01 What it is
The first comprehensive binding AI law. A risk-based regulation that sorts AI by its impact on people, then sets matching duties. It governs builders (providers) and users (deployers). Employers using AI in the workplace are deployers, and buying a system does not move the duties off you.
In force since 1 August 2024. Directly applicable across the EU and EEA, with no need for national law to repeat it.
02 Who it applies to
It follows the people the AI impacts, not just your headquarters. If your company is based in the EU or EEA, you are in scope. If you sit outside the EU but the AI output affects people in the EU or EEA, you are in scope for those people.
The right question is not where is my company? but are any of the people this AI impacts in the EU or EEA?
03 The four risk tiers
Most workplace AI is high-risk.
Banned outright. Includes emotion recognition in the workplace, social scoring, and certain manipulative or exploitative uses. Live since 2 February 2025.
Annex III(4): recruitment and selection, promotion and termination, task allocation, performance monitoring. Allowed with strict deployer duties.
Chatbots, AI-generated content, deepfakes. Transparency duties apply: people must be told they are interacting with AI.
Spam filters, basic productivity tools. No specific duties under the Act.
04 Deployer duties
What the employer has to do.
| Article | Duty | What it means |
|---|---|---|
| Art 4 | AI literacy | Staff who use or are affected by AI need a baseline of training. Live now. |
| Art 26 | Human oversight | A qualified person must be able to understand, monitor, and override the system. |
| Art 26 | Instructions for use | Follow the provider's instructions. Use the system only as intended. |
| Art 26 | Input-data quality | Make sure the data you feed in is relevant and representative. |
| Art 26 | Monitoring and incidents | Watch performance, report serious incidents, keep logs for at least six months. |
| Art 26 | Inform workers | Tell workers and their representatives before a high-risk system is used on them. |
| Art 86 | Right to explanation | People affected by a high-risk AI decision can ask for a meaningful explanation. |
| Art 27 | Fundamental rights assessment | Mainly for public bodies, but worth knowing. |
05 Timeline
Live, coming and contested.
06 Penalties
The biggest fines of any AI law to date.
Figures shown in USD, converted from euros at current rates. The Act sets penalties in euros. Lower thresholds apply for SMEs.
07 Other laws to watch
We assess the EU AI Act only. Local employment, privacy and AI laws may also affect your AI use, depending on your jurisdiction.
See where your HR AI use sits.
Ten minutes. A quick readiness check to address potential risks