THE EUROPEAN UNION ARTIFICIAL INTELLIGENCE ACT (AI ACT) – NEW OBLIGATIONS FOR BUSINESSES

2026.09.14.

The European Union’s Artificial Intelligence Act (“AI Act”) is the world's first comprehensive horizontal regulatory framework governing the development, placing on the market and use of

artificial intelligence systems. The purpose of the Regulation is to promote innovation while ensuring that AI technologies are deployed in a manner that respects fundamental rights, safety

and data protection.

Although the Regulation entered into force on 1 August 2024, its provisions become applicable in stages. The rules concerning prohibited AI practices and AI literacy have applied since 2

February 2025, obligations relating to general-purpose AI (“GPAI”) models have applied since 2 August 2025, while the majority of the remaining provisions become applicable from 2 August 2026.

What Constitutes an AI System?

The scope of the AI Act extends far beyond well-known generative AI tools such as ChatGPT or Microsoft Copilot. The Regulation may apply to any system that generates predictions,

recommendations, decisions or content on the basis of data-driven processing. Examples include image-recognition software, applicant-screening tools used in recruitment

processes, recommendation engines, automated document-processing solutions and AI powered virtual assistants.

The Risk-Based Approach

One of the fundamental concepts of the AI Act is its risk-based regulatory framework. Rather than regulating technologies themselves, the Regulation focuses on the specific use case and

the potential impact of the AI system concerned. As a first step towards compliance, organisations should identify all AI systems used or developed within their operations and determine the applicable risk category. The same technology may fall within different regulatory categories depending on the intended purpose and context of use.

The AI Act distinguishes four principal categories.

Prohibited AI Systems

Certain AI practices are prohibited altogether within the European Union. These include, among others, AI systems that manipulate individuals through harmful techniques, exploit

vulnerabilities, perform social scoring, conduct workplace emotion recognition, or use certain forms of biometric identification.

High-Risk AI Systems

High-risk AI systems are those capable of significantly affecting individuals’ health, safety or fundamental rights.

Such systems may include AI tools used for recruitment, employee selection, performance evaluation, promotion decisions, termination-related assessments, educational evaluation

systems, biometric identification technologies, certain critical infrastructure applications and AI solutions supporting decisions that have a significant impact on individuals. Whether a

system qualifies as high-risk must always be assessed in light of its specific intended purpose.

Limited-Risk AI Systems

For limited-risk AI systems, the AI Act primarily imposes transparency obligations.

Examples include chatbots, virtual assistants, recommendation engines and systems generating text, images, videos, audio recordings or other forms of content. In such cases, users must

generally be informed that they are interacting with an AI system and, where appropriate, that the content has been generated or manipulated through artificial intelligence.

Minimal-Risk AI Systems

Minimal-risk AI applications are generally not subject to extensive compliance obligations under the AI Act. Nevertheless, organisations should continue to consider data protection,

confidentiality, intellectual property and information security requirements when using such systems.

Users and Developers – Different Compliance Obligations

One of the most important features of the AI Act is that it distinguishes between entities developing or placing AI systems on the market (“providers”) and organisations using such

systems within their operations (“deployers”). Each category is subject to different obligations.

Obligations for Businesses Using AI Systems

Businesses using AI systems should first identify which AI tools are being used and for what purposes.

The AI Act already requires organisations to promote AI literacy, meaning that employees operating or supervising AI systems must possess an appropriate understanding of the technology and the associated legal and operational risks.

Where high-risk AI systems are deployed, additional obligations may arise, including:

ensuring effective human oversight;
monitoring the operation of the system;
handling and reporting serious incidents where required;
complying with logging and record-keeping requirements;
providing appropriate information to affected individuals;
carrying out data protection impact assessments in certain circumstances; and
cooperating with competent authorities.

Obligations for Developers and Providers

Businesses developing AI systems or making them available under their own name may be subject to considerably more extensive compliance requirements.

For high-risk AI systems, providers may be required to: establish and maintain a risk management system;

document the quality and origin of the relevant data sets;
prepare detailed technical documentation;
implement logging and traceability mechanisms;
ensure transparency and user information requirements;
provide appropriate human oversight measures;
demonstrate accuracy, robustness and cybersecurity;
maintain incident management procedures; and
prepare various compliance and data protection records and assessments.

Specific rules also apply to general-purpose AI models (GPAI), including large language

models (LLMs) and certain generative AI systems. Providers of such models may be subject to

additional documentation, transparency and copyright-related obligations.

Why Is an Internal AI Policy Important?

The use of AI tools such as ChatGPT, Copilot and similar systems is becoming increasingly

common in everyday business operations. For this reason, organisations should consider

adopting an internal AI policy addressing, among others:

which AI tools may be used;
what data may be uploaded to AI systems;
the protection of confidential information and trade secrets;
review procedures for AI-generated outputs;
circumstances requiring legal, privacy or information security review; and
employee guidance regarding the responsible use of AI technologies.

Sanctions

Non-compliance with the AI Act may result in significant administrative fines.

Violations involving prohibited AI practices may result in fines of up to EUR 35 million or 7% of the undertaking's total worldwide annual turnover, whichever is higher.

Breaches of requirements applicable to high-risk AI systems may result in fines of up to EUR 15 million or 3% of global annual turnover.

Violations relating to certain information and reporting obligations may result in fines of up to EUR 7.5 million or 1% of global annual turnover.

Conclusion

The AI Act is not relevant only to technology companies. Any organisation using artificial intelligence in its business activities may be affected by the new regulatory framework, while

businesses developing or commercialising AI solutions may face extensive documentation and compliance obligations.The first step towards compliance should be the identification of all AI

systems used within the organisation, the determination of their intended purpose and the preparation of an appropriate risk classification. Once this assessment has been completed,

organisations can establish the internal policies, training programmes, transparency measures and compliance procedures necessary for responsible and lawful AI governance.

This summary is intended to raise awareness and does not constitute legal advice.

If you have any questions or need further information in connection with the above, please do

not hesitate to contact us.