The EU AI Act is the European Union’s law on artificial intelligence. It sets rules for how AI systems are built, sold and used, graded by the risk each use poses to people’s safety and rights. It is not only for AI companies. It reaches any business whose AI, or the output of its AI, touches the EU, and it gives duties to the businesses that buy and use AI as well as those that build it.
Most boards know the name. Fewer can say whether they are caught by it, what role they play, or which of their AI systems it covers. This guide sets out the Act in plain English, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), and ends with the one test that tells a board whether it is ready.
What is the EU AI Act?
The EU AI Act, Regulation (EU) 2024/1689, is the EU rulebook for AI systems. It came into force in August 2024 and applies in stages to 2028. It does not regulate AI as a technology. It regulates uses of AI, and the heavier the potential harm, the stricter the rules.
Three features matter most to a board:
- It covers how AI is built, sold and used, so buyers and users have duties, not just developers.
- It can apply wherever AI touches the EU, not only to businesses based there.
- Much of it is already in force. Only the high-risk rules were delayed.
Does the EU AI Act apply to companies outside the EU?
Yes, in many cases. It follows the market, not the head office. A UK or US business is in scope if it sells an AI system, or a product or service with AI built in, to EU customers, or if the output of its AI is used in the EU, for example screening EU job applicants from London. An EU subsidiary brings the AI used by or for that business into scope too. For how the EU rules sit alongside the US approach, see US or EU AI Rules? What a UK Board Should Plan Around.
Five questions give a first answer. Are you based in the EU? Do you sell AI, or AI-enabled products, into the EU? Do you serve EU customers? Is the output of your AI used in the EU? Do you use AI in sensitive decisions about people, such as hiring or lending? A yes to any of the first four means the Act is likely to apply. A yes to the fifth tells you where to look first. For every situation, set out case by case, see who the EU AI Act applies to.
Who has to do something?
The Act gives different duties to different roles, and one business can hold different roles for different systems:
- Provider. Develops an AI system, or has one developed, and puts it on the market or into service under its own name. Providers carry the heaviest duties.
- Deployer. Uses an AI system under its authority in the course of its business. Most companies are deployers.
- Importer. An EU business that places on the EU market an AI system carrying the name of a company outside the EU.
- Distributor. Any other business in the supply chain that makes an AI system available in the EU, such as a reseller.
Roles can change. A business that puts its own name on a high-risk system built by someone else, substantially modifies one, or changes a system’s purpose so that it becomes high-risk, is treated as its provider. Fine-tuning an open model can have the same effect, as we explain in Building on an Open AI Model? Your EU AI Act Role May Change.
What are the four risk categories?
The Act sorts AI uses into four categories. The category decides what you must do.
| Category | What it means | Examples |
|---|---|---|
| Unacceptable risk | Banned. There is no route to make it compliant. | Manipulative or deceptive AI that causes significant harm, exploiting people’s vulnerabilities, social scoring, emotion recognition in the workplace or in education, untargeted scraping of facial images to build recognition databases |
| High risk | Allowed only with strict controls. | AI used in recruitment, promotion or worker monitoring, credit scoring of individuals, life and health insurance pricing, education admissions and assessment, and safety components of regulated products and critical infrastructure |
| Limited risk | Allowed, but people must be told. | Chatbots and AI voice agents, AI-generated or manipulated content, deepfakes, emotion recognition and biometric categorisation where these are not banned |
| Minimal risk | No specific duties under the Act beyond AI literacy. | Spam filters, AI in productivity tools used for drafting and summarising, stock forecasting |
High-risk depends on the use, not the industry. A retailer that uses AI to screen job applicants has a high-risk system. A customer service chatbot is not high-risk: it sits in the limited risk category and must tell people they are dealing with AI.
What applies now, and what comes next?
The Digital Omnibus moved the deadline for high-risk AI. It did not move the rest.
| Date | What applies |
|---|---|
| February 2025, in force | Banned practices and AI literacy for staff who use AI |
| August 2025, in force | Rules for general-purpose AI models, which fall on the companies that build them |
| August 2026, in force | Article 50 transparency: tell people when they deal with AI, and mark AI-generated content |
| 2 December 2027 | High-risk AI listed in Annex III, including employment, credit, insurance and education uses |
| 2 August 2028 | AI that is a safety component of products regulated under Annex I, such as machinery, toys and lifts |
By the end of 2027, a business using high-risk AI must be able to show documentation and risk management, human oversight by people with the competence and authority to intervene, monitoring and logs, incident handling, and evidence from its suppliers. None of that can be produced in the final quarter. The EU AI Act deadline briefing sets out the deployer duties and the fines in full.
Why the risk may already be inside tools you bought
Much of the AI in a business was never approved as AI. It arrived inside HR platforms, finance systems, customer service software and productivity suites, switched on by a vendor update or a team trial. The obligations do not disappear because the AI is embedded. If a recruitment platform ranks EU applicants, the business using it is the deployer of a high-risk system, whoever built it.
This is why the Act is a governance question before it is a legal one. It asks who in the business owns each AI system and the decisions it makes. The same question sits behind Who Owns the AI Agent When It Breaks? Delegated Authority for Boards, and behind the case in Privacy and Security Are One Risk for putting data, privacy and AI risk under one accountable owner.
What should the board do?
Five actions, in order:
- Find it. Build a full inventory of the AI in use, including AI inside the software you already pay for, and record where each system or its output touches the EU.
- Classify it. Place each system in a risk category (unacceptable, high, limited or minimal) and record your role for it: provider, deployer, importer or distributor.
- Fix what is live now. Confirm nothing falls under the banned practices, make sure people are told when they deal with AI, and support AI literacy for the staff who use it.
- Plan for December 2027. Give each high-risk system an owner, a budget and a plan, and ask vendors now for the documentation you will depend on.
- Govern it. Name one accountable person at board level and put a short AI compliance report on the board agenda every quarter.
The inventory is also the foundation for everything else the business wants from AI, a point developed in AI Readiness Starts Before AI.
The evidence test
One question tells a board whether it is ready: can you evidence where AI is used, what role you play, what risk category each system falls into and what controls exist?
Evidence means a record a regulator, auditor, customer or insurer could inspect, not an assumption held by the IT team. If the board cannot answer with evidence, that is the gap to close first.
The AIPEX EU AI Act Readiness Assessment closes it. It builds the AI inventory, checks your EU exposure, maps your role for each system, classifies each by risk, and reviews the gaps, then gives the board a prioritised action plan and identifies what needs legal review. Find it. Classify it. Govern it. The first step is evidence, not assumption.
Frequently asked questions
What is the EU AI Act in simple terms?
It is the EU's law on artificial intelligence. It regulates uses of AI according to the risk they pose: some uses are banned, high-risk uses are allowed only with strict controls, some must be disclosed to the people affected, and most carry no specific duties. It applies to businesses that build, sell or use AI where the AI or its output touches the EU. For the full guide, see What Is the EU AI Act? A Plain-English Guide for Boards.
What are the four risk categories in the EU AI Act?
Unacceptable risk, which is banned; high risk, which is allowed only with controls such as risk management, human oversight and logging; limited risk, where people must be told they are dealing with AI or AI-generated content; and minimal risk, which carries no specific duties under the Act beyond AI literacy. The category depends on how the AI is used, not on the industry.
How do we know if we are ready for the EU AI Act?
Apply the evidence test: can you evidence where AI is used, what role you play, what risk category each system falls into and what controls exist? If not, an EU AI Act Readiness Assessment builds that evidence and turns it into a board action plan.
Correct as of 25 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 25 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.