(noun, EU law)Regulation (EU) 2024/1689
The world's first comprehensive law on artificial intelligence. It regulates AI by what you use it for, not by how clever the technology is: the riskier the use, the stricter the rules.
Already in force, arriving in waves, and written for those who build AI and those who merely use it.
Same family GDPR, CE marking, product safety law. Same logic, new subject.
One law, sorted by risk
Most technology laws regulate the thing. The AI Act regulates the situation: the same model that drafts your newsletter, unregulated, becomes high-risk the moment it starts screening job applications. What counts is what the system is used for, on whom, and what happens to them.
Everything else in the Act follows from that one move. Every use of AI lands in one of four tiers, and each tier carries its own rulebook: from nothing at all, to a duty of honesty, to heavy paperwork, to an outright ban.
It covers you, probably
The Act sorts everyone around an AI system into roles. Two matter for most companies. The provider builds or sells the system and carries the heavy duties. The deployer uses it at work and carries fewer, but real ones: use the system as instructed, keep a human meaningfully in charge, train the people who run it.
And the law reaches beyond the union: it follows the output. A tool built elsewhere, whose results are used in Europe, is covered. "We are not an EU company" is not an exemption. Ask anyone who met the GDPR.
also covered: importers and distributors, and anyone whose system's output is used in the EU
From banned to barely touched
Find your use case in this row and you know most of what the law wants from you. The tier follows the use, not the vendor's marketing.
Unacceptable
Uses the EU decided no safeguard can fix: social scoring, manipulation that causes harm, emotion recognition at work or school, scraping faces off the internet.
illegal since 2 Feb 2025High-risk
AI deciding over lives and livelihoods: hiring, credit, exams, medical devices, infrastructure. Allowed, but under the full rulebook, tested and documented.
applies 2 Dec 2027 / 2 Aug 2028Transparency
AI a person might mistake for a human, or content that might pass as real: chatbots, deepfakes, synthetic media. The duty is honesty: say so, label it.
applies 2 Aug 2026Minimal
Spam filters, recommendations, AI in games, your drafting assistant. The vast majority of systems. No new obligations beyond the laws that always applied.
no AI Act dutiesThe same model can sit in three tiers in the same week. It is never "is this AI regulated", always "is this use regulated".
Eight practices are simply off the table
The prohibited tier is short, specific, and already law, since 2 February 2025. No conformity assessment, no consent checkbox, no contract clause makes these legal.
added May 2026, compliance by 2 Dec 2026
If the use is on this list, the paperwork question never arises. It is simply illegal.
A few narrow exceptions exist, mostly medical, safety and tightly-fenced law enforcement cases. If you think you are the exception, that is precisely when to bring a lawyer.
Where the rulebook gets heavy
High-risk does not mean scary technology. It means consequential decisions about people: who gets the job, the loan, the diploma, the visa, the treatment. The Act lists the territory in two annexes: standalone systems in sensitive areas, and AI inside products that already need a CE mark.
standalone uses (Annex III)
AI inside regulated products (Annex I)
Providers of these systems owe the full program: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, then a conformity assessment, a CE mark, and registration in the EU database, before the system reaches the market.
Deployers owe a working version: follow the instructions for use, assign trained human oversight, monitor the system in operation, and tell the people it affects. Public bodies, banks and insurers add a fundamental-rights impact assessment.
From August 2026, AI stops passing as human
The transparency tier is the deadline that touches almost everyone, because almost everyone now ships a chatbot or publishes generated content. From 2 August 2026: a chatbot must say it is one. A deepfake must be labeled as synthetic. AI-generated audio, image and video must carry a machine-readable mark, so tools and platforms can recognize it.
The duty is light, and that is the point: not less AI, just honest AI.
If a person could reasonably mistake it for the real thing, they have a right to know it is not.
Systems already on the market before 2 August 2026 get a grace period on the machine-readable marking, until 2 December 2026. The disclosure duties themselves are not postponed.
Two waves have landed. The next hits in weeks.
The Act entered into force on 1 August 2024 and applies in stages. The bans and the AI-literacy duty are live. The model rules are live. The honesty rules arrive in August 2026, the high-risk program in 2027 and 2028.
Dates updated 7 May 2026: the EU's "Digital Omnibus" agreement moved the high-risk deadlines from 2026/2027 to December 2027 and August 2028, and added the new ban. Formal adoption is expected before August 2026; the new dates bind once published in the Official Journal.
What ignoring it costs
Fixed sum or share of global annual turnover, whichever is higher. For small and medium companies, the lower of the two applies. National authorities enforce most of it; the Commission's AI Office watches the general-purpose models. The fine schedule has been in place since August 2025.
The quieter cost arrives earlier: procurement questionnaires, due-diligence checklists, enterprise customers asking for your tier. Compliance is becoming a sales document.
Four sentences to retire this year
Users have duties too
Using AI at work makes you a deployer. A lighter rulebook than a builder's, but a rulebook: oversight, instructions, and people who know what the tool can and cannot do.
It sorts by use, not by size
A ten-person firm screening CVs with AI sits in high-risk territory. A tech giant's spam filter sits in minimal. Your size shapes the fine, not the duty.
Two waves already landed
The bans and the AI-literacy duty have applied since February 2025, the model rules since August 2025. The honesty rules arrive in August 2026.
The law follows the output
Sell into Europe, serve European users, or let your system's results be used there, and you are in scope. The GDPR taught everyone this lesson once already.
Six moves, none of them dramatic
For most companies this is not a compliance emergency. It is an afternoon of honesty about where AI already lives in the business, then a habit of keeping that picture current.
Inventory
List every AI system in the building: the ones you built, the ones you bought, the ones inside other tools, and the ones staff use quietly.
Classify
Sort each use against the four tiers. Most land in minimal. The ones touching hiring, money, safety or students deserve a closer look.
Know your role
Provider, deployer, importer or distributor, per system. The duties follow the role, and one company can hold several at once.
Train your people
The AI-literacy duty already applies. Whoever runs or oversees an AI system should understand what it does, what it gets wrong, and when to overrule it.
Ask your vendors
Which tier, what documentation, who carries the provider duties. Buying AI does not transfer the deployer's share of the responsibility.
Write it down
An AI policy, a named owner, and a record of the above. When a customer or an authority asks, the answer should already exist.
This page is orientation, not legal advice. If your inventory turns up high-risk territory, bring counsel.
eu-ai-act:~$want a second pair of eyes on your AI map?
MethodKit helps teams get onto the same page about how they actually work, including the AI now woven into it. The inventory, the tiers, the roles: it is a mapping exercise, and mapping is what we do. Leave your email below and the conversation starts.
prefer email? ola@methodkit.com