Important note
This is an overview and not legal advice. The regulation has been and is being amended, and deadlines may shift. State of this article: November 2026. Before making decisions, check the current status with the European Commission or legal counsel.
What it is about
The AI Regulation (Regulation (EU) 2024/1689) governs the use of AI in the EU following a risk-based approach. Certain practices are prohibited, high-risk systems face strict requirements, and other systems are mainly subject to transparency duties. A distinction is made between providers who develop systems and deployers who use them in a company. Most SMEs are deployers.
What deployers should keep in view
- Overview: which AI systems do we use, and for what?
- Assess the risk class: use in sensitive areas such as recruitment can trigger higher requirements.
- AI literacy: employees should know opportunities and risks. The design of the obligation was adjusted politically; training remains sensible in practice.
- Transparency: AI-generated content and chatbots can trigger labelling duties.
- Documentation: record purpose, provider, data types and persons responsible.
Timeline
Application is staged. Prohibitions and first obligations already apply, further rules follow. For high-risk systems the deadlines were postponed following the political agreement on the AI omnibus. Do not rely on individual dates from articles, including this one, but check the current status.
Practical steps
- Create an AI inventory.
- Introduce an AI policy.
- Train employees.
- Seek legal advice if in doubt about the risk class.