Skip to content
Menu
EN

What is the EU AI Act – and what does it mean for your business?

The EU AI Act explainedLast updated 4 min read

Short answer

The AI Act (Regulation (EU) 2024/1689) is the EU's law on artificial intelligence. It applies both to those who build AI and to businesses that use AI at work – small ones included. The rules depend on the risk: some uses are banned, some are high-risk with many requirements, chatbots and AI content must be labelled, and the rest is minimal risk. For most businesses this means, today: give your staff AI literacy, don't use prohibited AI, label chatbots, and get ready for the high-risk requirements that apply from 2 December 2027.

The AI Act in one minute

The AI Act is an EU regulation. It applies directly in every EU country, without each country having to pass its own law. It regulates AI by how much harm it can do – not by the technology behind it.

The law distinguishes between two roles:

  • Providers build AI and put it on the market – for example OpenAI, Anthropic, Microsoft, or a company that builds its own AI feature.
  • Deployers use AI at work. That is almost every other business – including yours, if your staff use ChatGPT, Claude or Copilot.

The four risk levels

Level Examples What do you need to do?
Prohibited Emotion recognition in the workplace, social scoring Don't do it
High-risk Recruitment, HR decisions, credit scoring, education Human oversight, logs, informing the people affected (from 2 December 2027)
Limited risk Chatbots, AI-generated images and deepfakes Tell people it is AI (from 2 August 2026)
Minimal risk Email drafts, summaries, translation AI literacy and common sense

Try it yourself and see how a use of AI is classified:

GoalCube AI MapFictitious data
What will the AI be used for?
Minimal risk

Approved automatically under your rules. Staff need sufficient AI literacy (Art. 4).

Limited risk

Users must be able to see they are talking to an AI (Art. 50). GoalCube has ready-made wording you can use.

High risk

Recruitment is listed in Annex III. A person confirms the use before the AI gets any data, and decides each case (Art. 14 and 26; Art. 22 GDPR).

Prohibited

Emotion recognition in the workplace is prohibited (Art. 5). GoalCube won’t help with it.

The example is simplified. In GoalCube you answer a few questions, and the classification follows fixed rules.

Simplified example. In GoalCube, classification follows fixed rules.

What already applies?

The bans and the AI literacy requirement have applied since 2 February 2025. The rules for general-purpose AI models such as GPT and Claude have applied to their providers since 2 August 2025. The requirements to label chatbots and AI content apply from 2 August 2026. See every date in our article on AI Act deadlines.

What about GDPR?

The AI Act does not replace GDPR. If you use AI on information about customers, employees or suppliers, you must also follow GDPR: a legal basis, as little data as possible, a data processing agreement (DPA) with the AI provider and control over transfers outside the EU. Read more in Can we use ChatGPT, Claude or Copilot on personal data?

What to do

  1. Write down how you use AI.Which tools do you use, and for what? An AI register is the basis for everything else.
  2. Find the risk for each use.Most tasks are minimal risk. Recruitment, HR decisions, credit and education can be high-risk.
  3. Stop anything prohibited.For example emotion recognition in the workplace and social scoring.
  4. Give your staff AI literacy.A short introduction, matched to their tasks – and a record of who has had it.
  5. Label chatbots and AI content.From 2 August 2026, people must be able to see that they are talking to an AI, and deepfakes must be labelled.
  6. Prepare for high-risk.If you use AI in, say, recruitment, from 2 December 2027 a human must oversee it, logs must be kept and the people affected must be informed.

What the law says

Regulation (EU) 2024/1689 – AI Act
Entered into force on 1 August 2024 and applies in stages until 2030.
Article 3 AI Act – definitions
Defines terms such as AI system, provider and deployer (the business that uses AI under its authority).
Regulation (EU) 2026/1744 – Digital Omnibus on AI
Amends the AI Act: the high-risk rules are postponed and the AI literacy requirement is adjusted.

Questions and answers

Does the AI Act apply to small businesses?

Yes. There is no exemption for small businesses that use AI. But the requirements are light if your use is simple – and small businesses get lower fine caps and simpler documentation.

Does the AI Act apply if we only use ChatGPT?

Yes. You are a deployer when you use an AI system at work. At a minimum, you need to ensure AI literacy and avoid prohibited uses. If you use ChatGPT for high-risk tasks, more requirements apply.

What is the difference between the AI Act and GDPR?

GDPR is about personal data. The AI Act is about the AI itself and the risks it brings. If you use AI on personal data, both apply.

Has the AI Act been postponed?

Partly. The Digital Omnibus pushed the high-risk rules back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The bans, AI literacy and transparency already apply.

Sources

Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.

Be among the first.

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.

Read next