Executive guide · Updated 12 October 2026 · 10 min read
EU AI Act (AI Regulation): what applies to you and when
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689, also called the AI Regulation) applies in stages from February 2025 to August 2028, with a timeline amended in July 2026 by Regulation (EU) 2026/1744. Most SMEs still do not know whether it applies to them, at what level, or what they need to do. This guide explains it in plain language, with the dates exactly as they appear in the Official Journal of the EU, and an actionable roadmap.
Content reviewed on
In short
The AI Act is the European Union regulation that governs the development and use of artificial intelligence systems according to their level of risk. It entered into force on 1 August 2024 and applies in stages: prohibited practices and AI literacy from 2 February 2025; general-purpose AI models, governance and fines from 2 August 2025; general application, including transparency, from 2 August 2026; and, after Regulation (EU) 2026/1744, high-risk obligations from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Dates read on EUR-Lex on 29 September 2026 (Regulations (EU) 2024/1689 and 2026/1744).
Important: This guide is educational and indicative information. It is not individual legal advice or a conformity assessment. For a specific case, consult a specialised law firm.
What is the AI Act and who does it apply to
The AI Act (Regulation (EU) 2024/1689, also called the AI Regulation) is the first comprehensive law on artificial intelligence in the world. It was published in the Official Journal on 12 July 2024, entered into force on 1 August 2024 and applies progressively until August 2028. In July 2026, Regulation (EU) 2026/1744 (the "Digital Omnibus on AI") postponed the high-risk obligations and added two prohibited practices.
It applies to any company that develops, commercialises or uses AI systems within the European Union, including non-EU providers if their AI output is used inside the EU. Company size doesn't matter: a 20-employee SME is equally obligated as a multinational.
What changes by size and sector is the *level* of obligations: prohibited practices are forbidden for everyone; strict obligations only apply to AI systems classified as high-risk; most everyday uses (chatbots, ChatGPT) only have transparency obligations.
The 4 risk levels
The AI Act classifies systems by risk level. Knowing where you stand is the first step.
Level 1 · Prohibited
Prohibited practices (Art. 5)
AI systems banned for being incompatible with fundamental rights. Cannot be commercialised or used in the EU under any circumstance.
Examples: Mass facial recognition in public spaces, social scoring, emotion inference at the workplace, subliminal manipulation.
Level 2 · High risk
High-risk systems (Annex III)
Systems that significantly affect fundamental rights or safety. Permitted but with strict obligations: risk management, technical documentation, human oversight, CE marking.
Examples: AI for personnel selection, credit scoring, medical diagnosis, student assessment, critical infrastructure management.
Level 3 · Limited risk
Transparency obligations
Systems with low risk but requiring users to know they're interacting with AI or seeing artificially generated content.
Examples: Customer service chatbots, image generators, deepfakes (labelled), conversational assistants.
Level 4 · Minimal risk
No specific obligations
The majority of everyday AI uses. No binding obligations, but voluntary good practices are recommended.
Examples: Spam filters, product recommendations, search engines, automatic translation, grammar correction.
Application timeline 2024-2028
The AI Act does not apply all at once: it entered into force in 2024 and its obligations apply in stages, with the timeline amended in July 2026 and some transitional regimes. These are the main dates as published in the Official Journal.
1 August 2024
Entry into force
Regulation (EU) 2024/1689 enters into force twenty days after its publication in the Official Journal (12 July 2024). The transitional period begins: most obligations do not apply yet.
2 February 2025
Prohibited practices and AI literacy
Chapters I and II apply: the Article 5 prohibitions and Article 4 AI literacy. Since the July 2026 reform, Article 4 asks for tailored measures that support the AI literacy of staff and of anyone using the systems on the organisation's behalf, without setting a specific individual level.
2 August 2025
General-purpose AI models, governance and fines
Chapter V obligations apply to providers of general-purpose AI models (documentation, information for those who integrate them, copyright policy), with additional obligations for models with systemic risk. Models already on the market have until 2 August 2027 to comply. Governance (AI Office, national authorities) and the Article 99 penalty regime also apply; Article 101 fines on general-purpose model providers apply from August 2026.
27 July 2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI) enters into force
Published in the Official Journal on 24 July 2026, it postpones the high-risk obligations, adds two prohibited practices, grants a transitional period for marking AI-generated content and applies Articles 102 to 110 (adaptation of other EU laws) from this day.
2 August 2026
General application of the Regulation
General date of application, including Article 50 and Article 101 fines. Transparency splits the duties: providers must disclose that people are talking to an AI and mark synthetic content; deployers must, among other cases, disclose deepfakes. Generative systems already on the market have a special deadline for marking. High-risk obligations have later dates.
2 December 2026
New prohibitions and end of the marking grace period
Two prohibited practices added to Article 5 apply, with their conditions: systems that generate or manipulate realistic intimate or sexually explicit depictions of an identifiable person without consent, and child sexual abuse material. The special deadline for Article 50.2 marking also ends for generative systems placed on the market before 2 August 2026.
2 December 2027
Annex III high risk
High-risk obligations apply to Annex III systems: certain uses in employment, education, creditworthiness of natural persons, essential services and other areas, with exceptions. Providers meet requirements such as risk management and technical documentation; deployers have the Article 26 obligations (human oversight, monitoring, logs).
2 August 2028
Annex I high risk
High-risk obligations apply to Article 6.1 systems linked to regulated Annex I products such as toys, lifts or medical devices. After the reform, machinery moves to its own sectoral regime (Annex I, Section B).
What applies to your sector
Five typical SME cases and how the AI Act affects them.
HR consultancy / agency
High risk (Annex III, point 4)
If you use AI to filter CVs, evaluate candidates, decide promotions or terminations, your system is high-risk. You must ensure absence of discriminatory biases, transparency in automated decisions, and effective human oversight. Enforceable from 2 December 2027.
Private medical centre
High risk (Annex III, point 9)
If you use AI for diagnosis, clinical decision support or triage, high risk. In addition to the AI Act, the Medical Device Regulation (MDR) applies. Specific CE certification and system registration required.
Tax firm or financial advisor
High risk (Annex III, point 5)
If you do credit scoring or automated solvency assessments, high risk. Decisions must include intelligible explanations to the client (right not to be subject to purely automated decisions, also GDPR).
Training academy or institution
High risk (Annex III, point 3)
If you use AI to evaluate students, decide admissions or detect cheating, high risk. You must ensure the AI doesn't introduce biases against vulnerable groups and allows human review.
Marketing agency
Limited or minimal risk
Typical uses (ChatGPT for copy, image generators, predictive campaign analysis) are limited or minimal risk. Required: label deepfakes/generated content, comply with GDPR for client data, train the team in AI literacy.
Roadmap to compliance
Five practical steps to start today.
- 01
1. Inventory
Identify all AI systems your company uses or offers, including those embedded in third-party tools.
- 02
2. Classify
Determine each system's risk level according to Annex III and Art. 5. Document the classification.
- 03
3. Document
For high-risk systems, prepare technical documentation, automatic logs, and risk management procedures.
- 04
4. Train
Ensure staff AI literacy (mandatory from Feb 2025). Formal courses or internal sessions both work.
- 05
5. Govern
Designate an AI compliance lead, set up periodic reviews, and cooperate with authorities if needed.
Frequently asked questions about the EU AI Act
When does the EU AI Act come into force?
It entered into force on 1 August 2024, but it applies in stages: prohibited practices and AI literacy from 2 February 2025; general-purpose AI models, governance and fines from 2 August 2025; general application from 2 August 2026; Annex III high risk from 2 December 2027 and Annex I from 2 August 2028, as amended by Regulation (EU) 2026/1744.
Which regulation governs artificial intelligence in Europe?
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, published in the Official Journal on 12 July 2024. It applies directly in all 27 Member States, with no national law needed to transpose it. In July 2026, Regulation (EU) 2026/1744 amended its timeline and several articles.
Is the AI Act a regulation, a directive or a law?
It is an EU regulation, which is why its legal name is Regulation (EU) 2024/1689. "AI Act" is the short name used by the EU institutions and the press. Unlike a directive, a regulation applies directly in every Member State without national transposition.
What are the rules for using AI under the Regulation?
They depend on the level of risk. Some practices are prohibited (subliminal manipulation, social scoring, emotion recognition at work, non-consensual sexual deepfakes). High-risk systems (recruitment, credit, education, healthcare) carry obligations of risk management, documentation, human oversight and logging. Limited-risk systems carry transparency obligations: telling people they are talking to an AI and marking generated content. The rest has no specific obligations beyond the AI literacy measures of Article 4.
Who regulates and supervises AI in Europe and in Spain?
In the EU, the European AI Office (within the European Commission) supervises general-purpose AI models and coordinates the application of the Regulation with the Member States. In Spain, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), based in A Coruña, is the authority designated for market surveillance and the contact point with the EU, alongside sectoral authorities such as the data protection authority (AEPD).
What does an SME that only uses ChatGPT, Copilot, Claude or Gemini have to do?
In most cases, using an AI assistant to write, summarise or analyse documents is minimal or limited risk: take AI literacy measures for the staff who use it (Article 4, applicable since 2 February 2025), tell people when they are interacting with an AI and mark generated content that could be mistaken for real (Article 50), and respect the GDPR with the data you enter. If AI is used to make decisions about people (hiring, assessment, credit), it may be high risk and the obligations change.
What fines does the EU AI Act provide for?
Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for breaching other obligations; and up to EUR 7.5 million or 1% for giving inaccurate information to the authorities. For SMEs and start-ups the lower of the two amounts applies (Article 99). The fines regime applies from 2 August 2025, and for general-purpose AI providers from 2 August 2026.
Sources
The texts we read to write this guide. When in doubt, the regulation prevails.
Want to know exactly what applies to you?
Take the interactive 5-minute diagnostic or talk to IAescola about your specific case.