The world's first comprehensive AI law, explained for businesses.
The European Union (EU) Artificial Intelligence Act, Regulation (EU) 2024/1689, sets rules for AI based on how much risk it poses to people's health, safety, and fundamental rights.[1] It entered into force on August 1, 2024, and applies in stages through 2030. In 2026, the “Digital Omnibus,” Regulation (EU) 2026/1744, delayed the high-risk rules and simplified some obligations for smaller companies.[2][3]
Does the EU AI Act apply to a U.S. business?
Possibly, even if you have no office in Europe. Like the General Data Protection Regulation (GDPR), the Act reaches outside the EU.[1]
| Your role | What it means | Applies when |
|---|---|---|
| Provider | You develop an AI system or model, or have one developed, and sell or release it under your name | You place it on the EU market, or its output is used in the EU |
| Deployer | You use an AI system in your business (most SMBs) | You are in the EU, or the AI's output is used in the EU |
| Importer or distributor | You bring AI products made by others into the EU market or resell them | You make them available in the EU |
Exemptions include purely personal use, military and national security uses, and scientific research. General information, not legal advice.
Four risk tiers.
| Tier | Examples | Obligations |
|---|---|---|
| Unacceptable | Social scoring, manipulative AI, emotion recognition at work or school | Prohibited |
| High risk | AI used in hiring, credit scoring, insurance pricing, education, critical infrastructure, or as a safety component of regulated products | Risk management, data quality, documentation, human oversight, accuracy, cybersecurity, registration |
| Limited risk | Chatbots, AI-generated images, audio, video, and text, deepfakes | Tell people they are dealing with AI; label synthetic content |
| Minimal risk | Spam filters, AI in productivity tools, recommendation features | No new legal duties; AI literacy measures and voluntary codes encouraged |
When each part applies (as amended in 2026).
| Date | What applies |
|---|---|
| August 1, 2024 | The Act enters into force |
| February 2, 2025 | Prohibited practices banned; AI literacy duty begins |
| August 2, 2025 | Rules for general-purpose AI models; governance and penalty provisions |
| August 2, 2026 | Transparency duties (Article 50) for new AI systems; most remaining provisions |
| July 27, 2026 | Digital Omnibus (Regulation (EU) 2026/1744) enters into force[2] |
| December 2, 2026 | New bans on AI that generates non-consensual intimate images or child sexual abuse material; Article 50(2) labeling for generative AI already on the market before August 2, 2026 |
| December 2, 2027 | High-risk obligations for Annex III uses (such as hiring, credit, education) |
| August 2, 2028 | High-risk obligations for AI in products covered by EU product-safety law (Annex I) |
| August 2, 2030 | High-risk AI used by public authorities |
Prohibited AI practices.
- Manipulative or deceptive techniques that materially distort behavior and cause significant harm
- Exploiting vulnerabilities due to age, disability, or social or economic situation
- Social scoring that leads to unjustified or unfavorable treatment
- Predicting criminal behavior based only on profiling or personality traits
- Building facial recognition databases by untargeted scraping of images from the internet or video surveillance
- Emotion recognition in workplaces and schools, except for medical or safety reasons
- Biometric categorization to infer sensitive personal traits protected under EU law
- Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions
- From December 2, 2026: AI that generates non-consensual intimate images or child sexual abuse material[2]
High-risk AI: where it applies and what is required.
Annex III high-risk areas
- Biometrics
- Critical infrastructure (energy, water, transport, digital infrastructure)
- Education and vocational training
- Employment, hiring, and worker management
- Access to essential services, including credit scoring and life and health insurance pricing
- Law enforcement, migration, and border control
- Administration of justice and democratic processes
Provider duties (if you build it)
- Risk management system and quality management system
- Data governance for training and test data
- Technical documentation and automatic logging
- Transparency and instructions for deployers
- Human oversight by design
- Accuracy, robustness, and cybersecurity
- Conformity assessment, CE marking, and EU database registration
- Post-market monitoring and serious-incident reporting
Deployer duties (if you use it), Article 26
- Use the system according to the provider's instructions
- Assign human oversight to people with the necessary competence, training, and authority
- Make sure input data you control is relevant and representative
- Monitor operation, report serious incidents, and keep automatically generated logs for at least six months
- Inform workers and their representatives before using high-risk AI in the workplace
- Inform people when high-risk AI is used to make or help make decisions about them
- Public bodies, and private companies using AI for credit scoring or life and health insurance pricing, must complete a fundamental rights impact assessment (Article 27)
The 2026 Digital Omnibus narrowed some high-risk classifications and introduced simplified documentation and quality-management options for small and medium-sized enterprises (SMEs) and small mid-caps.[2]
Transparency duties that affect almost every business using AI.
- Chatbots and AI agents: people must be told they are interacting with AI, unless it is obvious.
- AI-generated content: providers of generative AI must mark audio, image, video, and text output in a machine-readable way so it can be detected as AI-generated.
- Deepfakes: deployers must disclose that image, audio, or video content has been artificially generated or manipulated.
- AI-generated text on matters of public interest: must be disclosed unless it has been reviewed by a human who takes editorial responsibility.
- Emotion recognition and biometric categorization: people exposed to these systems must be informed.
Rules for general-purpose AI models.
Providers of general-purpose AI models, such as the large language models behind popular chatbots, must keep technical documentation, give information to companies that build on their models, have a copyright compliance policy, and publish a summary of training content. Models with “systemic risk” face extra duties, including evaluations, adversarial testing, incident reporting, and cybersecurity protections. These rules have applied since August 2, 2025, and are supervised by the European AI Office.[5] Most SMBs are users, not providers, of these models.
Penalties.
| Violation | Maximum fine |
|---|---|
| Prohibited AI practices | Up to €35 million or 7% of worldwide annual turnover, whichever is higher |
| Most other obligations, including high-risk and transparency duties | Up to €15 million or 3% of worldwide annual turnover, whichever is higher |
| Supplying incorrect or misleading information to authorities | Up to €7.5 million or 1% of worldwide annual turnover, whichever is higher |
For SMEs, including start-ups, each fine is capped at whichever amount is lower; the 2026 amendments extended this to small mid-caps.[4][2]
Seven practical steps for SMBs.
1. Inventory your AI
List every AI tool, feature, and agent your business uses or sells, including those built into other software.
2. Check your EU exposure
Do you sell to, serve, or produce AI output used by people in the EU?
3. Classify each use
Prohibited, high-risk, limited, or minimal. Pay close attention to hiring, credit, insurance, and education uses.
4. Stop anything prohibited
Especially emotion recognition of employees and manipulative design.
5. Add transparency
Label chatbots, AI-generated content, and deepfakes, and update customer notices.
6. Train your people
Document AI literacy measures for staff who use or oversee AI.
7. Use the extra time wisely
High-risk rules start in December 2027. Build governance now with the National Institute of Standards and Technology (NIST) AI Risk Management Framework and International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 42001, which map well to the Act.
References
Sources cited on this page (last reviewed October 31, 2026)
- Official Journal of the EU, Regulation (EU) 2024/1689 (Artificial Intelligence Act).
- Future of Life Institute, Digital Omnibus on AI: AI Act Explorer.
- Orrick, EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes, July 2026.
- Future of Life Institute, Article 99: Penalties.
- European Commission, European AI Office.
General information, not legal advice. Related: AI rules in other countries · Regulatory Watch · AI privacy and regulations