What is the EU AI Act?

EU AI Act: definition and purpose

The EU AI Act has been in force since August 1, 2024 and applies directly in all member states. It is meant to enable innovation while protecting fundamental rights, safety and trust. Unlike the GDPR, it is not tied to personal data but to the use of AI systems and their risk.

The obligations apply in stages: bans and the AI literacy obligation since February 2, 2025, rules for general-purpose AI models since August 2, 2025 and most of the remaining provisions from August 2, 2026; further deadlines follow for high-risk systems in products. For individual obligations there are transitional rules and proposed amendments, so the current status should be checked.

Risk levels and roles

The regulation distinguishes four levels. Unacceptable risks are banned, such as social scoring or manipulative systems. High-risk systems, for example for recruitment, creditworthiness assessment or education, are subject to strict requirements. Transparency obligations apply to systems such as chatbots. Most other applications with minimal risk remain largely free.

The role matters: providers develop an AI system or place it on the market under their own name; deployers use it under their own responsibility. Most mid-sized companies are deployers. Anyone who substantially modifies a system or offers it under their own brand can, however, become a provider themselves.

Real-world example: a supplier reviews its AI use

A supplier with several hundred employees uses three AI applications: a chatbot in customer service, a text assistant for internal documents and a tool that pre-sorts job applications. The chatbot needs a notice that users are talking to an AI. The text assistant is uncritical but requires trained staff.

The applicant pre-screening probably falls into the high-risk category. The company must use it according to the instructions, ensure human oversight, keep logs and inform employees. Many companies deliberately choose human pre-screening or a vetted provider here. What matters is to justify the classification properly and to record who in the company is responsible for use and oversight.

What companies should check now

Begin with an inventory of all AI applications, including functions in purchased software. Assign each one a risk level and a role, name responsible persons, train employees and document the result. For prohibited practices, fines of up to €35 million or 7 percent of worldwide annual turnover are possible.

Nano Concepts helps with the technical inventory, with transparency notices and with logging in AI applications. You should clarify the legal assessment in an individual case with a lawyer so that classification and obligations fit your specific use. This article does not replace legal advice.

• Record all AI systems in use and assign each a risk level
• Clarify the role: provider or deployer
• Train employees and document AI literacy
• Plan transparency notices for chatbots and AI content
• Ask providers about conformity and documentation