EU AI Act: What the New AI Rules Mean for Companies

Guide · EU AI Act · Governance & regulation

The EU AI Act is the world’s first comprehensive AI law. What it means in concrete terms, which companies are affected and what leaders need to do now.

The EU AI Act is Europe’s answer to the question of how AI systems can be used fairly, transparently and in line with societal values. For companies, this is becoming increasingly relevant: one in five companies in Germany already uses AI, and adoption is growing rapidly.

This article gives a structured overview: What does the EU AI Act regulate? Which risk categories exist? And what do companies have to do concretely to be compliant?

What is the EU AI Act?

The EU AI Act is a European regulation on artificial intelligence, the world’s first comprehensive AI law. It creates a legal framework for the development and use of AI systems in the EU. The underlying idea: use the opportunities of AI and keep the risks as low as possible.

At its core is a risk-based approach. AI applications are divided into categories: from the ban on unacceptable practices to minimal risk without special regulation. The higher the risk to people, the stricter the requirements.

Why is AI being regulated?

AI now affects nearly every area of life: in medicine, systems support diagnoses; in recruiting, they filter applications; in lending, they assess risk. This inevitably puts questions of data protection, safety, fairness and fundamental rights in focus.

The EU AI Act addresses exactly these points. It ensures that AI systems are not used without control in areas that have a significant impact on people, without anyone taking responsibility for them.

The risk categories of the EU AI Act

1. Unacceptable risk: prohibited

Certain AI applications are banned entirely because they violate fundamental rights or undermine societal values. These include government social scoring, manipulative influence on vulnerable groups and real-time remote biometric identification in public spaces. Narrow exceptions for law enforcement are possible.

2. High risk: strict requirements

High-risk systems include AI in safety-critical products such as vehicles or medical devices, as well as AI in sensitive areas: critical infrastructure, education, employment, access to services, law enforcement and migration. Strict obligations apply to these systems: quality and risk management, representative data, complete documentation, human oversight, robustness and registration in an EU database.

3. Limited and minimal risk: baseline standards

Most AI applications are not subject to the strict high-risk requirements. Nevertheless, baseline safety standards must be met. AI-generated content must be labeled, and voluntary adoption of best practices is recommended.

Timeline: what applies when?

• June 2024: Regulation adopted.
• February 2025: Ban on unacceptable AI practices takes effect.
• +9 months from entry into force: Codes of conduct for providers and users.
• +12 months: Transparency obligations for general-purpose AI systems.
• +24 months: Full application of the regulation.
• +36 months: Obligations for high-risk applications under Annex I fully binding.

Transparency obligations for everyone

Regardless of the risk category, basic transparency requirements apply to all AI applications: AI-generated content must be clearly labeled, especially deepfakes and synthetic imagery. The use of copyrighted training data must be disclosed. And illegal content may be neither generated nor distributed.

What the EU AI Act means for companies in concrete terms

For many companies, the most important and most immediate requirement is Article 4 of the regulation: everyone who develops or uses AI in the EU must ensure that their employees have sufficient AI literacy. Concretely, this means: teams should know the opportunities and risks of AI systems, oversee them and be able to intervene at any time.

This is not an abstract demand, but a clear mandate for leadership and learning. Companies that build AI literacy today are not only compliant, they are also better prepared for the deeper requirements that will take effect in the coming years.