AI and regulation
The EU AI Act for companies: a practical guide
The AI Act (Regulation (EU) 2024/1689) also applies to companies that only use AI. Most of them must support their staff’s AI literacy, avoid prohibited practices and make clear that a chatbot is AI. The strict rules for high-risk systems, for example in hiring, apply from 2 December 2027.
What the AI Act is and when it applies
The AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence. As a regulation it applies directly in every member state, including the Czech Republic. It entered into force on 1 August 2024 and its obligations phase in over time. In 2026 it was amended by Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, which moved the deadlines for high-risk systems and rewrote the article on AI literacy.
| From | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4) |
| 2 August 2025 | Obligations for providers of general-purpose AI models and the penalty rules |
| 2 August 2026 | Transparency (Art. 50): chatbots, deepfakes and marking AI-generated content |
| 2 December 2026 | New prohibitions added by the Digital Omnibus, and the end of the grace period for machine-readable marking by systems placed on the market before 2 August 2026 |
| 2 December 2027 | High-risk systems under Annex III, such as hiring, credit or education |
| 2 August 2028 | High-risk AI in products under Annex I, such as machinery or medical devices |
Your role: provider or deployer
The AI Act distinguishes providers, who develop an AI system and place it on the market under their own name, from deployers, who use AI in their professional activity. Most companies are deployers: they use ChatGPT, Copilot, a website chatbot or an invoice agent. But if you develop an AI system, or have one developed, and place it on the market or put it into service under your own name, you may be its provider. That is why we determine the role at the start of every project.
What every company that uses AI must do
- AI literacy (Art. 4). Companies must take measures to support the AI literacy of their staff and other people who use AI on their behalf, taking into account their knowledge and what the AI is used for. Since the 2026 amendment, the regulation no longer requires a guaranteed level for each person, but the measures should be real and documented. The most common measure is AI training for staff by level.
- No prohibited practices (Art. 5). See the list below. For typical business tools, the most relevant is the ban on emotion recognition in the workplace.
- Transparency (Art. 50). People must know they are interacting with AI unless it is obvious. Deepfakes, and AI-generated text published to inform the public on matters of public interest, must be disclosed unless the text has gone through human editorial review.
- GDPR still applies. The AI Act does not replace data protection. What staff put into AI tools must comply with GDPR and protect trade secrets.
Prohibited practices
Since 2 February 2025 the EU prohibits AI used, among other things, for:
- manipulating people with subliminal or deceptive techniques that can cause significant harm,
- exploiting vulnerabilities due to age, disability or social situation,
- social scoring that leads to unfavourable treatment,
- emotion recognition in the workplace and in education, except for medical or safety reasons,
- untargeted scraping of facial images from the internet or CCTV to build facial recognition databases,
- biometric categorisation to infer, for example, race, political opinions or sexual orientation,
- predicting the risk of a criminal offence based solely on profiling.
From 2 December 2026 the Digital Omnibus adds a ban on AI that generates intimate images of identifiable people without their consent, and on AI that generates child sexual abuse material.
Chatbots and AI-generated content
The transparency obligations apply from 2 August 2026. A website chatbot or an AI that replies to email must make clear that it is AI unless this is obvious from the context. In autonomous customer support we handle this by having the agent introduce itself in its first message. Providers of systems that generate content must mark it in a machine-readable way; systems placed on the market before 2 August 2026 have until 2 December 2026.
When a system is high-risk
High-risk systems are listed in Annex III. For typical companies the key areas are:
- employment: recruiting, filtering CVs, evaluating candidates and decisions on promotion or termination,
- credit: assessing the creditworthiness of individuals,
- insurance: risk assessment and pricing of life and health insurance,
- education: admission and assessment of students.
The rules for these systems apply from 2 December 2027. Deployers must then use the system according to the provider’s instructions, assign oversight to people with the necessary competence, keep the automatically generated logs for at least six months, and inform workers before using the system in the workplace. Agents for invoices, email or customer support are generally not high-risk.
Fines
Breaching the prohibitions can lead to fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most other obligations carry up to €15 million or 3%, and supplying incorrect information to authorities up to €7.5 million or 1%. For small and medium-sized companies the lower of the two amounts applies.
A practical plan in five steps
- List the AI tools your company uses, including the ones staff set up themselves.
- Determine the role and risk for each: are you a provider or a deployer? Does the use fall under Annex III?
- Rule out prohibited practices, especially emotion recognition of employees.
- Set rules and training: what may be put into AI, who checks the output and how AI literacy is supported.
- For agents, set up transparency, human oversight and a log of every step. It helps with the AI Act and with everyday quality control.
How we handle it in our projects
Every project starts with a risk classification under the AI Act and a personal-data check under GDPR. The agent only gets the access it needs, a person approves steps with consequences, and every action is logged. More in AI guardrails: keeping agents under control.
This article explains the regulation in plain words and is not legal advice. The text published in the Official Journal of the EU is authoritative.
Sources: Regulation (EU) 2024/1689 (AI Act), EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex