Answer in brief
The EU AI Act sorts AI systems into four risk levels and attaches duties to each. Most business tools sit at minimal risk, chatbots and generated content carry transparency duties, and staff who use AI need basic AI literacy. Banned practices apply since 2025, high-risk rules come later. This is a summary, not legal advice.
What the EU AI Act is and who it concerns
This eu ai act summary starts with the basics. The AI Act is Regulation (EU) 2024/1689, which the European Commission calls the first comprehensive legal framework on AI worldwide. It uses a risk-based approach: the higher the risk an AI system poses, the heavier the rules. It entered into force on 1 August 2024, and its duties switch on in stages.
The Commission's questions and answers say the law reaches public and private actors inside and outside the EU that place an AI system on the EU market or use one in the EU. It names providers, who develop a system, and deployers, who use it. A shop that uses a chat assistant bought from a vendor is normally a deployer. Research before release and systems for military or national security are outside the scope.
The four risk levels in plain words
The Commission describes four levels. Unacceptable risk covers systems that threaten safety, livelihoods or rights, and they are banned. High risk covers uses that can seriously affect health, safety or fundamental rights, for example in employment, education, essential services, law enforcement and migration, and they face strict obligations before they reach the market.
The third level is transparency risk: systems where people need to know that AI is involved, such as chatbots and deepfakes. The fourth is minimal or no risk, which has no specific rules. The Commission says this covers most AI in use today, for instance AI in video games or spam filters. For a small company the practical task is to find which of its tools sit at which level.
Practices the Act bans outright
The Commission's page lists nine prohibited practices. They include harmful manipulation and deception, exploitation of vulnerabilities, social scoring, predicting an individual's criminal offence risk, untargeted scraping of faces from the internet or CCTV, emotion recognition in workplaces and schools, certain biometric categorisation and real-time remote biometric identification by police in public spaces. The ninth, added by the omnibus amendments, covers AI that generates non-consensual sexual content or child abuse material.
The first prohibitions have applied since 2 February 2025, together with the AI literacy duty. The AI Act Service Desk gives 2 December 2026 for the newly added ban on non-consensual sexual deepfakes and abuse material. Few ordinary businesses come near this list, but the emotion recognition item deserves a look: a tool that claims to read the mood of staff or candidates is exactly the kind of feature to ask a vendor about.
Transparency duties for chatbots and generated content
Article 50 sets the transparency rules. Per the AI Act Service Desk, providers must design systems that interact directly with people so that those people know they are dealing with an AI, unless this is obvious to a reasonably well-informed person. Providers of systems that generate audio, image, video or text must make the output machine-readable and identifiable as AI-made, to the extent technically feasible.
Deployers have their own duties. They must tell people exposed to emotion recognition or biometric categorisation systems how the systems work, and disclose deepfakes. They must also disclose AI-generated text published to inform the public on matters of public interest, with an exception where a human reviewed the text and someone holds editorial responsibility. The AI Act Service Desk gives 2 August 2026 as the start of these rules, with a later transition, until 2 December 2026, for some providers of synthetic-content systems already on the market.
For a business, the working rule is to look at every place where AI talks to a customer or produces public material: a website chat, a voice line, generated images in advertising, automated replies. Check what the provider of each tool already does and whether your notice to the user is clear, visible and given at the first contact. Which party owes which duty in your case is a question for a lawyer.
AI literacy: what the Act asks of your staff training
Article 4 requires providers and deployers to take measures to support the AI literacy of their staff and of other people who operate or use AI systems on their behalf. The measures should reflect those people's knowledge, experience and training, the context of use and the persons affected. According to the Commission, the duty has applied since 2 February 2025.
The Commission also says what it is not. The article does not require any specific level of AI literacy from any individual, and no certification is needed; internal records of training and other initiatives are enough. Supervision begins on 2 August 2026 through national market surveillance authorities, and the Digital Omnibus kept the duty while mandating no specific level. In practice: know who uses which tool, explain its limits to them, and write down that you did.
The dates from 2024 to 2028, after the Omnibus changes
The AI Act Service Desk gives the timeline. The Act entered into force on 1 August 2024. Prohibitions and AI literacy began on 2 February 2025. Duties for providers of general-purpose AI models began on 2 August 2025. Most of the Act applies from 2 August 2026, when transparency rules start and enforcement begins at national and EU levels.
The Digital Omnibus on AI amended some dates. The Commission says it entered into force in July 2026. The rules for high-risk systems listed in Annex III now apply from 2 December 2027, and those for high-risk AI embedded in regulated products from 2 August 2028. Dates in this area have already moved once, so check the Service Desk before relying on any single day.
What fines exist and what to write down
The Commission's Q&A page gives three penalty ceilings: up to 35 million euros or 7 percent of worldwide turnover for prohibited practices, up to 15 million or 3 percent for other requirements, and up to 7.5 million or 1 percent for supplying incorrect or misleading information. For small and medium companies, the lower of the two amounts in each category applies. Enforcement is proportionate and considers the nature and gravity of the breach.
Fines are the end of the road; paperwork is the beginning. Write down which AI tools are in use, who owns each one, what it is used for, what data goes in, whether it talks to the public or produces published material, and what the vendor says about its class. Add a short internal rule on how staff may use AI, and a record of the training given. These pages are what a regulator, a customer or a partner would ask for first.
What to prepare before ordering an AI Act readiness pack
Gather the list of every AI feature you use, including the ones hidden in other software: the chat widget on the site, the transcription tool, the writing assistant, the design generator. For each, note the vendor and the plan. List where AI output reaches the public, and who in the team uses AI daily. Find any vendor documents that state how the tool is classed.
VITON13 Studio offers this as a package called EU AI Act readiness pack. It contains an inventory of the AI systems your company uses, a risk classification for each, transparency notices for users and an internal AI use policy for staff. Before payment, the studio fills in the AI inventory template for three of your tools, so you can judge the format on your own case.
The fixed price is $113, and the work takes 5–8 working days. The classification is a working draft for your files, not a legal opinion, and a lawyer should confirm anything that touches a high-risk area. The package page and the free-draft page show the exact terms.
Practical checklist
- List every AI feature in use, including ones inside other software, with vendor and plan.
- Mark where AI talks to customers or produces published text, images or audio.
- Ask each vendor how the tool is classed under the AI Act and keep the answer on file.
- Record which staff use which tool and what you told them about its limits.
- Ask a lawyer to confirm the classification of anything that touches hiring, credit or similar decisions.
Questions and answers
Does the EU AI Act apply to a company outside the EU?
It can. The Commission says the law covers actors inside and outside the EU that place an AI system on the EU market or use one in the EU. Whether your case falls in scope is a question for a lawyer.
Is a chatbot on my website high risk?
Not by default. The Commission lists chatbots under transparency risk, meaning people must be able to tell they are talking to an AI. A chatbot used for decisions in areas such as employment or essential services is a different question.
Do I need an AI literacy certificate for my staff?
No. The Commission says Article 4 requires no certification and no specific level for any individual. It asks for measures that fit the people and the context, and internal records of training are enough as evidence.
When do the high-risk rules start to apply?
Per the AI Act Service Desk, rules for the high-risk systems listed in Annex III apply from 2 December 2027, and for AI embedded in regulated products from 2 August 2028, after the Digital Omnibus amendments. Check the Service Desk for later changes.
Are there lower fines for small companies?
Yes. The Commission's questions and answers say that for small and medium companies the lower of the two amounts in each penalty category applies, while larger companies face the higher. The ceilings still exist, so the duties still matter.