EU AI Act — What You Need to Know

The EU AI Act — Fundamentals

Key Points

Regulation (EU) 2024/1689 — effective since 1 August 2024. The world's first comprehensive AI law. It applies to everyone deploying AI in the EU — regardless of where the AI was developed.

The Principle: The riskier, the stricter

The EU AI Act is risk-based. Not all AI is equally dangerous. A spam filter is different from a system that decides on creditworthiness.

Unacceptable Risk  →  PROHIBITED
High Risk          →  Strict Obligations + Approval
Limited Risk       →  Transparency Obligation
Minimal Risk       →  Few Restrictions (Majority of all AI)

Timeline — what applies when?

Who is affected?

As a company, you are generally an operator — with specific obligations.

Penalties

Next: Risk Classes in Detail →

The 4 Risk Classes in Detail

Class 1 — Prohibited (since February 2025)

Eight practices are absolutely prohibited:

Practice Check: Is your company planning any of these? → Stop immediately. No transition period.

Class 2 — High Risk (fully from August 2026)

AI in these areas is automatically considered high-risk:

What operators of high-risk systems must do:

1. Establish a risk management system
2. Document data management practices
3. Create technical documentation
4. Activate automatic logging
5. Ensure human oversight
6. Guarantee accuracy, robustness, cybersecurity
7. Train employees ← this course fulfills Art. 4

Class 3 — Limited Risk (Transparency)

AI interacting with humans must disclose its identity.

Specifically:

• Chatbots must identify as AI
• AI-generated texts/images/videos must be labeled
• Deepfakes must be marked as such

Immediate action required for companies with AI chatbots — these obligations already apply.

Class 4 — Minimal Risk

Spam filters, product recommendations, AI in video games — largely unregulated. Voluntary codes of conduct recommended, no legal obligations.

Quick Test: Which Class Applies to Your System?

Question 1: Does the application fall under Annex III (High-Risk Areas)?
  → YES: High-risk obligations from August 2026
  → NO: Proceed to Question 2

Question 2: Does the AI interact with humans or generate visible content?
  → YES: Transparency obligation (Class 3)
  → NO: Minimal Risk (Class 4)

Unsure? → Seek legal advice. The costs are low compared to the fines.

Back: The Law | Next: What It Means for You →

What the EU AI Act Means for Your Company

Immediate Need for Action — Now, Not 2026

Some obligations already apply:

*technically fully effective from Aug. 2026, preparation recommended now

Your Obligations as an Operator

Step 1: Inventory Which AI systems does your company use? Complete for each system:

• Name and purpose of the system
• Provider
• Affected groups
• Risk class (→ Quick Test Module 2)

Step 2: Prioritize High-risk Systems For each high-risk system by August 2026:

• Establish a risk management system
• Review Data Protection Impact Assessment (DPIA)
• Document human oversight
• Train employees

Step 3: Demonstrate AI Literacy Art. 4 obliges operators to ensure that employees possess “sufficient AI competence”. This course + assessment = your proof.

Rights of the Affected Parties

When AI makes decisions about your customers, employees, or applicants:

Three Questions for Purchasing AI

Before your company buys or licenses an AI system:

1. “How do you explain an erroneous decision?” — No explanation model = no purchase.
2. “What training data did you use and on what legal basis?” — Lack of legal basis burdens you as the operator.
3. “Who is liable for discrimination by your system?” — “The customer” is not an answer.

Back: Risk Classes | Start Assessment →