EU AI Act Explained: What Businesses Must Do and When

EU AI Act explained simply: it is an EU law (Regulation (EU) 2024/1689) that sorts AI by risk. It bans a short list of harmful AI uses, sets strict rules for “high-risk” AI, requires labels and notices for chatbots and AI-generated content, and sets rules for the companies that build large general-purpose AI models. Parts of it already apply. After amendments made in 2026, the main high-risk rules start on 2 December 2027 and 2 August 2028.

This plain-English guide explains what the Act covers, whether it reaches your business (even outside the EU), and what to do now. Dates are as of October 2026.

EU AI Act explained: four levels of risk

The Act does not regulate “AI” in general. It looks at what an AI system is used for. The same model can be low-risk in one product and high-risk in another. A tool that sorts customer emails is treated very differently from the same tool ranking job applicants.

There are four main layers:

• Banned practices (Article 5). Some uses are simply not allowed. Examples include AI that manipulates or deceives people in ways that cause significant harm, AI that exploits people’s vulnerabilities, general “social scoring”, building facial recognition databases by scraping images from the internet, and emotion recognition at work or in schools.
• High-risk AI (Article 6). This covers AI that is a safety part of products already regulated by EU law (listed in Annex I, such as machinery or medical devices), and AI used in sensitive areas listed in Annex III, such as hiring, education, credit scoring and access to essential services.
• Transparency duties (Article 50). People must be told when they are talking to a chatbot, and certain AI-generated or AI-altered content (such as deepfakes) must be marked or disclosed.
• General-purpose AI models (Chapter V). Companies that build large models used across many tasks must keep technical documentation, have a copyright policy and publish a summary of the content used for training. The most powerful models face extra duties.

A narrow exit from “high-risk”

A system listed in Annex III is not automatically high-risk. Under Article 6(3), a provider can decide it is not high-risk if it does not pose a significant risk of harm, for example because it only does a narrow, preparatory task. This exit is not available if the system profiles individuals, and the provider must document and register its decision.

Who the EU AI Act applies to

The Act gives each business a role, and the duties follow the role:

• Provider – the business that develops an AI system (or has it developed) and puts it on the market under its own name or brand. Providers carry the heaviest duties.
• Deployer – a business that uses an AI system in its work. A company using an AI hiring tool is a deployer.
• Importer and distributor – businesses that bring AI systems into the EU or sell them on. They must check that the provider has done its job.

The Act reaches far beyond the EU. A provider based in Dubai, London or Tehran is covered if it sells or offers an AI system in the EU. Providers and deployers outside the EU are also covered where the output of their AI is used in the EU. Purely personal, non-business use is outside the deployer rules.

If you are based in the Gulf, our guide on whether the EU AI Act applies to UAE companies looks at this reach in more detail.

EU AI Act timeline as of October 2026

The Act applies in stages. In July 2026 the EU adopted the “Digital Omnibus on AI” (Regulation (EU) 2026/1744), which entered into force on 27 July 2026 and moved the high-risk dates later.

It also rewrote the AI literacy rule in Article 4. Providers and deployers must take measures to support the AI skills of their staff and others using AI on their behalf. They do not have to guarantee a specific level of knowledge for each person. Sensible training matched to how staff use AI is usually enough.

What high-risk providers and deployers must do

In short, a high-risk AI system must be well built, well maintained and properly supervised, and the business must be able to prove it with documents.

Providers of high-risk AI must have:

• a risk management process for the whole life of the system (Article 9);
• good data practices, including checks for bias and gaps in training data (Article 10);
• technical documentation, automatic logs, clear instructions for use and built-in human oversight (Articles 11–14);
• appropriate accuracy, robustness and cybersecurity (Article 15);
• a quality management system (Article 17), with documentation kept for 10 years (Article 18);
• a conformity assessment, an EU declaration of conformity, CE marking and registration in the EU database (Articles 43, 47, 48 and 49).

Following “harmonised standards” (technical standards cited by the EU) is presumed to meet the matching requirements (Article 40). Watch for the standards relevant to your product.

Deployers of high-risk AI must, under Article 26, follow the instructions, assign trained staff to oversee the system, use relevant input data, keep logs and inform affected people. Public bodies, private companies providing public services, and some banks and insurers must also carry out a fundamental rights impact assessment (Article 27). People affected by certain decisions have a right to an explanation (Article 86).

Be careful: a deployer can become a provider. Under Article 25 this happens if you put your own name or brand on a high-risk system, make a substantial change to it, or change its purpose so that it becomes high-risk.

Fines and enforcement

National market surveillance authorities enforce most of the Act. Article 99 sets these maximum fines:

• up to €35 million or 7% of worldwide annual turnover for banned practices;
• up to €15 million or 3% for most other breaches, including transparency failures;
• up to €7.5 million or 1% for giving incorrect, incomplete or misleading information to authorities.

For larger companies, the higher of the two amounts applies. For SMEs and start-ups, the lower one applies. Separate GDPR penalties can still apply.

Practical examples

Example 1: A Dubai recruitment platform with EU clients. A Dubai company sells an AI tool that scores CVs and shortlists candidates. Several clients are employers in Germany and Ireland. Recruitment is listed in Annex III, so the tool is likely high-risk. The Dubai company is the provider, even though it has no EU office. It should document its risk classification now, plan for the high-risk rules from 2 December 2027 and appoint an EU authorised representative. Its EU clients are deployers and must use the tool with human oversight.

Example 2: A London online shop using a customer chatbot. A UK online shop uses an AI chatbot to answer questions from customers across Europe. The chatbot is not high-risk. But under the transparency rules, customers must be told they are talking to an AI, unless that is obvious. The shop should add a clear notice at the start of each chat and review its privacy notice.

A quick checklist for any AI tool you use or sell:

• Is the use on the banned list? If yes, stop.
• Is it used in an Annex III area or as a safety part of a regulated product? If yes, treat it as possibly high-risk.
• Does it talk to people or create realistic content? If yes, plan notices and labels.
• Are you the provider, the deployer, or both?
• Does it process personal data? If yes, the GDPR applies too.

What to do next

1. Make a list of your AI. Record every AI system you build or buy, what it does and where its output is used.
2. Decide your role for each system. Note whether you are a provider, deployer, importer or distributor, and whether any changes you make could turn you into a provider.
3. Check the banned list and Annex III now. The bans already apply. A written high-risk assessment is the starting point for everything else.
4. Deal with what already applies. Put AI literacy training in place and add chatbot notices and content labels.
5. Plan for the high-risk dates. Use the time before December 2027 and August 2028 to build documentation, quality processes and supplier contracts. Our AI lawyer service can help you scope this work, and our legal services for Dubai companies cover cross-border set-ups.
6. Keep data protection in view. If your AI uses personal data, review your position with our GDPR compliance support, and see whether GDPR applies to UAE companies.
7. Get advice on your own case. To discuss your AI Act position, contact us.

This article is general information, not legal advice for a specific case.

Frequently asked questions

When does the EU AI Act apply?

In stages. The bans and the AI literacy duty have applied since 2 February 2025, and rules for general-purpose AI models since 2 August 2025. Most other rules, including transparency for chatbots and AI content, apply from 2 August 2026. The main high-risk rules now apply from 2 December 2027 (Annex III uses) and 2 August 2028 (AI in regulated products).

Does the EU AI Act apply to companies outside the EU?

Yes. It covers providers that place AI systems or general-purpose AI models on the EU market, wherever they are based, and providers and deployers outside the EU where the AI’s output is used in the EU. Non-EU providers of high-risk systems must appoint an EU authorised representative.

What are the maximum fines under the EU AI Act?

Up to €35 million or 7% of worldwide annual turnover for banned practices, €15 million or 3% for most other breaches, and €7.5 million or 1% for misleading information to authorities. SMEs and start-ups face the lower figure.

Is every AI tool high-risk?

No. It depends on the use. AI for hiring, education, credit scoring or access to essential services can be high-risk. Many everyday tools only face transparency rules or fall outside the Act.

Sources

• Regulation (EU) 2024/1689 (Artificial Intelligence Act) – EUR-Lex
• Regulation (EU) 2026/1744 (Digital Omnibus on AI) – EUR-Lex
• European Commission AI Act Service Desk – Article 113 (consolidated text)
• European Commission AI Act Service Desk – Article 4 (AI literacy)
• European Commission AI Act Service Desk – Article 99 (penalties)
• Nuno Sousa e Silva, ‘The Artificial Intelligence Act: Critical Overview’, 16 (2025) JIPITEC 2