The EU AI Act for companies: what to do now, in plain language.

What the AI Act is

The EU AI Act (Regulation (EU) 2024/1689) is a product-safety style regulation for artificial intelligence. It does not regulate AI as a technology; it regulates specific uses according to the risk they pose to people's health, safety and fundamental rights. Most uses carry few or no specific obligations. A defined set of practices is prohibited, another set is classified as high-risk with substantial duties, and some uses trigger transparency duties. As an EU regulation it applies directly in every member state, with national authorities responsible for supervision and enforcement.

Who it applies to: providers, deployers and non-EU companies

The regulation defines several roles, but two matter for most companies. A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority in a professional context. The software company selling a recruiting tool with an AI ranking feature is a provider; the Mittelstand company using that tool to screen applicants is a deployer. Deployers have fewer duties than providers, but they are not exempt.

Two points surprise many companies. First, the regulation applies to companies outside the EU when they place AI systems on the EU market or when the output of their system is used in the EU, so a Swiss or US company serving EU customers is in scope. Second, a deployer can become a provider: if you put your own brand on a high-risk system, substantially modify it or change its intended purpose so that it becomes high-risk, the provider obligations move to you. Building your own AI agents does not automatically make you a provider, but you cannot point to a vendor for the system's behaviour.

The risk tiers, with examples that matter to a normal company

The tier depends on the use, not the technology. The same language model is minimal risk when it drafts marketing copy and high-risk when it ranks job applicants.

For most companies the practical work sits in the second and third rows: find out whether anything you use touches employment decisions, credit, education or critical infrastructure, and make sure every chatbot and every published AI-generated asset carries the right disclosure.

General-purpose AI models

General-purpose AI models, the large models behind the products of OpenAI, Anthropic, Google, Mistral and others, have their own chapter. The obligations sit mainly with the model providers: technical documentation, information for downstream developers, a copyright policy, a summary of training content, and additional duties for models with systemic risk. These have applied since August 2025.

For a company building agents or products on such a model, the consequence is indirect but real: you rely on the provider's documentation for your own duties and remain responsible for the system you build. Ask vendors for their AI Act documentation.

The AI literacy duty applies to every organisation

Article 4 is the part of the regulation most companies overlook. Since February 2025, providers and deployers must ensure a sufficient level of AI literacy among their staff and other people who operate or use AI systems on their behalf. The required level depends on the person's role, technical knowledge and the context in which the system is used, including the people it affects.

There is no prescribed certificate, and the duty is proportionate: an accountant who uses an AI assistant for drafting needs different training from the HR team that operates a screening tool. What you need is a role-based training concept, evidence that it was delivered and a way to keep it current. Our AI training formats are built around this duty, from a leadership briefing to hands-on sessions for teams that work with agents every day.

The timeline

At the time of writing, proposals to postpone parts of the high-risk obligations have been under discussion at EU level. Treat the 2026 and 2027 dates as the original schedule, not as settled, and check the current status before you plan your compliance work against them. What is not in question: the prohibitions, the literacy duty and the general-purpose model rules already apply.

How the AI Act and the GDPR fit together

The GDPR applies whenever personal data is processed, regardless of the AI Act tier. In practice the two overlap on the same questions: is there a legal basis for the data, are people informed, is a data protection impact assessment needed, and are decisions with legal or similarly significant effects made solely by a machine. The AI Act adds the product view: is the system documented, tested, overseen and logged.

For companies in Germany a third layer matters: the works council has co-determination rights for technical systems that can monitor performance or behaviour, which covers many AI tools. The efficient approach is one intake process for every new AI use that answers the GDPR, AI Act and co-determination questions together, rather than three separate reviews that arrive in the wrong order.

A seven-step action plan for a typical company

1. Inventory. List every AI system in use, including features inside SaaS products, employees' own tool use and internal agents. Record purpose, vendor, data involved, who uses it and who is affected.
2. Classify. For each entry, decide your role (provider or deployer) and the risk tier. Flag anything that touches employment, credit, education, biometrics or critical infrastructure for a closer look, and identify every chatbot and generated-content use for transparency duties.
3. Write an AI policy. Acceptable use, prohibited uses, how new use cases are requested and approved, who owns AI governance. Keep it to a few pages that people will actually read.
4. Train by role. Deliver AI literacy training proportionate to each role, document attendance and content, and repeat when systems or rules change.
5. Fix the vendor contracts. Ask for AI Act documentation, model information, data processing terms and notification of material changes. Clarify who is the provider of what.
6. Design human oversight. For every use that decides or acts, define who oversees it, what they can see, what authority they have to intervene and how their decisions are logged. Our guide on guardrails for AI agents covers the technical side.
7. Document and monitor. Maintain the inventory as a living register, keep logs, define an incident process and review the whole set on a fixed cadence.

None of this requires a large programme. For a mid-sized company the first pass through all seven steps typically takes a few weeks, and it produces something useful beyond compliance: a clear picture of where AI is already used and where it should be. Our AI governance service runs exactly this process and leaves you with the register, the policy and the oversight design.