Provider or deployer?
The AI Act separates the provider, who develops an AI system or places it on the market, from the deployer, who uses it in their own business. A company that puts a language model from OpenAI or Anthropic into its customer service is in most cases a deployer, and the heaviest obligations fall on the provider. But a company that builds its own product on top of a model and sells it under its own name can become a provider of that system. That is the first thing to work out, because it decides which rules apply.
Prohibited uses
Some uses are banned outright and have been since 2 February 2025. They include manipulating people in ways that harm them, exploiting vulnerable groups, social scoring, inferring emotions at work or in schools except for medical or safety reasons, and untargeted scraping of facial images. Systems that generate non-consensual intimate images or child sexual abuse material were added to the list in 2026, with the ban applying from 2 December 2026. Ordinary business use of chatbots and writing tools is far from these lines, but it is worth checking once.
Transparency: tell people when it is AI
From 2 August 2026, people have to be told when they are talking to an AI system, unless it is obvious. A chatbot on a website should therefore say that it is a chatbot. AI-generated images, audio and video that could be mistaken for real, so-called deepfakes, must be labelled, and text published to inform the public on matters of public interest must say that it is AI-generated unless a person has reviewed it and taken editorial responsibility. Providers must also mark AI-generated content in a machine-readable way; for systems already on the market before 2 August 2026 that marking requirement applies from 2 December 2026.
When AI counts as high risk
High-risk systems are those used in areas listed in the Act, such as recruitment and staff management, credit scoring, education, essential services and critical infrastructure, and AI that is part of regulated products. They carry the heaviest rules: risk management, data quality, logging, human oversight, and for deployers a duty to use the system as instructed, monitor it and keep logs. After the changes adopted in 2026, the rules for these stand-alone systems apply from 2 December 2027, and for AI built into regulated products from 2 August 2028. A company that screens job applications with AI should start preparing now.
AI literacy among staff
Since 2 February 2025, both providers and deployers have to take measures so that the people who work with AI systems understand them well enough: what the tools can do, where they go wrong and what must not be put into them. The wording was softened in 2026 and no certificate or set level is required, but the obligation remains. In practice it means short training, written guidelines for which tools may be used for what, and someone who answers questions.
A short checklist
List the AI tools the company uses, including the ones staff have started using themselves. Decide for each one whether you are a provider or a deployer. Check that nothing touches the prohibited uses. Make sure chatbots and AI-generated content are labelled from August 2026. Find out whether any use is high risk, such as recruitment or credit, and plan for 2027. Write down how staff should use AI, and give them basic training. A review of your AI initiative covers these steps together with costs and data.
This is an overview, not legal advice
This guide describes the main lines of Regulation (EU) 2024/1689 as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, as of October 2026. The details depend on how a system is used, and guidelines from the European Commission and national authorities keep coming. The European Commission's AI Act pages and the text on EUR-Lex are the source; for a specific case, talk to a lawyer who knows the regulation.