The EU AI Act Explained Simply: What Applies to You

The manager of a hardware store uses one chatbot to write her product sheets, another on her website to answer customer questions, and she has just tried a tool that sorts the résumés she receives. She has heard that "Europe passed a law on AI" and wonders whether she's in trouble. Probably not, but one of those three uses deserves more attention than the other two.

This article gives the big picture of the European AI regulation, often called the AI Act. It doesn't replace the text itself or legal advice. Part of the timeline has been changed by more recent texts, so always check the dates on official sites before making a decision.

What it is, in three lines

Regulation (EU) 2024/1689 is a European law that governs the placing on the market and use of AI systems. Its principle is simple: the riskier a use is for people, the stronger the obligations. It doesn't try to regulate the inner workings of every model, but what people do with them.

It distinguishes two roles that matter to you:

The provider develops an AI system or puts it on the market under its own name: a company that builds a chatbot, or a software vendor that sells a résumé-screening tool.
The deployer uses an AI system in a professional setting. The hardware store manager who plugs a chatbot into her website is a deployer.

A strictly personal, non-professional use falls outside the law. If you use a chatbot to help you write a letter to your landlord, there's nothing you need to do.

Four risk levels

Level	What it means	Examples
Prohibited practices	Uses considered unacceptable, banned	Social scoring of citizens, manipulation that exploits vulnerabilities, emotion recognition at work and in schools (except for medical or safety reasons)
High risk	Allowed, with heavy obligations	AI used for hiring and managing employees, access to education, granting credit, certain regulated products
Transparency	Allowed, with a duty to inform	Chatbots that talk with people, faked audio or video content, certain generated texts
Minimal risk	No specific obligation	Spell checkers, spam filters, most writing uses

Most of the uses described on our blog fall under the last row or the "transparency" row. The bans have applied since February 2025. For the rest, the application dates are staggered and have been adjusted by later texts, especially for high-risk systems: check the up-to-date timeline on the European Commission's website or on the CNIL's (the French data protection authority).

What applies to you if you're a professional

Know what you're doing with AI

The regulation asks companies that use AI to take measures so that their teams understand it well enough for their role. The exact wording of this obligation has evolved, but the principle remains training the people who use it. In practice, a small business can start with an internal page: which tools are allowed, which data never goes into them (see what you're better off never pasting), and who checks the results. The beginner mistakes make a good starting point for discussion.

Inform people when required

If your website offers a chatbot, the people using it must know they're talking to an AI, unless it's obvious. Content that imitates real people or events (image, video, audio) must be flagged as generated or altered, with exceptions, for example for artistic or satirical works where the notice can be discreet. A text of public interest published to inform people may also be covered. For images, also read commercial use of AI images.

Be careful with high-risk uses

Sorting résumés, scoring candidates, evaluating employees, deciding on access to credit or training: these uses fall into the high-risk category. If you're a deployer, you must in particular follow the provider's instructions, keep real human oversight, and inform the people affected. If you're considering such a tool, demand from your provider what it must supply to you, and have the use validated by a lawyer or a data protection officer. The GDPR applies on top of that. Our article on AI bias shows why this area is sensitive.

Inventory your uses

The first practical step is to know what you're doing with AI. Here is a prompt for drawing up that list with your team, which will serve as a basis for a discussion with a lawyer. AI is not a legal advisor: what it classifies is a hypothesis to verify.

Prompt

I run a hardware store with 12 employees. Here is the list of AI uses in our company:

1. [USE 1, E.G. WRITING PRODUCT SHEETS WITH A GENERAL-PURPOSE CHATBOT]
2. [USE 2, E.G. CHATBOT ANSWERING CUSTOMERS ON THE WEBSITE]
3. [USE 3, E.G. TOOL THAT SORTS THE RÉSUMÉS WE RECEIVE]

For each use, fill in a table: use, my role (provider or deployer), probable risk level under the European AI regulation (prohibited, high risk, transparency, minimal), possible obligation, question to ask a lawyer.
Do not cite any specific article or date: for those points, write "to be checked in the up-to-date text". If a use is too vague to classify, ask me a question instead of guessing.

Keep the last instruction: the timeline has changed several times, and AI tends to cite outdated dates with confidence. Check every answer against the official text or with a professional.

What you don't have to do

You don't have to audit the model behind ChatGPT, Claude, or Mistral: the obligations on the makers of general-purpose models fall on them, not on their users. You also don't have to stop everything: the vast majority of writing, summarizing, or brainstorming uses are minimal risk.

What you do have to do is know what you're using, train the people who use it, and not hand an AI a decision about someone's professional or financial life without human review.

For this week

List all the AI tools your team uses, including the ones employees started using on their own: ask them directly. Run the list through the prompt above, then submit the uses classified as "high risk" or "transparency" to your lawyer or your data protection officer, with today's date on your list.