The EU AI Act is the world's first broad law for artificial intelligence, and if you build, sell, or simply use AI in the European market, it applies to you. The good news: for most businesses the obligations are lighter than the headlines suggest. The catch: the ones that do apply are specific, and the enforcement timeline is moving. This is a plain-language guide to what matters in 2026 and how to get ahead of it.
What the AI Act actually regulates
The Act is a product-safety-style regulation, not a data-privacy law. Where GDPR governs personal data, the AI Act governs the AI system itself: how it's designed, documented, and overseen. It also has a wide reach: it applies to providers who develop AI systems and to deployers who put them to use inside the EU, even when the underlying model was built elsewhere. In other words, "we just use a tool a vendor built" does not automatically put you outside its scope.
The four risk tiers
Everything in the Act hangs off a simple idea: the higher the risk to people, the heavier the rules. There are four levels.
| Tier | What it covers | Your duty |
|---|---|---|
| Unacceptable | Practices like social scoring or manipulative systems | Banned outright |
| High-risk | AI in areas like hiring, credit, medical devices, critical infrastructure | Heaviest obligations |
| Limited-risk | Chatbots, AI-generated content, emotion or deepfake tools | Transparency duties |
| Minimal-risk | Spam filters, most productivity and analytics tools | No specific obligations |
The practical takeaway: most everyday business AI sits in the limited or minimal tiers. You climb into high-risk mainly when your system helps decide something consequential about a person: who gets hired, who gets a loan, who gets a diagnosis.
Transparency: the rule most businesses will feel first
Even outside high-risk, the Act expects honesty about AI. If customers interact with a chatbot, they should be able to tell they're talking to a machine. AI-generated images, audio, and video are expected to be labelled or machine-marked as artificial. And if you use an AI system to make or support decisions about people, they should know it's in the loop. None of this is onerous (it's mostly clear disclosure and a little UX work), but it's the obligation the widest range of companies will touch, and it's worth building in now rather than bolting on later. In practice this is often a single line of disclosure and a labelled output, but it should be deliberate and consistent rather than buried in terms nobody reads.
The high-risk timeline is shifting
Here's where 2026 gets genuinely current. The Act entered into force in August 2024 and phased in over time: bans on prohibited practices and AI-literacy duties from early 2025, and general-purpose AI model obligations from August 2025. Transparency obligations were slated for August 2026. But the heaviest high-risk requirements are being reworked and deferred under a proposal often called the "AI Omnibus," which would push several high-risk obligations out by roughly a year or more to give organisations and standards bodies time to catch up.
Not legal advice, and the dates are moving. The high-risk timeline is being amended at EU level as of this writing, so treat specific deadlines as provisional and confirm the current position for your exact use case with qualified counsel before you rely on it. The direction of travel is clear even if the calendar isn't: the obligations are coming, and preparation is cheaper than a scramble.
General-purpose AI and your vendors
If your product is built on a large foundation model (the kind behind most chat and copilot features), obligations for those general-purpose AI (GPAI) models fall largely on the model provider, not on you. That's mostly good news. But it makes vendor diligence part of your compliance: ask providers whether they publish the technical documentation, training-data summaries, and usage policies the Act expects, because their compliance posture becomes part of yours. When you design secure AI systems, treat "is this vendor AI-Act-ready?" as a standard procurement question.
It's also worth separating obligation from good practice. Even where the Act doesn't strictly require it, keeping a simple record of which AI tools you use, what each one does, and who owns it makes every future compliance question (this regulation and the next) far easier to answer. Governance you build once tends to pay off repeatedly.
A practical readiness checklist
- Inventory your AI. List every AI system you build or deploy and note what each one decides or influences.
- Classify each by risk tier. Most will be minimal or limited; flag anything touching hiring, credit, safety, or health for a closer look.
- Turn on transparency. Label chatbots and AI-generated content, and disclose AI involvement in decisions about people.
- Build AI literacy. Make sure staff who use these tools understand their limits, a duty that already applies.
- Vet your vendors. Confirm foundation-model and tool providers meet their own obligations.
- Keep records. Documentation and human-oversight habits are far cheaper to maintain than to reconstruct.
For regulated sectors the bar is higher: if you build clinical tools, see our companion piece on the EU AI Act for medical device software, where high-risk rules and MDR obligations overlap.
Deploying AI and unsure where you land? Neurova AI builds AI systems with transparency, oversight, and documentation designed in from the start. Book a call and we'll map your tools to the risk tiers.
Frequently asked questions
Does the EU AI Act apply to my business if I only use AI tools? Often yes. The Act regulates both providers who build AI systems and deployers who use them. If you deploy an AI system in the EU (even a third-party one) you can carry obligations such as human oversight, transparency to users, and using the system in line with its instructions. Duties scale with the system's risk level.
What are the EU AI Act risk tiers? There are four: unacceptable-risk practices that are banned, high-risk systems with the heaviest obligations, limited-risk systems subject mainly to transparency duties (for example labelling chatbots and AI-generated content), and minimal-risk systems with no specific obligations. Most everyday business tools fall into the limited or minimal tiers.
When do the EU AI Act deadlines take effect? Bans on prohibited practices and AI-literacy duties applied from February 2025, and general-purpose AI model obligations from August 2025. Transparency obligations were set for August 2026, but the high-risk timeline is being revised under the proposed AI Omnibus, which would defer several high-risk obligations. Confirm the current dates for your use case before relying on them.