The EU AI Act at a Glance: Risk Tiers, Deadlines, and How to Implement It

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. As an EU regulation it applies directly in every member state — no separate national implementation law is needed. And it doesn't just cover companies that build AI systems; it explicitly applies to companies that merely use them.

The core idea: the law regulates not the technology as such, but the specific use case — graded by the risk it poses to health, safety, and fundamental rights. The higher the risk, the stricter the obligations. This produces four tiers:

Since 2 February 2025, certain AI practices have been completely banned in the EU because they violate fundamental rights. These include social scoring (rating people based on their social behavior with detrimental consequences), manipulative or deceptive techniques that materially distort people's behavior and can cause them significant harm, and the untargeted scraping of facial images from the internet to build recognition databases.

Particularly relevant for everyday working life: AI-based emotion recognition in the workplace and in educational institutions is prohibited — for example, software that continuously infers employees' emotional state from their voice or facial expressions. The only exceptions are medical and safety reasons, such as fatigue detection for professional drivers.

These prohibitions are absolute: there is no remaining transition period, and they cannot be lifted by obtaining the affected people's consent. So whenever you evaluate a new tool — especially from vendors outside the EU — always check whether it includes such features before you deploy it.

High-risk systems are permitted but subject to strict requirements. Annex III of the regulation lists the fields of use — especially relevant for mid-sized companies: AI in employment decisions (such as automatically pre-sorting job applications or software supporting promotion and dismissal decisions) and assessing the creditworthiness of natural persons. The main obligations fall on the providers of such systems, but deployers also have duties: use the system in line with its instructions, monitor its operation, and ensure effective human oversight by trained staff.

Limited risk is about transparency: anyone interacting with a chatbot must be able to tell they are talking to a machine. AI-generated or AI-manipulated content — deepfakes, for instance — must be labeled as such. For a customer service team this means, concretely: the chatbot on your website needs a clear notice that an AI is answering.

The vast majority of AI applications fall into the minimal-risk category: spam filters, spell checkers, most internal writing and research assistants. The AI Act imposes no special requirements here. The due-diligence rules from Lesson 4 — check outputs, keep sensitive data out of open tools — still apply, because data protection and liability law continue to operate independently.

The AI Act does not apply all at once but in stages. The key dates:

The fines are deliberately painful: deploying prohibited practices can cost up to 35 million euros or 7 percent of worldwide annual turnover — whichever amount is higher. Most other violations (such as breaches of deployer or transparency obligations) carry fines of up to 15 million euros or 3 percent, and supplying false information to authorities up to 7.5 million euros or 1 percent. For small and medium-sized enterprises, the lower of the two amounts serves as the cap.

For context: the fine catalogue in Article 99 contains no separate penalty for the training obligation in Article 4. But a lack of AI literacy can count against you in other violations and in liability cases — which is why documented training is your best safeguard, as described in Lesson 1.

For most mid-sized companies, the AI Act is not a mega-project but well-organized groundwork. Four steps form the foundation:

Also anchor clear ownership: one person or a small team that keeps the inventory current, vets new tools before use, and tracks the deadlines. AI literacy is not a one-off project — Article 4 requires a sufficient level on an ongoing basis, and the tool landscape changes fast.

This closes the loop on the course: you know why the training obligation exists, how the tools work, where they create value, and which risks you need to keep under control — and now also the legal framework all of this operates in. If you implement the four steps above, you are not just fulfilling an obligation; you are laying the foundation for using AI safely and productively in your company.