The EU AI Act in plain words: summary, deadlines and duties.
The EU AI Act regulates AI by risk. The transparency duties apply since August 2026; the high-risk rules were moved to 2027 and 2028. Read in a few minutes what applies to your company, from when, and what the AI literacy duty really requires.
Not legal advice · checked monthly
Prohibited AI practices are banned (Art. 5). Providers and deployers must support their staff’s AI literacy (Art. 4).
Obligations for general-purpose AI models, the governance framework and penalties apply.
People must be able to tell they’re talking to an AI; AI content is marked. Applies to ordinary assistants and to open source too.
Two further Art. 5 bans. Systems on the market before August 2026 must apply machine-readable marking by then.
Annex III systems, such as in recruitment or credit checks, must comply.
AI in regulated products (Annex I) must comply.
Key takeaways
- The EU AI Act (Regulation (EU) 2024/1689) regulates AI by risk: prohibited, high, transparency, minimal.
- Since 2 August 2026 the transparency duties of Article 50 apply, such as the AI notice in a chatbot.
- High-risk duties apply from 2 December 2027 or 2 August 2028 (Digital Omnibus, Regulation (EU) 2026/1744).
- Since February 2025 companies must take measures to support their staff’s AI literacy (Art. 4).
EU AI Act summary: the essentials in 60 seconds.
The EU AI Act regulates AI by its risk to people: the higher the risk, the stricter the duties. It applies to providers who develop AI systems or offer them under their own name, and to deployers who use them professionally. Most companies are deployers.
Prohibited (Art. 5)
Such as social scoring or manipulative AI. Applies since 2 February 2025; two more bans from 2 December 2026.
High-risk (Annex III and I)
Such as AI in recruitment or credit checks. From 2 December 2027 or 2 August 2028.
Transparency (Art. 50)
Chatbots, assistants and AI-generated content. Applies since 2 August 2026.
Minimal risk
Such as spam filters. No special duties: AI literacy under Art. 4 still applies.
Who does the EU AI Act apply to?
The EU AI Act applies to everyone who develops, offers or professionally uses AI systems in the EU, including providers outside the EU whose AI is used here. Providers carry most duties. Deployers, meaning companies using AI in daily work, mainly have to support AI literacy, meet transparency duties and use high-risk systems as intended.
If you offer an AI system under your own name, such as a chatbot on your own website, you may also have provider duties for it. Your legal advisers settle the role case by case.
EU AI Act: which duties apply from when.
Checked against the Digital Omnibus on AI: Regulation (EU) 2026/1744, in force since 27 July 2026.
| Date | What applies | Status |
|---|---|---|
| 2 Feb 2025 | Prohibited practices; AI literacy measures (Art. 4) | applies |
| 2 Aug 2025 | Duties for general-purpose AI models, governance, penalties | applies |
| 2 Aug 2026 | Transparency duties under Article 50 | applies |
| 2 Dec 2026 | Two new bans; machine-readable marking for systems on the market before August 2026 | next |
| 2 Dec 2027 | High-risk systems under Annex III | deferred |
| 2 Aug 2028 | High-risk AI in regulated products (Annex I) | deferred |
Transparency under Article 50: what applies since August 2026.
Article 50 covers four cases: AI that talks directly to people must identify itself; AI-generated content must carry machine-readable marking; people must be informed about emotion recognition and biometric categorisation; deepfakes and AI texts on matters of public interest must be disclosed.
The duties apply to ordinary systems, not only high-risk, and to open source too. The notice must be clear and come at the latest with the first interaction.
The EU AI Act training duty: what Article 4 really requires.
The EU AI Act does not prescribe a training duty with an exam or certificate. Since 2 February 2025, Article 4 requires providers and deployers to take measures to support their staff’s AI literacy. The Digital Omnibus clarified this in 2026: what is required is a genuine effort, not a specific result.
In practice four building blocks are enough: a usage policy, a short training that fits the use, a contact person for questions, and a record of who was informed when.
Implementing AI literacy under Art. 4, in four steps.
Set rules
A usage policy: which AI tools are allowed and which data may go in.
Train
A short training per role: how AI works, where it errs, how to check the source.
Name a contact
One person who answers questions and assesses new tools.
Document
Who was informed and trained when? That is your evidence.
Who is responsible in Germany, and what do breaches cost?
Supervision
The German AI market surveillance act (KI-MIG) makes the Federal Network Agency the central supervisor. Sector authorities remain responsible in some areas, such as BaFin for financial services.
Fines (Art. 99)
Up to €35m or 7% of worldwide annual turnover for prohibited practices; up to €15m or 3% for other duties, such as under Article 50.
KI-MIG: who supervises AI in Germany →
How RAGSuite supports you with the EU AI Act.
AI notice in the widget
Users see from the first message that they are talking to an AI.
Source on every answer
Traceable for your team and for an auditor.
Audit log
Community: 15 days; RAGSuite Engine and Enterprise: full with export.
Model documented
You set which model a project uses, and can prove it.
RAGSuite does not make you compliant with the EU AI Act automatically. It gives you the building blocks to prove your duties.
Which risk class does your AI fall into?
The free risk class check classifies your use in a few questions: no sign-up, in your browser.
Questions about the EU AI Act.
What does the EU AI Act regulate, in plain words?
The EU AI Act regulates AI by its risk to people. Some uses are prohibited, high-risk AI must meet strict requirements, and chatbots and AI content must be recognisable. Almost all companies must also support their staff’s AI literacy. The duties take effect step by step from 2025 to 2028.
Who does the EU AI Act apply to?
To everyone who develops, offers or professionally uses AI systems in the EU, including providers outside the EU whose AI is used here. Providers carry most duties. Companies using AI in daily work are mostly deployers: they mainly have to support AI literacy and meet transparency duties.
Is there a training duty under the EU AI Act?
Not in the sense of an exam or certificate. Since February 2025, Article 4 requires measures that support staff’s AI literacy; the Digital Omnibus clarified that a genuine effort is enough. In practice that means a usage policy, a short training, a contact person and documentation.
Did the August 2026 deadline disappear?
Only for high-risk systems. Those duties were moved by Regulation (EU) 2026/1744 to 2 December 2027 or 2 August 2028. 2 August 2026 was still a real deadline: since then the transparency duties of Article 50 apply, and authorities can enforce them.
Is our internal AI assistant a high-risk system?
Usually not. High-risk depends on the purpose, such as recruitment, credit checks or critical infrastructure (Annex III). An assistant that answers questions from handbooks and policies usually falls under the transparency duties. Your legal advisers confirm the classification in the individual case.
Does the EU AI Act apply to open source AI?
For the transparency duties of Article 50, yes: open source systems are not exempt there. That also covers internal assistants built on open software. Other duties have exemptions, but not the bans or high-risk rules. Your legal advisers clarify whether they apply.
The EU AI Act: calmly prepared.
Check your risk class for free, or talk to us about what applies to your use now.