--- title: "The EU AI Act: a Practical Overview | Pitch" description: "What the AI Act regulates, who it applies to, how the risk-based approach works and what the penalties are, as of October 2026." url: https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # The EU AI Act: a Practical Overview What the AI Act regulates, who it applies to, how the risk-based approach works and what the penalties are, as of October 2026. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework Regulation (EU) 2024/1689, the AI Act, entered into force on 1 August 2024 and applies in stages. It is the first horizontal regulation of AI in the EU and takes a risk-based approach: the higher the risk an AI system poses to health, safety or fundamental rights, the stricter the rules. An AI system is defined in Article 3(1) as a machine-based system designed to operate with varying levels of autonomy that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. Fixed-rule software that does not infer is outside this definition. The Act applies to providers that place AI systems or general-purpose AI models on the EU market, to deployers established or located in the EU, and, under Article 2, to providers and deployers in third countries whose output is used in the EU. It does not apply to systems used exclusively for military or national security purposes, to scientific research and development before a system is placed on the market, or to purely personal, non-professional use. The Act distinguishes four levels: - **Prohibited practices (Article 5)**, such as social scoring, manipulative techniques that cause significant harm, untargeted scraping of facial images and emotion recognition in the workplace and in education. These have applied since 2 February 2025. - **High-risk systems (Article 6 and Annexes I and III)**, for example AI used in recruitment, education, credit scoring or as a safety component of regulated products. They face requirements on risk management, data quality, documentation, logging, human oversight, accuracy and robustness. - **Transparency duties (Article 50)**, for chatbots, synthetic content such as deepfakes, and emotion recognition or biometric categorisation. These apply from 2 August 2026. - **All other systems**, which carry no specific obligations, although Article 4 on AI literacy applies to every provider and deployer. General-purpose AI models have their own chapter. Providers must keep technical documentation, give information to downstream providers, respect EU copyright law and publish a summary of the training content. Models with systemic risk carry additional duties. These obligations have applied since 2 August 2025. Fines under Article 99 reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other breaches, and EUR 7.5 million or 1% for supplying incorrect information to authorities. For SMEs the lower of the two amounts applies. ### The 2026 postponement In November 2025 the Commission proposed a "Digital Omnibus" to postpone the high-risk rules. It was adopted as Regulation (EU) 2026/1744, in force since 27 July 2026. The high-risk obligations for Annex III systems now apply from 2 December 2027, and for systems that are safety components of products under Annex I from 2 August 2028. Transparency duties under Article 50 were not postponed. The [timeline](https://www.pitch.law/academy/ai-act-compliance-timeline) explains the details. ## In practice A Ghent software company sells an HR platform that ranks job applicants and also uses a chatbot to answer customer questions. The ranking function is used for recruitment, which is a high-risk area in Annex III, so the company as provider will have to meet the high-risk requirements once they apply. The chatbot is not high-risk but must tell users that they are talking to an AI system, unless that is obvious. The company's customers, a retailer for example, are deployers. They must use the system in line with the instructions, ensure human oversight and inform candidates and workers' representatives. See [provider or deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act). A first step for either party is the same: list the systems, classify them and note the role. [Our register](https://www.pitch.law/technologies/ai-act-governance-toolkit) is built for this, and the [records of processing](https://www.pitch.law/technologies/privacy-register) cover the personal data involved. ## Frequently asked questions ### Does the AI Act apply to a company that only uses ChatGPT or similar tools? Yes, as a deployer. The obligations are light for general office use, but AI literacy under Article 4 applies, and transparency or high-risk duties can arise depending on how the tool is used. ### Does the AI Act replace the GDPR? No. Both apply when an AI system processes personal data. See [AI Act meets GDPR](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ### Are SMEs exempt? No. SMEs have lower maximum fines and some simplifications, but the substantive duties for high-risk systems apply regardless of size. ### Who supervises compliance? National market surveillance authorities supervise most systems; the Commission's AI Office supervises general-purpose AI models. Which national authorities are competent in each member state should be confirmed at the time of an actual matter. ## How this connects Our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) service turns this framework into an inventory, a classification and a plan. The articles on [risk classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) and [conformity assessments](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) go deeper on the two steps that matter most. ## In short - Risk-based rules: prohibited, high-risk, transparency, other - Applies to providers and deployers, also outside the EU - Fines up to EUR 35 million or 7% of turnover - High-risk rules postponed to December 2027 and August 2028 ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Clauses in Vendor Contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) [Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control.](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)