GUIDE
The EU AI Act: what applies to your business, and when
The EU AI Act for business leaders: what already applies (prohibited practices, AI literacy, transparency), what has been postponed for high-risk, provider vs deployer, and the concrete steps to take now.
The EU AI Act: what applies
to your business, and when
Europe's AI regulation is not just a matter for lawyers or large groups. It concerns any company that uses AI, including a small business running ChatGPT. This guide sorts it out, for a business leader: what already applies today, what has been postponed, and the concrete steps to take now. No jargon, and without turning your organization into a legal department.
What is the AI Act, in one sentence for a leader?
The text sorts uses into four families: prohibited practices (manipulation, social scoring), high-risk uses (recruitment, scoring, critical infrastructure), limited-risk uses subject to transparency (chatbots, generated content), and everything else, at minimal risk, which is free. Most of a small or mid-sized company's uses fall into the last two families. Placing your uses on this grid is the real starting point, and it is also the first step of our method, augmented execution.
What already applies today?
Two of them touch a leader who uses AI directly. AI literacy: any company that uses AI must make sure its people have a sufficient understanding of what they are handling. Transparency: a chatbot must disclose that it is an AI, and generated content (text, images, audio) must be flagged, with a machine-readable technical marking. A grace period runs until 2 December 2026 for that technical marking only, not for the chatbot disclosure.
What has been postponed?
The delay removes nothing: documentation, risk management, human oversight and logging still have to be prepared, simply later. If one of your uses is affected, this window is a reprieve to get organized, not an exemption. And it touches neither the prohibitions, nor literacy, nor transparency, which do apply now.
Are you a "provider" or a "deployer"?
| Provider (system maker) | Deployer (your business, a user) | |
|---|---|---|
| Role | Designs, places on the market | Uses AI in its business |
| Weight of obligations | Heavy (system conformity, technical documentation) | Targeted: compliant use, transparency, literacy |
| What already applies | GPAI, documentation, marking at source | AI literacy, chatbot disclosure, content flagging |
| High-risk (from 2027) | Prove the system's conformity | Human oversight, use per instructions, logs |
Watch one trap: by substantially modifying a system, or putting it out under your own brand, a deployer can be reclassified as a provider, with the obligations that come with it. Hence the value of knowing exactly what your teams use, and how.
Is your use "high-risk"?
So the right question is not "do we use AI," but "what is each use for." The same tool can be harmless for drafting minutes and sensitive for shortlisting CVs. That is why everything starts with an honest map of your uses, including the ones nobody approved. The guide to use cases by sector helps spot where the sensitive uses sit in your line of work.
What penalties, and for whom?
What to take away is the order of priority they draw: never fall into a prohibited use, hold transparency and literacy now, and prepare for high-risk if you are concerned. The rest is good management, not fear.
What to do concretely, right now?
1. Map your AI uses, including informal ones, team by team. 2. Document the training of your people (AI literacy). 3. Make chatbots visible and flag generated content (transparency). 4. Write a one-page set of rules: what is allowed, what never leaves, what always gets checked. 5. If a use is high-risk, use the reprieve until 2027 to prepare documentation and oversight.
Map your AI uses
My Pulse · state of your uses in 10 min · free · the first step toward compliance
Frequently asked
Is a small business that only uses ChatGPT concerned by the AI Act?
Yes, but lightly. As a deployer, it must ensure its teams' AI literacy and transparency (disclose chatbots, flag generated content). These obligations already apply. High-risk, which is heavier, concerns it only if a specific use falls under Annex III.
Does using AI automatically make my business "high-risk"?
No. High-risk depends on the use, not the tool. Drafting, summarizing or translating is not high-risk. Screening applications or deciding on credit is. The same tool can be either, depending on what you do with it.
Do I need a lawyer or a DPO to become compliant?
Legal counsel usefully validates the sensitive cases. But most of the work is operational: knowing what your teams use, setting rules, documenting. It is an execution effort before it is a legal file.