The EU AI Act, explained
You've heard of it. Here's how to actually think about it — without the legalese. Two comparisons do most of the work: it's organised like product-safety law (by risk), and it's a close cousin of GDPR (for AI systems instead of personal data).
It's product-safety law for AI.
The Act's whole logic is risk-based. It doesn't regulate "AI" as a technology — it regulates what an AI system is used for. The same model is barely touched inside a spam filter and heavily regulated inside a hiring tool. Obligations scale with the risk of the use, not the cleverness of the tech.
If you've ever seen a CE mark on a product, you've already met this idea — the EU regulates a kettle and a surgical robot very differently, for the same reason.
Everything sorts into four levels of risk.
Most AI sits in the bottom two tiers. The Act spends almost all of its weight on the high-risk band.
…you're already halfway there.
GDPR governs what you do with personal data. The AI Act governs what you do with AI systems. A hiring tool is both — and the two laws share the same instincts.
Where they're alike
On automated decisions, GDPR's Article 22 and the AI Act's Articles 26 & 86 are two doors into the same room — human oversight plus a right to understand the decision. Regulators and courts read this broadly: even an automated score that feeds a human's final call can count.
Where they differ
Like CE-marking, but for AI.
A high-risk AI system is treated much like a regulated product. Two roles, two sets of duties:
Builds it / puts it on the market
- Run a conformity assessment
- Write the technical documentation
- Register it in the EU database
- Monitor it after launch
Uses it in their organisation
- Follow the provider's instructions
- Keep a competent human in control
- Keep logs of what it did
- Report serious incidents
Where the analogy breaks: the AI Act watches systems after launch more closely than classic product law, and it puts fundamental rights — fairness, non-discrimination — squarely in scope. Open-source is no loophole, either: self-host an open model (say, Mistral) for a high-risk use and you're still the deployer, carrying the full duties — and locality is no loophole either (see running your own AI isn't compliance). Most organisations are deployers, not providers: you're using AI someone else built — though configure, rebrand or repurpose it and the Act can flip you into its provider (see deployer or provider?). Your headline duty is already live — AI literacy for the staff who use it (Article 4), in force since February 2025 — meaning staff who can make informed choices about tools and data, not a generic awareness slide. For a worked sector example — easy wins up to high-risk hiring systems — see AI for HR & talent.
It arrives in waves — and one deadline is moving.
- 2 Feb 2025 Live now The banned practices and the AI-literacy duty (Art. 4) took effect.
- 2 Aug 2025 Live now Rules for general-purpose AI models (the large foundational models) began.
- 2 Aug 2026 Next Most of the Act applies: governance, transparency duties and the penalty regime.
- 2 Dec 2027 Moving The heaviest high-risk obligations (Annex III) — originally 2 August 2026, now being deferred to this date by the Digital Omnibus package.
And the teeth: penalties are set as a share of worldwide annual turnover — up to 7% for banned practices, 3% for high-risk failures, 1% for misleading information (GDPR reaches 4%, and the two stack rather than substitute). For most companies, though, the bigger cost is commercial: the deal that stalls, not the fine that lands.
From "does this apply to us?" to evidence.
Knowing the shape of the law is step one. Knowing which of your systems it catches — and what you can show for it — is the work.
Not sure which of your systems the Act catches?
Bring it along. An honest read, no pitch.
Book a discovery call →Related guides
Deployer or provider?
Most companies using AI are “deployers”, with manageable duties. But configure, rebrand or repurpose that AI and the Act can treat you as its “provider” — with a manufacturer’s full obligations. The line, and how not to cross it by accident.
Read the guide HR & TalentAI for HR, talent & L&D
From easy wins to the hiring decisions the AI Act treats as high-risk — and the trap of using a chatbot as a judge.
Read the guide