The European AI regulation has entered its strict enforcement phase and has become a reference point well beyond the Union’s borders. If you do business with clients in the EU, it applies to you regardless of where your company is registered.
First distinction: do you build it or use it
The regulation draws a firm line between whoever develops an AI system and whoever deploys it. Most companies fall into the second group, where the obligations are considerably lighter – but not absent.
Risk tiers
A system falls into one of several risk categories, and everything else follows from that.
- Unacceptable risk – prohibited outright. This covers things like social scoring of citizens.
- High risk – permitted under strict conditions. Typically hiring, creditworthiness, access to education, critical infrastructure.
- Limited risk – transparency obligations. The user must know they are talking to a machine.
- Minimal risk – no specific obligations. Most everyday tools sit here.
Important: the category depends on the purpose, not the technology. The same model is minimal risk when it writes product copy and high risk when it makes hiring decisions.
What to do if you use AI
Take an inventory. Which AI tools does the company use, who uses them, for what, and with which data. Most companies doing this for the first time discover tools management did not know about.
Then check two things for each one: whether the task falls into a high-risk category, and what happens to the data you send. Some free services use your inputs to train their models, which is a problem under both this regulation and data protection law.
Third, make sure the staff using the tool understand its limits. The regulation expects a certain level of user competence, and in practice that means a short internal training session and a record that it took place.
Transparency toward users
If you run a chatbot on your site, visitors must know they are talking to a machine. If you publish AI-generated content, labelling is mandatory in some cases.
Practical advice
Do not buy expensive consulting before you have done the inventory. Most small companies find afterwards that everything they use sits in the minimal-risk band, and that their only real job is to write it down and set a usage policy. Only if something lands in the high-risk category does calling a lawyer make sense.