AI Act: safe and compliant use of AI

Q: Does the AI Act also apply to companies that only use AI?

Yes. The AI Act doesn’t apply only to AI developers and providers. Companies that use AI in their processes may also have obligations. The scope depends on the system’s purpose, its level of risk, and the organization’s role. For everyday tools, this will often mainly involve usage rules, AI literacy, data handling, and responsibilities. More sensitive scenarios may require a more detailed assessment.

Q: When do the AI Act obligations start to apply?

The AI Act entered into force on August 1st 2024, but its individual obligations are being phased in gradually. The regulation will become fully applicable in stages through 2028. This is because the amendment to the AI Act, known as the Digital Omnibus, which the EU approved in June 2026, postponed the deadlines for high-risk AI systems. February 2nd 2025: The ban on certain AI practices applies, along with the obligation to ensure an adequate level of AI literacy among people who work with AI. August 2nd 2025: The rules for providers of general-purpose AI models (typically large language models) and part of the rules for EU-level oversight apply. August 2nd 2026: The transparency rules take effect. For example, organizations must inform users that they are interacting with AI (chatbots) and label AI-generated content, including deepfakes. December 2nd 2027: The postponed deadline for the rules on stand-alone high-risk AI systems in areas where AI affects people’s rights or safety (HR, education, access to services, biometrics, infrastructure). The original deadline of August 2nd 2026 was pushed back by the Digital Omnibus. August 2nd 2028: The rules take effect for high-risk AI systems in regulated products covered by other EU harmonization legislation (medical devices, toys, cars).

Q: Do we have to keep a record of every AI tool we use?

The AI Act doesn’t require all organizations to keep the same blanket record of every tool. Formal registration mainly applies to high-risk systems. Without a basic overview, however, you won’t be able to determine where AI is being used, what data it works with, and whether any use case falls under a stricter regime. We will set the scope of the inventory based on the size of your company and how you use AI. For everyday tools, it can be simple. For HR, decision-making, or sensitive data, more information will be needed.

Q: What is a high-risk AI system?

It is a system whose use can significantly affect people’s safety, health, or fundamental rights. Typical examples include use in HR, education, access to services, critical infrastructure, or certain regulated products. The requirements for these systems are considerably stricter and cover, for example, risk management, documentation, data quality, logging, human oversight, accuracy, and cybersecurity.

Q: How does the AI Act relate to GDPR?

AI systems often process personal data, so GDPR remains just as important alongside the AI Act. Some use cases will require addressing the legal basis, data minimization, transparency obligations, retention periods, data protection impact assessments, or the risks of automated decision-making. The AI Act doesn’t replace GDPR; rather, it adds another layer of rules.

Q: What does AI literacy mean for employees?

People who work with AI or make decisions about its use must understand its capabilities, limitations, and risks. This doesn’t mean the same training for everyone. An everyday user of generative AI needs different knowledge than an HR team using AI in recruitment, and management approving the rollout of a new system needs different knowledge again.

Q: What are the fines for breaching the AI Act?

Penalties depend on the severity of the infringement. Prohibited AI practices can result in fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher. For failing to meet obligations relating to high-risk systems, the cap is €15 million or 3% of turnover, and for supplying misleading information to regulators, €7.5 million or 1%. For small and medium-sized enterprises, the lower of the two amounts applies. In addition to fines, organizations may face a ban on using a specific AI system and reputational damage.

The AI Act applies to companies that develop, deploy or sell AI, or use it in their internal processes. We help you map the AI tools you use, establish your role under the AI Act, assess the risks, and put rules and documentation in place – and we train your people to use AI tools properly.

What the AI Act requires and who it affects

The AI Act is Regulation (EU) 2024/1689, which sets the rules for developing, buying, deploying and using artificial intelligence. How much it asks of you depends on your role in relation to a specific AI system and what you use it for. A provider of its own AI solution faces different rules from a company that uses a chatbot, Copilot or an AI tool in recruitment.

Most everyday tools fall into the limited or minimal risk categories. Stricter requirements apply, for example, to systems used in HR, education, critical infrastructure, the provision of certain services, or decision-making that can significantly affect a person.

Obligations under the AI Act are not set for a company as a whole. They depend on the specific tool, how it is used, the organisation's role and the level of risk. The Act may apply, for example, to organisations that:

use ChatGPT, Copilot or other AI tools at work,
deploy AI in HR, recruitment, customer support or decision-making,
buy systems that already have AI features built in,
develop their own AI solutions for customers,
modify or resell other providers' AI products.

How can we help

We help you get AI use in your company under control, with clear rules in place and your AI Act obligations met. We map the AI tools in use, establish your role under the AI Act and identify where legal, security or operational risks arise. We then prepare the rules, documentation and staff training, and tie the AI Act in with GDPR, cybersecurity and your internal processes.

AI tool inventory

We find out which AI tools your organisation uses, who works with them, for what purpose, and what data goes into them.

Role and classification

For each system, we establish your role and assess whether it is an ordinary use, a system subject to transparency obligations, or a high-risk system.

Rules for using AI

We set rules for approving tools, handling data, verifying outputs, human oversight and using AI in sensitive processes.

Risk and supplier assessment

We examine the risks of specific AI solutions and set up a process for vetting AI suppliers before you buy or deploy.

AI documentation

We draw up your AI tool inventory, internal rules, checklists, risk assessment materials and other documents to match your role and the system's risk level.

AI literacy training

We train management, people in responsible roles and employees according to how they work with AI, and explain where the practical limits of AI use lie.

TRUSTED BY ORGANISATIONS IN MANUFACTURING, IT, ENERGY AND BEYOND

How we work with you

We start by finding out how AI is actually used in your company. Not just which tools IT buys, but also where people bring in tools on their own, for which tasks and with what data.

We then assess each use of AI by its risk and your role under the AI Act. On that basis, we set rules, responsibilities and controls so that everyday AI use stays simple and clear for employees while more sensitive cases get the oversight they need.

We don't treat AI Act compliance as yet another standalone workstream. We link it to GDPR, information security, supplier management and the rules you already have in place.

We set AI rules according to actual risks, not the name of the tool.
We build on what you already have. We don't start from scratch where what you already use can reasonably be put to work.
We involve the people who actually use AI – not just IT, legal or security.
We don't ban AI across the board. We help you decide where it makes sense and where the risk becomes unacceptable.

Frequently asked questions

Does the AI Act also apply to companies that only use AI?

Yes. The AI Act is not just for AI developers and providers. Companies that use AI in their own processes may have obligations too. The extent depends on the system's purpose, its risk level and the organisation's role. For everyday tools, it mostly comes down to usage rules, AI literacy, data handling and responsibilities. More sensitive scenarios may call for a more detailed assessment.

When do the AI Act obligations start to apply?

The AI Act entered into force on 1 August 2024, but its obligations are being phased in gradually until 2028. That is because the Digital Omnibus – an amendment to the AI Act adopted by the EU in June 2026 – pushed back the deadlines for high-risk AI systems.

2 February 2025: the ban on certain AI practices applies, along with the obligation to ensure an adequate level of AI literacy among people who work with AI.
2 August 2025: the rules for providers of general-purpose AI models (typically large language models) apply, together with part of the rules on EU-level governance.
2 August 2026: transparency rules start to apply. Organisations must, for example, tell users when they are interacting with AI (chatbots) and label AI-generated content, including deepfakes.
2 December 2027: the postponed deadline for the rules on stand-alone high-risk AI systems in areas where AI affects people's rights or safety (HR, education, access to services, biometrics, infrastructure). The original date of 2 August 2026 was moved by the Digital Omnibus.
2 August 2028: rules start to apply for high-risk AI systems in regulated products covered by other EU harmonisation legislation (medical devices, toys, cars).

Do we have to keep a record of every AI tool we use?

The AI Act does not require every organisation to keep the same blanket record of every tool. Formal registration mainly concerns high-risk systems. But without a basic overview, you won't know where AI is being used, what data it handles, or whether any use case falls under a stricter regime. We scale the inventory to the size of your company and the way you use AI. For everyday tools, it can be simple. For HR, decision-making or sensitive data, more information will be needed.

What is a high-risk AI system?

It is a system whose use can significantly affect people's safety, health or fundamental rights. Typical examples include use in HR, education, access to services, critical infrastructure or certain regulated products. The requirements for these systems are considerably stricter and cover areas such as risk management, documentation, data quality, logging, human oversight, accuracy and cybersecurity.

How does the AI Act relate to GDPR?

AI systems often process personal data, so GDPR remains just as important alongside the AI Act. Some uses will require you to address the legal basis, data minimisation, information obligations, retention periods, impact assessments or the risk of automated decision-making. The AI Act does not replace GDPR; rather, it adds another layer of rules.

What does AI literacy mean for employees?

People who work with AI or decide how it is used must understand its capabilities, limitations and risks. That doesn't mean the same training for everyone. An ordinary user of generative AI needs different knowledge from an HR team using AI in recruitment, or from management approving the roll-out of a new system.

What are the fines for breaching the AI Act?

Penalties depend on the seriousness of the breach. Prohibited AI practices carry a fine of up to €35 million or 7% of worldwide annual turnover, whichever is higher. For failing to meet obligations relating to high-risk systems, the cap is €15 million or 3% of turnover; for supplying misleading information to regulators, it is €7.5 million or 1%. For small and medium-sized enterprises, the lower of the two amounts applies. Beyond fines, you also risk a ban on using the AI system in question, as well as reputational damage.

Need clear rules for using AI?

We'll map which AI tools your organisation uses, what for, and where risks or obligations may arise. We'll propose next steps and help you put rules, responsibilities and documentation in place, so that AI doesn't remain a grey area between IT, legal, security and individual teams.