The EU AI Act: What Growing Businesses Need to Know

The EU AI Act, which entered into force in August 2024, is the world's first comprehensive legal framework for artificial intelligence. Like EU GDPR, it has extraterritorial reach - it applies not only to AI providers and deployers established in the EU but to those outside the EU whose AI outputs are used within the EU. Here is what growing businesses need to understand about their obligations and the timeline.

What the EU AI Act is

The EU AI Act creates a risk-based regulatory framework for AI systems. It imposes different obligations depending on the risk level of the AI application - from outright prohibition of the highest-risk applications to minimal requirements for low-risk tools. The goal is to ensure AI used in the EU is safe, transparent, and respects fundamental rights.

The Act applies to providers (those who develop or place AI systems on the market), deployers (those who use AI systems in a professional context), importers and distributors. If you develop AI tools used in the EU, or use AI tools in your EU-facing operations, you are likely within scope.

The risk classification system

The EU AI Act classifies AI systems into four categories:

• Unacceptable risk (prohibited): AI systems that pose a clear threat to people's rights - such as social scoring by governments, real-time remote biometric surveillance in public spaces, and cognitive behavioural manipulation. These are banned entirely.
• High-risk AI: systems used in critical infrastructure, education, employment, essential services, law enforcement and justice. High-risk AI requires conformity assessment, technical documentation, human oversight measures, and registration in the EU database - obligations similar in scale to medical device regulation.
• Limited risk: systems like chatbots that interact with humans - must be transparent that the person is interacting with AI.
• Minimal risk: most current AI applications, including spam filters, AI-enabled video games, and recommendation systems - no specific obligations beyond existing law.

What counts as high-risk AI for businesses

Growing businesses most likely to encounter high-risk AI obligations include those using AI for:

• Recruitment and employment decisions: AI systems used to shortlist candidates, rank applicants, or make or strongly influence hiring, promotion or termination decisions are classified as high-risk
• Credit scoring: AI used to assess creditworthiness for loans or credit
• Access to essential services: AI used to assess eligibility for benefits, insurance or public services
• Biometric identification: systems that identify or categorise individuals based on biometric data
• Education and training: AI that determines access to educational institutions or evaluates students

Importantly, the provider of the AI tool and the deployer (the business using it) both have obligations - even if you buy an off-the-shelf AI tool, you have responsibilities as a deployer of high-risk AI.

Obligations for businesses using high-risk AI

Deployers of high-risk AI systems must:

• Conduct a fundamental rights impact assessment before deploying the system
• Implement human oversight mechanisms - a human must be able to interpret and override the AI's output
• Keep logs of the system's operation
• Ensure staff using the system have appropriate AI literacy training
• Register in the EU database for high-risk AI (via the provider)
• Inform employees or other affected individuals that AI is being used in decisions about them

Timeline and what to do now

The EU AI Act entered into force in August 2024, with obligations phasing in over 36 months:

• August 2024: Act in force
• February 2025: Prohibited AI practices apply - identify and cease any prohibited use cases immediately
• August 2025: General-purpose AI model obligations apply - if you develop foundation models or GPAI, obligations are live
• August 2026: High-risk AI obligations apply in full
• August 2027: Obligations for high-risk AI embedded in regulated products (medical devices, machinery, toys) apply

Practical steps to take now:

• Inventory the AI systems you use or develop - classify each by risk level
• Identify whether any use cases fall into the prohibited category - cease these immediately
• For high-risk AI, begin mapping the conformity assessment requirements you will need to meet
• Assign responsibility for AI Act compliance - this is a new governance domain requiring board-level attention
• Follow European AI Office guidance as it is published - the regulatory framework is still being elaborated

Back to all guides