Who you are under the AI Act
- Provider
Develops an AI system or places it on the market under its own name. Has the most obligations.
- Deployer
Uses an AI system in its professional activity, for example a chatbot on the website or a document analysis tool. That's the case for most small businesses.
- Private user
Uses AI for personal, non-professional purposes. The AI Act practically doesn't cover them.
This is a description of the rules for orientation, not legal advice. For a specific deployment, especially in a high-risk area, consult a lawyer.
Dates worth knowing
| From | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (for example manipulation that exploits people's vulnerabilities, social scoring) and the obligation to look after AI literacy |
| 2 August 2025 | Obligations for providers of general-purpose models and the rules on supervision |
| 2 August 2026 | Most of the remaining rules, including the transparency obligations of Article 50 |
| 2027 to 2028 | Obligations for high-risk systems, postponed by the Digital Omnibus regulation (EU 2026/1744) |
Obligation 1: AI literacy
Article 4 requires companies that use AI to ensure an adequate level of AI literacy among the people who use it. It's not about certificates, but about people knowing what the tool is for, where it gets things wrong and what data must not be typed into it.
Obligation 2: transparency
- A chatbot on a website or in a shop must clearly say you are talking to AI, unless that's obvious from the circumstances.
- Realistic AI-generated images, video and audio that show real people or places and could pass for genuine (deepfakes) must be labelled as generated.
- AI-generated text published to inform the public on matters of public interest must be labelled, unless it has been edited by a person who takes responsibility for it.
The simplest practice: next to a chatbot write “AI assistant” and add a way to contact a person. For AI-generated images showing real people, add a visible caption.
Obligation 3: watch out for high-risk areas
Annex III of the AI Act lists areas where AI can seriously affect people's lives. For a small business the most important are: recruitment and selection of candidates, decisions on promotion and dismissal, assessing employees' work and behaviour, and assessing people's creditworthiness.
If you use AI to filter CVs or assess employees, you are using a high-risk system. Then the obligations are serious: human oversight, monitoring of operation, keeping logs and informing the people concerned. The date has been postponed, but it's a good moment to think such uses through.
Terms from this guide
- AI Act
The EU Regulation 2024/1689 on artificial intelligence. It assigns obligations by risk level and by role: provider or deployer of AI.
- Deepfake
A realistic image, video or recording generated or altered by AI that shows real people or events and could pass for genuine.
Questions and answers
Do I have to report that we use ChatGPT in the company?
There's no general obligation to report the use of AI tools. There are obligations concerning employees' competence, transparency towards people and high-risk systems.
Do AI images on the website have to be labelled?
The obligation covers realistic content that shows real people, places or events and could pass for genuine. Clearly artistic or illustrative images are treated more leniently, but a label builds trust anyway.
What are the penalties?
The regulation provides for fines depending on the type of infringement, the highest for prohibited practices. For small businesses and start-ups the fines are calculated more leniently. Details are in Article 99 of the regulation.
Sources and documentation
- Regulation (EU) 2024/1689 (AI Act): the full text on EUR-Lexeur-lex.europa.eu
- European Commission: the AI Act, timeline and explanationsdigital-strategy.ec.europa.eu
- European Commission: AI literacy (Article 4), questions and answersdigital-strategy.ec.europa.eu