques, emotion recognition in the workplace (with exceptions), untargeted scraping of facial images | Use prohibited |
| High-risk (Art. 6, Annexes I and III) | AI in recruitment and HR decisions, creditworthiness assessment, critical infrastructure, safety components of products | Extensive obligations for providers and deployers |
| Transparency obligations (Art. 50) | Chatbots, AI-generated content, deepfakes | Labelling and informing the people concerned |
| Minimal risk | Spam filters, AI-assisted spell checking, recommendations in business software | No specific obligations apart from AI literacy |
AI literacy under Article 4
Since 2 February 2025, providers and deployers must take measures to ensure that their staff and other persons dealing with AI systems on their behalf have a sufficient level of AI literacy. This applies regardless of the risk class – including the use of general-purpose assistants.
- Basics: what can AI do, where are its limits, how do errors and bias arise?
- Company rules: which tools are approved, which data may be entered?
- Role-specific depth: people who use AI output for decisions need more knowledge than occasional users.
- Evidence: document trainings, refresh them regularly, include new tools.
Trainings with quiz and certificate through training management provide traceable evidence.
The AI inventory: the first step
Without knowing which AI systems are used in the company, role and risk class cannot be determined. An AI inventory is therefore the basis for every further step – even though the AI Act does not explicitly require it.
- 1
Collect systems
Ask business areas, IT and purchasing: which tools, platforms and software features use AI? AI features in existing standard software count too.
- 2
Describe purpose and use
What is the system used for, who uses it, which decisions does it influence, which data is processed?
- 3
Determine the role
Are you provider, deployer or both?
- 4
Classify the risk
Check prohibited practices first, then high-risk under Annexes I and III, then transparency obligations. Document the rationale.
- 5
Derive obligations
Record the applicable obligations and owners for each system.
- 6
Keep it current
An approval process for new AI tools keeps the inventory complete.
| Inventory field | Example |
|---|---|
| Name and provider | Chat assistant, provider X |
| Purpose | Drafting customer replies |
| Role | Deployer |
| Risk class | Transparency obligation / minimal risk |
| Data processed | Customer enquiries without special categories |
| Owner | Head of customer service |
| Measures | Usage policy, training, labelling AI-generated replies |
Setting up an AI usage policy
Besides the inventory and training, a short usage policy is the most effective way to govern AI in the company. It should at least define which AI tools are approved, which data may and may not be entered – such as trade secrets or personal data –, how AI output must be checked and labelled, and who decides on approving new tools. Distribute the policy with a read acknowledgement and cover it in the AI literacy training.
Obligations as a deployer of high-risk AI
- Technical and organisational measures to use the system in line with the instructions for use.
- Human oversight by competent, trained people with the necessary authority.
- Ensure input data is relevant and sufficiently representative, to the extent you control it.
- Monitor operation and inform the provider and authorities about risks or serious incidents.
- Keep automatically generated logs for at least six months.
- Inform employees and their representatives before a high-risk system is used in the workplace.
- In certain cases – such as public bodies, creditworthiness or insurance – carry out a fundamental rights impact assessment (Art. 27).
Penalties
| Infringement | Maximum |
|---|---|
| Prohibited practices | €35m or 7% of worldwide annual turnover |
| Other obligations, including for high-risk systems and transparency | €15m or 3% |
| Incorrect or incomplete information to authorities | €7.5m or 1% |
For small and medium-sized enterprises, the lower of the two amounts applies in each case.
EU AI Act and ISO 42001
The ISO/IEC 42001 standard describes an AI management system. It is voluntary but helps implement AI Act obligations in an organised way: AI policy, roles, risk and impact assessment, lifecycle, data and human oversight. Companies with an existing ISO 9001 or ISO 27001 system can reuse many structures.
The EU AI Act in docxpert
The AI register in docxpert records every AI system with purpose, role, risk class and linked evidence. For the EU AI Act, a requirement catalogue for the gap analysis and nine templates are built in, including AI inventory and risk classification, AI risk and impact assessment, AI lifecycle with human oversight and technical documentation for high-risk AI.
Frequently asked questions
Does the EU AI Act apply if we only use ChatGPT?
Yes. As a deployer you must at least ensure AI literacy among your staff. Depending on use, transparency obligations may apply. General text assistance is usually not a high-risk use.
Is an AI inventory mandatory?
The AI Act does not explicitly require it. But without an inventory, roles and risk classes cannot be determined – so it is the practically necessary first step.
Since when does the AI literacy obligation apply?
Since 2 February 2025. It applies to providers and deployers regardless of the risk class.
Is AI in recruitment high-risk?
AI systems used to select candidates, evaluate them or decide on promotion and termination are generally high-risk systems under Annex III.
What happens in case of infringements?
Fines of up to €35m or 7% of worldwide turnover for prohibited practices and up to €15m or 3% for other infringements. For SMEs the lower amount applies.
Do we need an AI policy?
It is not explicitly required but strongly recommended. A policy defines which tools are permitted, which data may be entered and who approves new AI applications.
How do the AI Act and the GDPR relate?
Both apply side by side. If an AI system processes personal data, GDPR obligations also apply – such as legal basis, transparency and, where needed, a data protection impact assessment.
What is the difference between provider and deployer?
The provider develops an AI system and places it on the market. The deployer uses it under its own authority. Most companies are deployers; those offering their own AI solutions are also providers.
How should I inventory AI features embedded in software we already use?
Ask business teams, IT and procurement about more than separately purchased AI products. Check enabled features in office suites, customer platforms, HR tools and analytics services. Record the provider, function, intended purpose, users, data types and whether your organisation can influence settings or outputs. Actual use matters more than the product label: an optional feature may be unused or may change a consequential workflow. Ask the provider for available information on the model, limitations and terms, and record unresolved questions. Review privacy, information security and your organisation's role with process owners. Define who approves new features and when an existing register entry must be reassessed. This keeps the inventory aligned with real use rather than starting only with central IT purchases.