Term
AI Act
The EU regulation that sorts AI systems by risk and assigns duties by role. A supplier of a system carries different obligations from a company that only uses it.
Updated
What it means
The AI Act is a directly applicable EU regulation. It sorts artificial intelligence systems by risk: prohibited practices, high-risk systems, systems that owe transparency, and everything else.
Duties follow the role, not the technology. One set applies to whoever develops a system or supplies it under their own brand, another to whoever merely uses it; most companies are in the second group.
For an ordinary company the closest category is the transparency duty. A customer chatting with a bot must know it is not a human, and AI-generated content that could pass for real must be labelled as such. It is not a ban on using the technology, but a duty not to hide from people what they are dealing with.
How it works in practice
The first step is an inventory: which AI tools the company uses, for what, on which data and from which supplier. Recruitment, appraisal and monitoring of staff are where the rules bite hardest.
The Act does not replace GDPR: personal data still needs a legal basis and, for risky use, an impact assessment. On networks it overlaps with NIS2, so it is run as one compliance agenda, not three folders.
In an accounting firm the Act touches, for instance, tools that read documents through AI-driven OCR and propose postings, or assistants that answer clients. For each one we record who checks the output: the system’s proposal is approved by an accountant, and responsibility for the entry stays with a person, not with the software supplier.
What to watch out for
The costliest mistake is supplying someone else’s model under your own brand: the user becomes the provider, with every duty that follows. The second is screening CVs with a tool nobody told applicants about and that keeps no logs.
The regulation also expects companies that use such systems to ensure adequate AI literacy among their staff. Without an internal rule people paste contracts, payroll or client data into public chat tools, and since no data processing agreement is in place with the tool’s provider, that is a GDPR problem as well.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.