What is the EU AI Act?
The EU AI Act is the European law that sets rules for developing and using AI systems. Its official name is Regulation (EU) 2024/1689. The law entered into force on 1 August 2024 and applies directly in all EU member states.
The law works with risk levels: the greater the risk of an application to safety, health or fundamental rights, the stricter the rules. The rules apply to providers that place AI systems on the market and to deployers, the organizations that use AI professionally. If you use ChatGPT, Claude or an AI agent in your business, you belong to that second group.
This article describes what the rules ask for, as of October 2026. It is general information. Put your own situation to a lawyer.
When does the EU AI Act apply?
The EU AI Act applies in phases: the first rules have applied since 2 February 2025 and the last ones apply from 2 August 2028.
| Date | What applies |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | Prohibited AI practices and the AI literacy duty |
| 2 August 2025 | Rules for general-purpose AI models and for governance |
| 2 August 2026 | Transparency rules; the AI Office and national authorities enforce |
| December 2026 | Ban on AI that generates sexually explicit images without consent |
| 2 December 2027 | Rules for high-risk AI in sensitive areas (Annex III) |
| 2 August 2028 | Rules for high-risk AI in products such as lifts and toys (Annex I) |
Source: European Commission, as of August 2026.
What changed in the EU AI Act in 2026?
In 2026 the EU amended the AI Act with the AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The European Commission made the proposal on 19 November 2025 and a political agreement followed on 7 May 2026.
The changes that affect you as a business owner:
- High-risk rules apply later. The rules for high-risk AI in Annex III apply from 2 December 2027. The original date was 2 August 2026. For AI in products under Annex I it becomes 2 August 2028.
- AI literacy is worded differently. Article 4 now asks you to take measures to develop the AI literacy of your people. The law no longer prescribes a particular level.
- There is a ninth prohibition. AI systems that generate sexually explicit or intimate images without consent, or child sexual abuse material, are banned. That ban applies from December 2026.
- More companies fall under the lighter rules. Simplifications for SMEs now also apply to small mid-caps, including simpler technical documentation.
Older articles still mention August 2026 and August 2027 for high-risk AI. Those dates have been out of date since the amendment.
Which risk levels does the EU AI Act have?
The EU AI Act has four risk levels: unacceptable risk, high risk, transparency risk and minimal risk.
Unacceptable risk. These practices are prohibited. Examples are social scoring, harmful manipulation, emotion recognition in the workplace and in education, and the untargeted scraping of facial images from the internet or CCTV footage for recognition databases.
High risk. These are applications with major consequences for people. The Commission mentions, among others, software that sorts CVs in recruitment, credit scores that determine whether someone gets a loan, the scoring of exams and safety components in critical infrastructure. For these systems requirements apply on risk management, data quality, logging, documentation, human oversight and robustness.
Transparency risk. This level is often called limited risk. It concerns systems where people need to know they are dealing with AI, such as chatbots and AI-generated images and text.
Minimal risk. According to the Commission this covers the vast majority of AI systems in the EU, such as spam filters. The AI Act sets no rules of its own here. Other laws, such as the GDPR, still apply.
According to the Dutch Data Protection Authority it is your own responsibility to assess which risk group a system you develop or use falls into.
What do you arrange as a business owner for the EU AI Act?
As a business owner you arrange five things: an overview of your AI use, a risk classification, transparency, AI literacy and, for high-risk AI, the deployer duties.
Step 1: make an overview. List which AI tools and AI features your business uses, including the features inside your CRM, HR software or accounting package.
Step 2: classify each application. Determine the risk level per application. If you use AI in recruitment or in credit assessment, check whether the application is listed in Annex III.
Step 3: arrange transparency. Make sure people who communicate with your AI agent or chatbot know it is AI. If you create deepfakes or publish AI text on matters of public interest, Article 50 asks you to disclose that.
Step 4: work on AI literacy. Write down who works with which AI systems and which knowledge that requires. The AI literacy test shows where your team stands.
Step 5: follow the deployer duties for high-risk AI. Use the system according to the provider's instructions, organize human oversight, use relevant input data and report incidents to the provider and the supervisory authority. These duties apply from 2 December 2027.
Which rules apply to models such as ChatGPT and Claude?
For the models behind ChatGPT, Claude and Gemini, separate rules for general-purpose AI models have applied since 2 August 2025. Those rules are aimed at the providers of the models, such as OpenAI, Anthropic and Google.
The providers must, among other things, draw up technical documentation and have a policy to respect copyright. For models with systemic risk they must assess and mitigate those risks. The European AI Office supervises these model rules.
As a user of such a model you do not carry out those model duties yourself. Your duties lie in how you use the model: transparency, AI literacy and the rules of the risk level of your application.
How high are the fines under the EU AI Act?
The fines under the EU AI Act run up to 35 million euros or 7 percent of worldwide annual turnover. Article 99 has three levels:
| Infringement | Maximum fine |
|---|---|
| Prohibited AI practices | 35 million euros or 7% of worldwide annual turnover |
| Other obligations in the regulation | 15 million euros or 3% of worldwide annual turnover |
| Incorrect information to authorities | 7.5 million euros or 1% of worldwide annual turnover |
For large undertakings the higher of the two amounts applies. For SMEs and start-ups the lower of the two applies.
Supervision in the Netherlands was not yet fully laid down in law in October 2026. On 20 April 2026 the Dutch government put the proposal for the AI Act implementation law out for consultation. In that proposal existing regulators supervise within their own domain, and the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure get a coordinating role.
How does the EU AI Act relate to the GDPR?
The EU AI Act and the GDPR apply side by side: if your AI system processes personal data, you deal with both laws. The GDPR governs what you may do with personal data. The AI Act governs which requirements the AI system and its use must meet.
An example: software that assesses job applications processes personal data and so falls under the GDPR. The same software is listed as a high-risk application in the AI Act. What the GDPR asks of you when using AI is covered in using AI under the GDPR.
What does the EU AI Act mean for AI agents?
For an AI agent that answers customer questions or prepares administration, the transparency rules are the most important part of the EU AI Act. People who communicate with the agent must know it is an AI system.
If the agent makes decisions in an Annex III area, such as selecting job applicants or assessing creditworthiness, it can count as a high-risk system. Determine that before you put the agent into use.
Practical points for every business with an AI agent:
- Have the agent identify itself as AI at first contact
- Arrange that an employee can watch along and intervene
- Write down which data the agent processes and where it is stored
- State in your privacy notice that you use AI
How to introduce an agent step by step is covered in the step-by-step plan to implement an AI agent.
Frequently asked questions
Does the EU AI Act also apply to small businesses? Yes. The law applies to every organization that provides AI systems or uses them professionally, including SMEs. Which duties you have depends on the risk level of your application. Lower fine ceilings apply to SMEs.
When do the rules for high-risk AI apply? On 2 December 2027 for the sensitive areas in Annex III, such as recruitment, education and lending. For AI in products such as lifts and toys it is 2 August 2028. That follows from the July 2026 amendment.
Do I have to disclose that customers are communicating with AI? The transparency rules of the EU AI Act have applied since 2 August 2026. People must know they are communicating with an AI system. Have your AI agent or chatbot make that clear at first contact.
Is AI literacy still mandatory after the 2026 amendment? Yes. Article 4 remains an obligation for providers and deployers of AI. Since July 2026 the article asks you to take measures to develop AI literacy; the law does not prescribe a fixed level.
Who supervises the EU AI Act in the Netherlands? That was not yet fully settled in October 2026. In the government proposal of April 2026 existing regulators supervise in their own domain, coordinated by the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure.
Moving forward with AI in your business
Learn to apply AI responsibly in a 1-on-1 AI training, read what an AI agent costs or book a no-obligation call about your situation.
