The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, but its obligations arrive in stages. If your company uses AI, some of them already apply to you, whether you build models or simply use them.
What already applies
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices (Article 5), such as social scoring or exploiting people’s vulnerabilities, and the AI literacy duty (Article 4): staff who use or operate AI must have sufficient knowledge to do it responsibly. |
| 2 August 2025 | Obligations for general-purpose AI models, the governance structure, and the penalties framework. |
AI literacy is the one most companies overlook. It applies to deployers, meaning any organisation using AI under its own authority, not only to the companies that build it.
What arrives next
| Date | What applies |
|---|---|
| 2 August 2026 | Most of the remaining rules, including obligations for high-risk AI systems listed in Annex III and the transparency duties of Article 50 (for example, telling people they are interacting with an AI system). |
| 2 August 2027 | Rules for high-risk AI that is part of products already regulated by EU safety law (Annex I), and the deadline for general-purpose models placed on the market before August 2025. |
In November 2025 the European Commission proposed adjustments, as part of its “digital omnibus” package, that would delay some high-risk deadlines until the supporting standards are ready. Check the current status before planning around a specific date.
Is your use of AI “high-risk”?
Annex III lists the areas where AI systems are high-risk. For the sectors we work with, the most relevant are:
- Creditworthiness and credit scoring of individuals (AI used only to detect financial fraud is excluded).
- Risk assessment and pricing for life and health insurance.
- Employment: recruitment, screening candidates, decisions on promotion or termination.
- Access to essential public and private services.
A support chatbot or an internal document assistant is usually not high-risk, but it still carries transparency and AI literacy duties.
What deployers of high-risk systems must do
If you use a high-risk system built by someone else, the Act still gives you obligations, including:
- Use it according to the provider’s instructions, with human oversight by trained people.
- Keep the logs the system generates, for at least six months unless other law says otherwise.
- Inform workers and their representatives before using it at work.
- For some deployers, including banks and insurers using AI for credit scoring or insurance pricing, carry out a fundamental rights impact assessment before first use.
The penalties
Fines reach up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaches of most other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities. In Spain, supervision is led by AESIA, the Spanish AI Supervision Agency.
Where to start
- Make an inventory. List every AI system your company uses or builds, including the AI features inside tools you already pay for.
- Classify each one against the prohibited list, Annex III and the transparency rules.
- Name an owner for each system.
- Start keeping evidence now: what the system is used for, who oversees it and what it did.
- Train your staff. AI literacy has applied since February 2025.
The inventory and the evidence are the parts most companies struggle with, because AI use spreads faster than anyone can document it. That is the problem we built Hura to solve: it records AI use from the traffic itself.