# The EU AI Act, explained: who has to do what, and when

URL: https://ai-pulse.aglaganova.com/blog/the-eu-ai-act-explained-who-has-to-do-what-and-when
Published: 2026-10-09
Author: Roman Aglaganov, Full-stack developer
Category: Policy
Region: Europe
Tags: regulation

> The world’s first comprehensive AI law sorts AI by risk, bans a few uses outright and phases in its rules over several years. Here is the plain-language version.

![The semicircular plenary chamber of the European Parliament in Strasbourg, seen from above](https://ai-pulse.aglaganova.com/api/media/file/eu-parliament-1.jpg)

The European Union’s Artificial Intelligence Act is the world’s first comprehensive law for AI. It entered into force on 1 August 2024 and applies to anyone who puts an AI system on the EU market, wherever they are based. If your product is used in Europe, Brussels is now part of your product team.

## Four levels of risk

Instead of regulating “AI” in general, the Act sorts uses by how much harm they could do:

**Unacceptable risk (banned):** social scoring, AI that manipulates people in harmful ways, building facial-recognition databases by scraping images from the internet, emotion recognition at work and in schools, and most real-time facial recognition by police in public spaces, with narrow exceptions.

**High risk (strict rules):** AI used in hiring, credit scoring, education, critical infrastructure, law enforcement and similar areas. Providers need risk management, good-quality data, documentation, human oversight and registration in an EU database.

**Limited risk (be transparent):** chatbots must tell you that you are talking to a machine, and AI-generated content such as deepfakes must be labelled.

**Minimal risk (carry on):** spam filters, video-game AI and most everyday tools face no new obligations.

Big general-purpose models, the engines behind chatbots, get their own chapter: technical documentation, a summary of training data, a copyright policy and, for the most powerful models, extra safety testing and incident reporting.

## The timeline

**2 February 2025:** the bans start applying, along with a duty to make sure staff using AI understand it.

**2 August 2025:** obligations for general-purpose AI models begin, backed by a voluntary code of practice published that summer.

**2 August 2026:** most remaining rules apply, including those for many high-risk systems.

**2 August 2027:** rules for high-risk AI built into products that already need EU safety checks, such as medical devices and machinery.

In late 2025 the Commission proposed pushing back some high-risk deadlines as part of a wider package to simplify EU digital rules, so check the Commission’s page for the current timetable before you plan around these dates.

## What happens if you ignore it

Fines for using banned AI practices can reach €35 million or 7% of a company’s worldwide annual turnover, whichever is higher. Lower tiers apply to other violations. That is enough to make even the largest companies read the small print, which is rather the point.

## Sources

- [Regulation (EU) 2024/1689 (the AI Act), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [European Commission: AI Act overview](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)