EU AI Act — All Requirements for Businesses at a Glance

The EU AI Act (officially: Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence) is the world's first comprehensive law regulating artificial intelligence. It was enacted on 13 June 2024 and entered into force on 1 August 2024.

Purpose of the law: To create a uniform legal framework for the safe and trustworthy use of AI in the EU — without hindering innovation.

Who is affected? Any company that develops, distributes or uses AI systems — inside or outside the EU, provided the AI is used on the EU market or affects EU citizens. This also includes the use of ChatGPT, Microsoft Copilot, Google Gemini and other AI tools in everyday work.

The AI Act applies directly in all 27 EU member states and requires no national implementation. The requirements are being introduced gradually, with different deadlines depending on the area of regulation.

The most important requirement, and the one that is already in effect, is Article 4 — AI literacy. Since 27 July 2026, Article 4(1) reads:

Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, […]. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.

From 2 February 2025 until 26 July 2026, Article 4 required best efforts to ensure that staff have a sufficient level of AI literacy.

What this means in practice:

• The knowledge, experience and training of the employees as well as the use of the AI must be taken into account. A specific level of competence does not have to be guaranteed for any individual.

The EU AI Act does not prescribe a specific form of training or a certification body. Companies can conduct training internally, use external providers or rely on online certifications. What matters is that the content covers the relevant areas of competence and that participation is documented.

The EU AI Act divides AI systems into four risk classes, which entail different requirements:

🔴 Prohibited AI practices (in effect since February 2025):

• Social scoring
• Real-time biometric mass surveillance in public spaces
• Emotion recognition in the workplace and in educational institutions
• Manipulation through subliminal techniques

🟠 High-risk AI (applies from 2 December 2027 and 2 August 2028 respectively):

• AI in application procedures and personnel selection
• AI for creditworthiness assessments
• AI in education and vocational training
• AI in critical infrastructure

🟡 AI with limited risk:

• Chatbots must be labeled as AI
• AI-generated content must be made transparent

🟢 AI with minimal risk:

• Spam filters, recommendation systems, text correction
• Most office applications (ChatGPT for texts, Copilot for emails)
• No special requirements — only the general competence obligation under Article 4

The EU AI Act is being introduced gradually. The key deadlines:

• 1 August 2024: AI Act enters into force
• 2 February 2025: Prohibited AI practices apply. The AI literacy obligation (Art. 4) applies.
• 2 August 2025: Rules for general-purpose AI models (GPT, Gemini, Claude). National supervisory authorities must be designated. The Regulation's penalty framework applies.
• 2 August 2026: The AI Act applies generally — except for the postponed obligations for high-risk AI.
• 2 December 2027: Obligations for high-risk AI under Annex III.
• 2 August 2028: Obligations for high-risk AI under Annex I.

Fines for violations:

• Prohibited practices: up to €35 million or 7% of worldwide annual turnover
• Violations of high-risk requirements: up to €15 million or 3% of turnover
• Providing false information to authorities: up to €7.5 million or 1% of turnover
• Reduced rates apply to SMEs and startups

Regardless of fines: if damage results from untrained AI use — for example, a GDPR violation because an employee entered customer data into ChatGPT Free — the company bears responsibility under general liability rules.