The AI Act is the new European regulation on artificial intelligence. It’s the first law in the world that defines how AI can be developed and used safely, fairly, and transparently.
For companies operating in Europe — or even those offering AI tools to European users — this marks a major turning point.
Below we’ll explain, in simple language, what the AI Act is, who it applies to, and what businesses need to do to comply.
1. What Is the AI Act and Why It Matters
The AI Act (Artificial Intelligence Act) was approved by the European Union in 2024 and will gradually enter into force between 2025 and 2026.
Its goal is to protect people’s rights while promoting innovation and trust in artificial intelligence.
In short, the law aims to ensure that AI in Europe is:
Safe – it must not endanger people or society.
Transparent – users should know when AI is being used and how it works.
Accountable – humans must stay in control of key decisions.
Ethical and non-discriminatory – respecting privacy, equality, and dignity.
Europe wants to set a global standard — just as it did with the GDPR — and show that technology can be advanced without losing human oversight.
2. Who Must Comply
The AI Act applies to any organization that develops, uses, or distributes AI systems within the EU.
This includes:
Developers and suppliers of AI systems;
Integrators who embed AI tools into their own products;
Distributors or importers of AI-based software or devices;
Users, meaning companies that apply AI tools in their daily activities.
So the law doesn’t only target tech giants.
It also concerns:
A marketing agency using ChatGPT to generate content;
An HR team using an AI system to screen job candidates;
A bank using algorithms for credit scoring;
A small business using AI-powered chatbots or analytics tools.
If your company uses artificial intelligence in any form, the AI Act applies to you.
3. How the AI Act Classifies Risks
The entire regulation is based on a risk-based approach.
Every AI system falls into one of four risk categories:
a) Unacceptable Risk – Prohibited AI
These are AI systems considered dangerous to human rights or safety.
Examples include:
Social scoring (ranking citizens based on behavior);
Real-time biometric surveillance of people in public spaces;
AI that manipulates human behavior.
Such systems are completely banned in the EU.
b) High Risk – Strictly Regulated
These systems are allowed, but only under strong obligations for safety, quality, and documentation.
They typically involve:
Recruitment and HR management;
Education, exams, or training evaluation;
Credit and banking;
Healthcare and critical infrastructure;
Law enforcement or migration control.
Companies using high-risk AI must carry out compliance assessments, provide detailed documentation, ensure human oversight, and be ready for external audits.
c) Limited Risk – Transparency Required
This group covers generative AI systems like ChatGPT, Copilot, or image generators, and any AI that interacts directly with people.
They must inform users clearly when content or communication is AI-generated and not human.
For example:
Chatbots must tell users they’re interacting with AI.
Deepfake videos must include visible warnings.
AI-generated text or images should be labeled as such.
d) Minimal Risk – Free Use
This includes simple or low-impact systems such as spam filters, predictive text, or recommendation algorithms.
These can be used freely but should still follow basic ethical standards and data protection rules.
4. Key Obligations for Businesses
Depending on the risk category, companies will need to fulfill different obligations.
The main ones include:
a) Technical Documentation
You must keep an updated record describing:
what the AI system does;
how it was trained (data sources, accuracy, limitations);
who is responsible for it;
potential risks and safety measures.
b) Transparency
Users must always know when they are dealing with an AI system, and for what purpose.
Example: a virtual assistant must disclose that it is not a human operator.
c) Human Oversight
AI cannot fully replace human judgment in critical decisions.
A responsible person must monitor the system, be able to pause or override it, and handle complaints or errors.
d) Data Protection and Fairness
AI systems must respect the GDPR, ensuring privacy, non-discrimination, and fairness in automated decision-making.
e) Certification for High-Risk Systems
High-risk AI tools will need a CE marking (similar to medical devices or safety products).
Without this certification, such systems cannot legally be placed on the EU market.
5. How Companies Can Prepare
Here’s a simple 5-step roadmap to prepare for the AI Act:
1. Map All AI Systems
List every AI system your company develops or uses — including external services or APIs — and understand how they work.
2. Assess the Risk
Classify each system according to the AI Act categories (high, limited, minimal).
This determines your obligations.
3. Create an AI Usage Policy
Write internal rules on when and how AI can be used, how data is handled, and who approves new tools.
4. Train Employees
Ensure your staff knows what the AI Act is and what it means in practice — for example, how to label AI-generated content or avoid sharing confidential data with public AI tools.
5. Keep Compliance Records
Prepare documents that prove you’re using AI responsibly.
For high-risk systems, keep logs, reports, and monitoring data ready for inspection.
6. Penalties for Non-Compliance
Like the GDPR, the AI Act includes severe financial penalties for violations:
Up to €35 million or 7% of global annual turnover for banned uses;
Up to €15 million or 3% for serious non-compliance (e.g., unapproved high-risk AI);
Up to €7.5 million or 1.5% for minor violations (e.g., lack of transparency).
Authorities will have broad powers to investigate, request information, and suspend non-compliant systems.
7. Opportunities, Not Just Limits
While some see the AI Act as a restriction, it’s also a huge opportunity for responsible innovation.
Companies that adopt transparent and ethical AI early will:
earn trust from customers and partners;
gain market advantage over competitors;
attract clients who value data protection and compliance.
In short, compliance with the AI Act can become a mark of quality — a guarantee that your technology is reliable, fair, and human-centered.
8. What to Do Now
Even before the law is fully enforced (by 2026), companies should start:
Appointing an AI Compliance Officer or internal reference;
Creating an AI inventory listing all tools and vendors;
Reviewing data practices to ensure GDPR alignment;
Updating supplier contracts and NDAs to include AI clauses;
Planning periodic audits and risk assessments.
Conclusion
Undeclared AI usage can expose your organization to serious compliance, privacy, and reputational risks.
Endoacustica’s AI Disclosure Assessment helps companies detect, evaluate, and manage hidden or unauthorized use of artificial intelligence across internal data, documents, and workflows.
With our expertise in cyber intelligence, forensics, and regulatory compliance, we provide clear, actionable insights to keep your business secure and fully AI-compliant under the EU AI Act.
Contact Endoacustica today for a professional assessment and ensure your organization stays transparent, compliant, and protected.