The EU AI Act in plain English

The one-sentence version

The EU AI Act is a European Union law that sets rules for AI systems based on how risky they are, with duties falling mainly on the companies that build AI systems and, to a lesser degree, on the organizations that use them.

Who has to care

Companies inside the EU, obviously. But also companies outside the EU in two common cases: if they put an AI system on the EU market, or if the AI's output is used in the EU. A US or Mexican software vendor selling to EU customers can be in scope. A local shop using AI only domestically usually is not.

This is why 'does the AI Act apply to me?' cannot be answered by a slogan — it depends on where you are, where your provider is, and where affected people are. Our screening asks exactly those questions, and we never assume the Act applies to everyone.

The four risk levels

Unacceptable risk: a short list of banned practices — for example social scoring by governments, certain manipulation, and most real-time remote biometric identification in public by law enforcement. These are prohibited outright.

High risk: AI used in sensitive areas such as hiring, credit scoring, education admissions, critical infrastructure, law enforcement, and medical devices. These systems must meet requirements on data quality, documentation, human oversight, robustness, and transparency before and while they are used.

Limited risk: systems like chatbots must make clear to people that they are interacting with AI, and AI-generated content must be labeled in defined cases.

Minimal risk: everything else — spam filters, game AI, most business automation — carries no new duties under the Act.

Dates that matter

The Act entered into force on 1 August 2024 and applies in phases: prohibitions and AI-literacy duties since 2 February 2025; rules for general-purpose AI models and governance since 2 August 2025; transparency obligations (like chatbot disclosure) from 2 August 2026; the strict high-risk obligations for most listed use cases from 2 December 2027; and for AI embedded in regulated products (like medical devices) from 2 August 2028.

Worth knowing: in July 2026 the EU amended the Act (the 'Digital Omnibus on AI') and moved the high-risk deadlines — earlier guidance citing August 2026/2027 for high-risk duties is outdated. We track government sources and update our guidance when the law changes, which is exactly why date claims should always be checked against the current text.

What this is not

This article is general education, not legal advice, and this site is not a government or certification body. For decisions with legal consequences, talk to a qualified lawyer — our assessments are designed to make that conversation faster and cheaper, not to replace it.