The EU AI Act is no longer a future concern. A practical guide to risk categories, deadlines and concrete steps for your organisation.
The EU AI Act is the world’s first broad AI law. It touches every organisation that develops, procures or deploys AI - even if you “only use ChatGPT”. This article is not legal text but a readable guide so you know what to arrange in 2026.
The core: a risk-based law
Instead of regulating AI as such, the law looks at what you do with it. The higher the risk to people, the stricter the requirements. There are four categories.
1. Unacceptable risk (banned)
Social scoring systems, manipulative AI exploiting vulnerable groups, real-time biometric identification in public spaces (with narrow law-enforcement exceptions). Banned outright since February 2025.
2. High risk
AI in recruitment, credit scoring, education decisions, medical devices, critical infrastructure. This is where the heavy requirements live: risk management, data quality, human oversight, transparency and logging.
3. Limited risk
Chatbots, deepfakes, AI-generated content. Mostly transparency duties: make clear the user is talking to AI or that an image is synthetic.
4. Minimal risk
Spam filters, AI in games. No specific obligations - but the general AI literacy obligation still applies.
The deadlines you must know
- 2 February 2025 - ban on unacceptable-risk AI and the AI literacy obligation (Article 4) apply.
- 2 August 2025 - rules for general-purpose AI models (GPT, Claude, Gemini) apply.
- 2 August 2026 - most obligations for high-risk AI apply.
- 2 August 2027 - final phase-in for high-risk AI in regulated products (e.g. medical devices).
Does this apply to me as a user?
Yes. The law distinguishes providers and deployers. A provider builds or markets the system; a deployer puts it to work in a professional context. Both have obligations - a deployer’s are lighter, but not empty. For high-risk AI you must, among other things: use the system per the instructions, set up human oversight, check input data and retain logs.
What to do in 2026: a five-step plan
- 1Inventory every AI system your organisation uses - including the free tools staff have adopted on their own.
- 2Categorise each system into one of the four risk categories.
- 3Train staff on AI literacy and document who completed what.
- 4Draft policy and an AI register: who may do what, with which data, and who checks?
- 5Create an incident procedure: how do you report an error, hallucination or AI-mediated data leak?
Common mistakes
Many organisations assume the law does not apply because they “don’t build AI themselves”. That is rarely true. The moment you use ChatGPT for customer letters or deploy an AI CV screener, you are a deployer with obligations.
A second misconception: AI literacy is not a mandatory hour-long training. The law requires knowledge appropriate to the role. A data scientist needs a different level from a receptionist.
The AI Act does not punish AI use. It punishes thoughtless AI use.
Start now, not in August
The enforcement date for high-risk AI is 2 August 2026. Waiting until July is not a plan; an AI register, policy and training programme take months to build. Our course covers the literacy obligation (Article 4) and gives you a template for inventorying and categorising your systems.
