EU AI Act: what changes for those who build or use AI systems

Regulation (EU) 2024/1689, known as the AI Act, is the European law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages: some rules have applied since 2025, most of the rest since August 2026, and the most demanding ones, for high-risk systems, have been postponed to 2027 and 2028.

It is not only about companies that build AI: a business that uses a chatbot for its customers or software that screens CVs has obligations too. Here we sum up how it works and what to do now, based on the text published on EUR-Lex and on guidance from the European Commission and the European Parliament.

This article is for information only and is not legal advice: for specific cases, consult a legal professional.

A risk-based approach

The AI Act does not regulate the technology as such, but its uses, grouped by level of risk:

• Prohibited practices: for example harmful manipulative techniques, social scoring, emotion recognition at work and in schools (with some exceptions), and untargeted scraping of facial images to build facial recognition databases. From 2 December 2026 the list also includes systems that generate child sexual abuse material or intimate images of identifiable people without their consent.
• High risk: systems used in sensitive areas listed in Annex III (recruitment and staff management, education, access to credit and essential services, critical infrastructure, justice, migration) or safety components of products that are already regulated, such as medical devices and machinery (Annex I). They require risk management, good-quality data, technical documentation, event logging, human oversight and cybersecurity.
• Transparency obligations: telling people they are interacting with an AI, marking generated text, images, audio and video so that machines can also detect it, disclosing deepfakes, and informing people when emotion recognition or biometric categorisation is used.
• Minimal risk: most applications, such as spam filters or video games, with no specific obligations.

General-purpose AI models, such as the large language models (LLMs) behind chatbots and assistants, have their own rules: the companies that develop them have documentation and copyright obligations.

The timeline as of October 2026

• 1 August 2024: entry into force.
• 2 February 2025: prohibitions and the AI literacy obligation (training the people who use or build the systems).
• 2 August 2025: rules for general-purpose models, governance and penalties.
• 2 August 2026: most of the regulation applies, including the transparency obligations. For generative systems already on the market before that date, content marking is required from 2 December 2026.
• 2 December 2027: obligations for Annex III high-risk systems (originally 2 August 2026).
• 2 August 2028: obligations for high-risk systems built into regulated products, Annex I (originally 2 August 2027).

The postponement comes from the Digital Omnibus on AI, proposed by the Commission in November 2025, approved by the European Parliament and the Council in June 2026 and published in the Official Journal of the EU as Regulation (EU) 2026/1744, in force since 27 July 2026. It also rewrote the AI literacy rule: providers and deployers must take measures to support it, without having to guarantee a specific level. A delay is not a cancellation, and guidelines and technical standards are still being prepared.

Provider or deployer: who does what

The regulation distinguishes between roles. The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. The deployer uses it under its own authority in a professional activity.

The heaviest obligations fall on the provider, but a deployer of a high-risk system must follow its instructions, assign oversight to competent people, keep the logs and inform the workers involved. Anyone who substantially modifies a high-risk system, or puts their own brand on it, becomes a provider in turn. With custom-built software, whether the software house or the client is the provider should be settled in writing.

An example close to our own work: in a recruiting system such as ATS, an AI feature that filters or scores applications would fall under the Annex III high-risk uses, while the CV archive or the step-by-step interview process would not.

In Italy: Law 132/2025

Italy’s national AI law, Law no. 132 of 23 September 2025, has been in force since 10 October 2025 and applies consistently with the AI Act. It names the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) as the national AI authorities, requires employers to inform workers when AI systems are used, and creates a criminal offence for the unlawful distribution of AI-generated or manipulated content. Some parts are left to government decrees.

What a company should do now

1. Inventory: list the AI systems in use or under development, including those inside purchased software and cloud services. In Artika, the theatre streaming platform we built on AWS, automatic subtitles (Amazon Transcribe) and video moderation (Amazon Rekognition) are AI services from a cloud provider: they belong in the inventory too.
2. Classification: for each system, the risk level and the company’s role, provider or deployer.
3. AI literacy: training matched to the role of the people who use, build or oversee the systems.
4. Documentation: purpose, data used, supplier, version, internal owner; for high-risk systems, the required technical documentation.
5. Human oversight: who checks the results, how a decision is corrected, how the system is suspended.
6. Transparency: notices in chatbots and labels on generated content.
7. Vendor checks: documentation, contract clauses, where the data is processed and GDPR compliance.

Much of this builds on the work already done for the GDPR, such as records of processing and impact assessments.

When we design applications with AI components, we plan logging, documentation and human oversight from the start, because adding them later costs more. If you want to review the systems you use, or you are designing a new one, let’s talk.