Short answer: the AI Act (Regulation (EU) 2024/1689) is the European law on AI. The higher the risk of a use, the stricter the rules. Most rules have applied since 2 August 2026. For most small businesses that simply use AI tools, it comes down to this: make sure your team knows what it is doing, and be open when customers deal with AI.
This article is general information, not legal advice.
A law based on risk
The AI Act sorts AI by risk:
- Banned uses, such as AI that manipulates people or exploits their vulnerabilities, social scoring, and AI that infers people's emotions in the workplace or in education (except for medical or safety reasons).
- High risk, for example AI in products already covered by EU safety rules, or AI in uses listed in an annex to the law. Strict requirements apply here.
- Transparency rules for, among other things, chatbots and AI-generated content.
- For everything else: few extra rules, but you still have to work on AI literacy.
What does this mean for you as a user?
In the law you are then a deployer: you use an AI system in your business.
- AI literacy (Article 4). You have to take measures to support the AI skills of staff who work with AI, tailored to their knowledge and experience and to what they use AI for. Since the 2026 amendment, you do not have to guarantee that everyone reaches a set level. The European Commission and member states have to support businesses with this, small businesses in particular.
- Transparency (Article 50). People must know they are dealing with an AI system, unless that is already obvious. That is mainly the provider's job. If you use AI to create a deepfake, you have to disclose it yourself.
The timeline (after the Digital Omnibus)
In 2026 the AI Act was amended by the Digital Omnibus on AI. The amendment entered into force on 27 July 2026 and, among other things, pushed back the high-risk rules.
| Date | What starts to apply |
|---|---|
| 1 August 2024 | The law enters into force |
| 2 February 2025 | Banned uses, definitions and AI literacy |
| 2 August 2025 | Rules for general-purpose AI models and governance |
| 2 August 2026 | Most rules, including transparency (Article 50). Supervision and enforcement begin. |
| 2 December 2026 | New bans on AI that creates non-consensual sexual deepfakes or child sexual abuse material |
| 2 December 2027 | Rules for high-risk systems in Annex III |
| 2 August 2028 | Rules for high-risk AI in products under Annex I |
Where to find more
The European Commission runs an AI Act Service Desk with the full, updated text per article, short summaries and FAQs.
As of October 2026. Legislation and guidance may still change; check the current situation at the source.
Sources
- AI Act Service Desk: Timeline for the implementation of the EU AI Act
- AI Act Service Desk: Article 3, definitions
- AI Act Service Desk: Article 4, AI literacy
- AI Act Service Desk: Article 5, prohibited AI practices
- AI Act Service Desk: Article 50, transparency obligations
- European Commission: AI Omnibus enters into force
- European Commission: AI Literacy, Questions & Answers
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- Council of the EU: Timeline artificial intelligence act
Accessed 21 October 2026.