The EU AI Act: what does it mean for your business?

Short answer

The AI Act is the EU’s law on artificial intelligence. It sorts AI by how much risk it poses. Most businesses use low-risk AI – for writing, email and analysis – and face few requirements. But some kinds of AI are banned, and AI used for things like recruitment, credit or critical infrastructure faces strict rules. Since August 2026 you also have to tell people when they’re talking to an AI.

This guide is a plain-language explanation, not legal advice. If in doubt, ask a lawyer.

The four risk levels

1. Prohibited AI. For example, systems that manipulate people or “social scoring” of citizens. Banned since February 2025.
2. High risk. AI that affects people’s lives and rights – such as recruitment, education, credit scoring, critical infrastructure and certain health products. Requirements include documentation, human oversight and risk management.
3. Limited risk – transparency rules. For example chatbots and AI-generated content. People must know they’re talking to an AI, and certain AI images and videos must be labelled.
4. Minimal risk. Most everyday business use of AI. No special requirements, but good practice is recommended.

The key dates

• February 2025: The bans took effect.
• August 2025: Rules for large AI models (the ones behind e.g. ChatGPT) – mainly a requirement for the providers.
• August 2026: Transparency rules: tell people when they’re talking to AI, and label certain AI-generated images and videos.
• December 2027: Requirements for high-risk AI (e.g. recruitment, credit, critical infrastructure). The date was pushed back from August 2026 when the EU’s amendment package (the “Digital Omnibus”) entered into force in July 2026.
• August 2028: Requirements for AI built into products with their own rules, such as medical devices and machinery.

What should your business do now?

1. List the AI you use. Don’t forget the “hidden” ones, such as AI in your CRM or HR system.
2. Place each solution in a risk level. For most, it will be minimal or limited risk.
3. Be open. If you have a chatbot or AI replies to customers, say clearly that it’s AI.
4. Keep people in the decisions. Especially when AI affects customers, employees or citizens.
5. Train your people. Anyone using AI should know what it can do and where it gets things wrong.
6. Watch out for high risk. If you use AI for recruitment or credit scoring, start preparing now – December 2027 will come quickly.

How BCT helps

We build AI with the guardrails in place from day one: clear rules for what the AI may do, human approval and a log of everything it does. On a Shadow Walk we look at your workflows and help you choose AI that delivers value – and that you can stand behind.

Read about the Shadow Walk →

Frequently asked questions

Does the AI Act apply to small businesses?

Yes, it applies to anyone who develops or uses AI in the EU. But most small businesses use low-risk AI and face few requirements.

Can we still use ChatGPT and Copilot?

Yes. Everyday use for writing, email and analysis is minimal risk. Be careful with personal data, and tell customers if they’re talking to an AI.

When do the high-risk requirements apply?

From December 2027 for most areas and August 2028 for AI in products such as medical devices and machinery.

What happens if we don’t comply?

Fines can be large, especially for prohibited AI. That’s why it pays to get an overview of your AI now.

In short

The AI Act sorts AI by risk. Most businesses use low-risk AI and face few requirements, while some kinds of AI are banned, and AI used for things like recruitment, credit or critical infrastructure faces strict rules.

The most useful thing you can do now is list the AI you use, work out what risk it carries, and make sure people are told when they’re talking to an AI. That puts you in a good position as the rules tighten.