EU AI Act: The Practical Guide for European Enterprises

The EU AI Act entered into force on 1 August 2024. Its requirements apply in phases: prohibited practices and AI-literacy duties started applying on 2 February 2025, governance and general-purpose AI obligations followed on 2 August 2025, and most remaining provisions apply from 2 August 2026. Some high-risk requirements have later dates.

For enterprises, this means navigating new obligations, risk categories, and compliance requirements. The question on many boardroom agendas: what does this actually mean for our AI initiatives?

The Act is risk-based rather than a general ban. Classification depends on a system's intended purpose and deployment context. In particular, some AI uses in employment and other sensitive areas can be high-risk, while other assistants mainly have transparency obligations.

The challenge: many organizations still do not understand exactly where their AI systems fall, which obligations apply, and how to demonstrate compliance.

This article provides a practical guide. No legal jargon, just concrete guidance. After reading, you will know which AI categories exist, where your applications most likely fall, and what steps to take.

The Structure: AI Categorized by Risk

The EU AI Act takes a risk-based approach. Not all AI is equal: a chatbot answering product questions is fundamentally different from a system that decides whether someone qualifies for a mortgage. The legislation recognizes this and creates four categories:

Category 1: Unacceptable Risk (Prohibited)

Certain AI applications are simply prohibited in the EU:

• Social scoring systems (as used in China)
• Biometric identification in public spaces (with exceptions for law enforcement)
• Manipulative AI that exploits vulnerable groups
• Emotion recognition in workplaces and educational institutions

This category is clear-cut: do not do it. Fines can reach up to EUR 35 million or 7% of global revenue.

Category 2: High Risk

AI systems that have significant impact on people's rights and safety:

• Credit decisions and insurance pricing
• Recruitment and selection (CV screening, interviews)
• Education: admissions and assessment
• Critical infrastructure
• Medical diagnostics
• Law enforcement

For high-risk AI, strict obligations apply:

• Risk assessment and mitigation
• Data quality requirements
• Technical documentation
• Human oversight
• Registration in the EU database
• Conformity assessment

Transparency duties for certain AI systems

The final AI Act does not make "limited risk" a universal product classification. Article 50 sets transparency duties for specific systems and outputs, including:

• Chatbots and conversational AI
• AI-generated content
• Emotion detection (outside prohibited contexts)
• Biometric categorization

Depending on the system, duties can include:

• Inform users that they are communicating with AI
• Make clear when content is AI-generated
• Marking certain AI-generated or manipulated content

Category 4: Minimal Risk

AI systems with no specific obligations:

• Spam filters
• Video game AI
• Inventory optimization

Here, only the general obligation to use AI "in a responsible manner" applies.

Where do enterprise knowledge assistants fall?

A knowledge assistant is not automatically high-risk. Its classification depends on its intended purpose and actual use. Article 50 transparency duties may apply to systems that interact directly with people, while an HR system used to make or materially influence employment decisions may fall into a high-risk use case. Examples that require a use-case assessment include:

• HR policy assistants
• Legal knowledge bases
• IT helpdesk AI
• Internal search systems

The transparency obligation means in practice: users must know they are communicating with AI, and when in doubt, they should be able to see where information comes from.

The Core Obligations: What Do You Need to Do?

Different obligations apply depending on the system, provider/deployer role, intended purpose, and deployment context.

Transparency Obligations (Article 50)

1. AI disclosure: Users must know they are interacting with an AI system, not a human. This can be simple: "You are speaking with an AI assistant."

2. Content marking: AI-generated text, audio, or images must be identifiable as such. For internal systems, this means clear labeling.

3. Source attribution: While not explicitly required by the AI Act, this aligns with the spirit of the law. When AI generates answers, best practice is to show the sources.

Governance Requirements

Regardless of the risk category, the law recommends:

• AI register: Document which AI systems you use
• Risk assessment: Periodically evaluate the impact
• Responsibilities: Appoint an AI officer
• Training: Ensure users understand how AI works and what its limitations are

The Overlap with GDPR

The EU AI Act does not replace GDPR. They complement each other. If your AI processes personal data (and that is almost always the case), both regulations apply:

| GDPR | EU AI Act | |------|-----------| | Legal basis for processing | Risk categorization | | Privacy by design | Transparency requirements | | Data subject rights | Human oversight | | DPA required | Technical documentation |

Organizations that take GDPR seriously have a head start: the principles of transparency, accountability, and data governance are comparable.

Timeline: When does what need to be in place?

• 1 August 2024: the AI Act entered into force
• 2 February 2025: prohibited practices and AI-literacy duties started applying
• 2 August 2025: governance rules and obligations for general-purpose AI models started applying
• 2 August 2026: most remaining provisions start applying
• 2 December 2027: rules for certain high-risk areas, including employment, start applying under the current implementation timeline
• 2 August 2028: rules for high-risk AI embedded in regulated products start applying

Source: European Commission, AI Act implementation timeline.

The message: there is time to prepare, but do not wait until the last moment.

Fines and Enforcement

The EU is not modest with sanctions:

• Prohibited AI practices: up to EUR 35 million or 7% of global revenue
• High-risk violations: up to EUR 15 million or 3% of revenue
• Incorrect information to regulators: up to EUR 7.5 million or 1.5% of revenue

National regulators are still being designated, but existing authorities (such as the Dutch Data Protection Authority in the Netherlands) are expected to play a role.

Compliance in Practice: From Theory to Implementation

Understanding legislation is step one. Implementing it within your organization is where things get complex. Here is a practical step-by-step plan.

Step 1: AI Inventory

Map out which AI systems your organization uses:

• Internally developed AI
• AI functionalities in SaaS products
• Third-party AI integrations
• Experiments and pilots

Many organizations underestimate how much AI they actually use. That "smart search function" in your knowledge base? That is AI. That automatic categorization in your ticketing system? Also AI.

Step 2: Risk Classification

Per identified system:

• Which category does this fall under?
• Which obligations apply?
• What is the current compliance status?

Tip: involve both IT and Legal. The technical reality and legal interpretation need to align.

Step 3: Gap Analysis

Identify where you fall short:

• Is transparency notification missing?
• Are sources not traceable?
• Is documentation missing?
• Is human oversight not defined?

Step 4: Remediation Planning

Prioritize based on:

• Risk level (high-risk first)
• Timeline (when do obligations take effect?)
• Impact (how many users, how many decisions?)

Step 5: Vendor Assessment

For AI you procure: evaluate vendors on:

• EU data residency
• AI Act compliance statements
• Transparency capabilities
• Audit trail functionality

Ask explicitly: "How does this product help me comply with the EU AI Act?"

The Role of Procurement

AI compliance starts with procurement. Include AI Act requirements in:

• RFPs and vendor selection criteria
• Contracts and SLAs
• Due diligence checklists

What to Look for in Compliant AI Solutions

1. EU-hosted: Data stays in Europe
2. Transparent operation: You can explain how the system arrives at answers
3. Source attribution: Every output is traceable to input
4. Audit logs: Who asked what, when, and what was the answer
5. Human oversight: Ability to review AI decisions
6. No training on customer data: Your data does not improve the model for others

Frequently Asked Questions and Misconceptions

"Do we need to stop using AI until we are compliant?"

No. Most enterprise AI can continue to run. The emphasis is on transparency and documentation, not prohibition. Start by inventorying and work toward the requirements that apply to your use case in phases.

"Does our knowledge base AI fall under high risk?"

Not necessarily. A system limited to searching documents and drafting source-linked answers is different from one used to make or materially influence decisions in areas listed as high-risk, such as employment. Document the intended purpose and obtain a use-case-specific assessment.

"What if our AI vendor is not EU-based?"

The AI Act applies to AI deployed in the EU, regardless of where the vendor is based. Ask your vendor about:

• Where data is processed
• Whether EU-specific options are available
• How they support compliance

"Is open-source AI exempt?"

Partially. Open-source AI models are exempt from some provider obligations, but if you deploy them in your organization, the deployer obligations still apply.

"How does this relate to sector-specific regulation?"

The AI Act works alongside existing regulation. In financial services, healthcare, and other regulated sectors, additional requirements may apply. The AI Act is a floor, not a ceiling.

"What if we only use Microsoft/Google/AWS AI?"

The major cloud providers are working on compliance, but the responsibility for correct use lies with you. Their tools may be compliant; your implementation determines whether you are compliant.

Conclusion: Compliance as Competitive Advantage

The EU AI Act is often presented as an obstacle. But forward-thinking organizations see it differently: it is an opportunity.

In a world where consumers and business clients are increasingly critical of AI usage, "we comply with the EU AI Act" is a trust signal. It communicates: we take AI seriously. We take privacy seriously. We take your rights seriously.

Organizations investing now in compliant AI are building a foundation that:

• Builds trust with customers and employees
• Minimizes risks with future legislation
• Enables faster adoption (less resistance)
• Prevents vendor lock-in (EU-hosted options are portable)

The EU AI Act is not the last piece of AI legislation. It is the first. Organizations that learn to navigate this landscape now are better prepared for what comes next.

The practical question is not "should I take this seriously?" The answer is yes. The question is "how do I start?" And the answer: start by inventorying, classifying, and documenting. Find vendors that support compliance. And remember: transparency is at the core.

AI you can trust starts with AI you can explain. To users, to regulators, and to yourself.