08 / Trust & Governance
EU AI Act
The European Union’s law regulating AI by level of risk. It bans some uses outright, puts strict duties on high-risk systems, and requires AI literacy among staff.
How you’ll hear it
“Does the AI Act apply to us? We are not an AI company.”
“If you use AI in the EU, parts of it do.”
Avoid
Assuming the Act only concerns companies that build AI.
The longer version
The EU AI Act covers organisations that provide AI and those that use it in the EU, with duties scaled to risk. Some practices are prohibited, high-risk uses such as recruitment and credit decisions carry heavy requirements, and transparency and literacy duties apply more widely. Obligations phase in over several years, so check the current timeline for your use case.
In depth
The EU AI Act is the first broad law regulating AI by level of risk. It applies to organisations that provide AI systems and to those that use them in the EU, so it reaches far beyond technology companies.
It sorts uses into tiers. A small number of practices are banned outright, such as social scoring and certain kinds of manipulation. High-risk uses, including recruitment, credit decisions, education and access to essential services, carry heavy duties: risk management, data quality, documentation, human oversight and accuracy. Many other uses mainly carry transparency duties, such as telling people when they are dealing with an AI or when content has been generated.
Some obligations already apply. The bans and the duty to ensure AI literacy among staff took effect in February 2025, and rules for general-purpose AI models followed in August 2025. Timelines for high-risk systems have been under review, so check the current dates for your use case rather than relying on an old summary.
Penalties are significant, reaching into percentages of global turnover for the most serious breaches. The practical effect for most organisations is simple: know which of your AI uses fall into which tier.
What to do
- List your AI uses and map each one to a risk tier, starting with anything that affects people’s jobs, money or access to services.
- Put an AI literacy programme in place now. It is already an obligation.
- Ask every AI vendor how their product supports your obligations, in writing.