A recruitment-software company in Toronto has no office in Europe, no European staff and no plans to open either. It does, however, have three customers in Germany who use its tool to rank job applicants. Under the EU AI Act, that is enough. The law reaches AI systems whose output is used in the EU, wherever the company behind them sits – which is why businesses well outside Europe have started reading a regulation many of them assumed was someone else's problem.
This guide explains the EU AI Act for businesses inside and outside the EU: the risk tiers, the main roles and obligations, the timeline, and what to do first. It sticks to what the text of the law establishes. It is not legal advice, and for specific systems you should talk to a lawyer who works in this area.
What the EU AI Act is
The AI Act – formally Regulation (EU) 2024/1689 – is the European Union's horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. As a regulation, it applies directly in all member states without needing national transposition, although each country designates authorities to enforce it.
Its core idea is risk-based: the stricter the potential harm to health, safety or fundamental rights, the heavier the obligations. Most AI systems in use today fall into the lightest category and face few or no new duties.
The four risk tiers of the AI Act
| Tier | What it covers | What it means |
|---|---|---|
| Unacceptable risk | Practices considered a clear threat to rights | Prohibited |
| High risk | AI in sensitive areas or safety components of regulated products | Strict requirements before and after market entry |
| Limited / transparency risk | Chatbots, AI-generated or manipulated content | Disclosure obligations |
| Minimal risk | Spam filters, recommendation of products, most internal tools | No new obligations (voluntary codes encouraged) |
Prohibited practices
The banned list includes, among others: manipulative techniques that materially distort behaviour and cause significant harm; exploiting vulnerabilities linked to age, disability or social or economic situation; social scoring leading to unjustified detrimental treatment; emotion recognition in workplaces and educational institutions (with medical and safety exceptions); untargeted scraping of facial images to build recognition databases; and, subject to narrow exceptions, real-time remote biometric identification in public spaces for law enforcement.
High-risk AI systems
High-risk systems come in two groups. The first is AI used as a safety component of products already covered by EU product-safety law, such as medical devices or machinery. The second is a list of use cases in Annex III, which includes:
- biometric identification and categorisation;
- management of critical infrastructure;
- education and vocational training (for example, scoring exams or deciding admissions);
- employment and worker management (CV screening, promotion and termination decisions);
- access to essential private and public services (such as creditworthiness assessment and certain insurance pricing);
- law enforcement, migration and border control, and the administration of justice.
That Toronto recruitment tool sits squarely in the employment category.
Transparency obligations
People must be told when they are interacting with an AI system unless it's obvious. Synthetic audio, image, video and text content generated by AI must be marked in a machine-readable way, and deployers who publish deepfakes must disclose that the content is artificial.
Providers, deployers and why location doesn't save you
The Act assigns obligations by role:
- Provider – whoever develops an AI system (or has it developed) and places it on the market or puts it into service under its own name.
- Deployer – an organisation using an AI system under its authority in a professional context.
- Importers and distributors – those bringing systems into or making them available on the EU market.
The territorial scope is broad. It covers providers placing systems on the EU market regardless of where they are established, deployers located in the EU, and providers and deployers in third countries where the system's output is used in the EU. Non-EU providers of high-risk systems must appoint an authorised representative in the Union.
Key obligations for high-risk AI
Providers of high-risk systems carry the heaviest load. They must, among other things:
- run a risk-management system across the lifecycle;
- apply data governance to training, validation and test data;
- maintain technical documentation and automatic logging;
- give deployers clear instructions for use;
- design for effective human oversight, accuracy, technical resilience and cybersecurity;
- operate a quality-management system, complete a conformity assessment, apply CE marking and register the system in the EU database;
- monitor the system after it's on the market and report serious incidents.
Deployers have lighter but real duties: use the system according to its instructions, assign competent human oversight, monitor operation, keep logs under their control, and inform affected workers before using high-risk AI in the workplace. Certain deployers – public bodies and some providers of services such as credit and insurance – must also carry out a fundamental-rights impact assessment.
General-purpose AI models
The Act has a separate chapter for general-purpose AI (GPAI) models, such as the large language models behind popular assistants. Their providers must keep technical documentation, give information to downstream developers, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training. Models deemed to pose systemic risk – presumed when training compute exceeds 10^25 floating-point operations – face additional duties, including model evaluations, adversarial testing, incident reporting and cybersecurity protections.
If your company builds on someone else's model rather than training one, these duties mostly sit with the model provider. Your obligations depend on what you build with it.
The AI Act timeline
- 2 February 2025: prohibitions apply, along with an obligation for providers and deployers to ensure adequate AI literacy among staff dealing with AI systems.
- 2 August 2025: rules for general-purpose AI models and the governance and penalties framework apply.
- 2 August 2026: most remaining provisions apply, including the Annex III high-risk requirements and transparency duties.
- 2 August 2027: requirements for high-risk AI embedded in products covered by existing EU product legislation.
In late 2025 the European Commission proposed changes that could delay some high-risk deadlines, tied to the availability of technical standards. Check the current status before you build a compliance plan around any single date.
Penalties
Fines are tiered. For prohibited practices: up to €35 million or 7% of worldwide annual turnover, whichever is higher. For most other violations: up to €15 million or 3%. For supplying incorrect or misleading information to authorities: up to €7.5 million or 1%. Lower caps apply to SMEs and start-ups.
What to do first: an AI Act checklist
- Inventory every AI system you build, buy or use, including features inside third-party software.
- Classify each one by risk tier and note your role – provider, deployer or both.
- Rule out prohibited uses immediately; those rules already apply.
- Train staff to a level of AI literacy that fits their role, and document it.
- Add transparency to customer-facing chatbots and AI-generated content.
- For anything high-risk, start on documentation, data governance, logging and human oversight now – these take months, not weeks.
- Ask your vendors what they're doing to comply, and get it in writing.
The bottom line
The EU AI Act is less a ban on AI than a product-safety framework for the uses that can genuinely hurt people. For most businesses – inside or outside the EU – the practical work is an inventory, transparency for chatbots and generated content, staff training, and serious preparation only where systems touch hiring, credit, education, health or safety. Know which tier you're in, and the rest of the AI Act becomes a manageable project rather than a threat.
