- The AI Act splits systems into four risk levels: unacceptable, high, transparency-related and minimal.
- The regulation entered into force on 1 August 2024 and applies from 2 August 2026, with exceptions: prohibitions from February 2025, GPAI from August 2025, high-risk systems from December 2027 and August 2028.
- This is not legal advice; check the text and the Commission's notices.
The AI Act, the European Union regulation on artificial intelligence, is the first such broad legal act on AI. For many companies it sounds scary, yet in practice most ordinary uses, such as a spam filter or an assistant for drafts, are not subject to any extra obligations. This text summarizes the structure of the rules according to the European Commission’s description and shows where to look for current deadlines. This is not legal advice, and in disputed matters you need the text of the regulation or a lawyer.
Four risk levels
The European Commission describes that the AI Act defines four levels of risk. Unacceptable risk means a ban: it concerns systems considered a clear threat to the safety, livelihoods and rights of people. High risk covers uses that can seriously endanger health, safety or fundamental rights. Transparency risk concerns obligations to inform, for example that you are talking to a machine. Minimal or no risk comes with no new rules, and according to the Commission it covers the vast majority of systems used in the EU, such as AI-enabled games or spam filters.
| What it covers | What happens | |
|---|---|---|
| Unacceptable | Manipulation, social scoring, exploiting vulnerabilities and other prohibited practices | A ban on use |
| High | Recruitment, credit scoring, education, critical infrastructure, law enforcement and others | Strict obligations before being placed on the market |
| Transparency | Chatbots, generated content, deepfakes | Obligations to inform and label |
| Minimal | Spam filters, games, ordinary tools | No new obligations |
Prohibited practices
The Commission lists nine prohibited practices: harmful manipulation and deception, exploiting vulnerabilities, social scoring, assessing the risk of an individual committing an offence, untargeted scraping of facial images from the internet or CCTV to build recognition databases, emotion recognition in workplaces and schools, biometric categorisation to infer protected characteristics, real-time remote biometric identification for law enforcement in public spaces, and systems generating non-consensual intimate content or child sexual abuse material. Prohibitions 1–8 became effective in February 2025, and the ninth, added through the AI Omnibus, takes effect in December 2026.
The calendar
According to the Commission the regulation entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions. Prohibited practices and AI literacy obligations apply from 2 February 2025. Governance rules and obligations for general-purpose AI (GPAI) models from 2 August 2025. Rules for high-risk systems in certain areas, such as biometrics, critical infrastructure, education and employment, apply from 2 December 2027, and for systems embedded in regulated products from 2 August 2028. These shifts result from the AI Omnibus, a simplification adopted in 2026. The transparency rules start to work in August 2026, and I write about their practical effect in the article AI Act: content transparency.
- 01August 2024The regulation enters into force.
- 02February 2025Prohibitions and AI literacy.
- 03August 2025Governance and GPAI obligations.
- 04August 2026General application, transparency.
- 05December 2027High risk: selected areas.
- 06August 2028High risk: regulated products.
Obligations for high-risk systems
For high-risk systems the Commission lists strict obligations before being placed on the market: adequate risk assessment and mitigation systems, high-quality datasets to minimise the risk of discriminatory outcomes, logging of activity for traceability of results, detailed documentation for authorities, clear information to the deployer, appropriate human oversight and a high level of robustness, cybersecurity and accuracy. Once a system is on the market, authorities handle market surveillance, deployers ensure human oversight and monitoring, and providers run post-market monitoring. Serious incidents and malfunctions are reported to the relevant authorities.
What follows for a small business
The first practical tip: check which level your uses belong to. A tool for drafts and summaries will usually land in minimal risk, a chatbot for customers in transparency, and a recruitment tool in high risk. The second: the Commission gives simplifications for small and medium-sized enterprises and small mid-cap companies, for example simplified documentation requirements. The third: keep a register of uses, which I describe in the text NIST AI RMF for small teams, because it eases both risk assessment and answering the authorities’ questions. The fourth: use official sources such as the AI Act Service Desk. You will find all materials in the AI Act and law hub.
Last checked: 20 October 2026. Deadlines have changed before; check current notices. This is not legal advice.