The EU AI Act at a glance.

Not legal advice. This page summarises the legal situation in general and simplified terms. It does not replace a review of your individual case by a lawyer. As of 22 October 2026.

What the regulation is

Regulation (EU) 2024/1689, known as the AI Act, is the EU’s first comprehensive law on artificial intelligence. It applies directly in all member states. Obligations fall mainly on providers, who develop AI systems or place them on the market, and on deployers, who use AI systems under their own authority in a professional context. How strict the rules are depends on the risk of a use.

Regulation (EU) 2026/1744, the “Digital Omnibus” on AI, amended the AI Act in July 2026: deadlines for high-risk AI were postponed, the AI literacy obligation was reworded and new prohibitions were added.

Four risk levels

• Unacceptable risk – prohibited (Art. 5): for example social scoring, manipulative techniques that cause people significant harm, untargeted scraping of facial images from the internet, or emotion recognition at work and in education. From 2 December 2026, AI that generates intimate images of real people without consent or child sexual abuse material is also prohibited.
• High risk (Art. 6, Annexes I and III): AI in sensitive areas such as recruitment, education, creditworthiness assessment or critical infrastructure, and AI in products such as machinery or toys. Strict requirements apply to risk management, data, documentation, logs and human oversight.
• Transparency obligations (Art. 50): chatbots must be recognisable as AI, AI-generated content must be marked in a machine-readable way and deepfakes must be disclosed.
• Minimal or no risk: for example spam filters or AI in video games. The regulation sets no specific obligations for these; the AI literacy obligation, however, applies to the use of all AI systems.

What this means for businesses that use AI

If you use AI systems under your own authority in a professional context, you are a deployer under the regulation. For most uses – answering questions, drafting texts, sorting enquiries – these points matter most:

AI literacy (Art. 4)

Providers and deployers take measures to support the AI literacy of their staff and of other people who work with AI systems on their behalf, taking into account prior knowledge, experience and the purpose of use. Since the Digital Omnibus rewording, they do not have to guarantee a particular level; the obligation to take measures remains. It makes sense to offer training and to record who has learned what.

Transparency for chatbots (Art. 50)

AI systems that communicate directly with people must be designed so that people learn they are interacting with an AI – unless this is obvious. The information must be given clearly, distinctly and accessibly at the latest at the first interaction. Anyone who generates deepfakes or publishes AI-generated text on matters of public interest must disclose this; for texts, this does not apply if a person has reviewed them editorially and holds editorial responsibility.

Human oversight and documentation

For high-risk AI, Art. 26 requires deployers among other things to: use the system according to its instructions, assign human oversight to people with the necessary competence and authority, monitor operation and keep automatically generated logs for at least six months. Employers using high-risk AI at work inform staff and their representatives beforehand. These obligations apply from 2 December 2027. Outside the high-risk area, too, clear responsibilities, human approvals and traceable logs are good practice.

Supervision in Germany

Since 29 July 2026, the German AI Market Surveillance and Innovation Promotion Act (KI-MIG) has applied. The competent market surveillance authority is generally the Federal Network Agency (Bundesnetzagentur). It is also the single point of contact and complaints office and informs businesses through its AI Service Desk. For AI systems directly connected with regulated financial services and used by supervised companies, BaFin is responsible.