The AI Act is the first broad law in the world to regulate the use of artificial intelligence. Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages between 2025 and 2027. Many executives see the law as a topic for lawyers and IT. That is a misconception that can prove expensive later: most of the obligations are about how an organization uses AI, who oversees it and what staff understand about it.
This article sets out what the law regulates, who the obligations apply to, which deadlines are in play and where an organization is wise to start. It is written for executives and managers who are not lawyers yet are responsible for the choices the law asks of them.
What the law is about
The AI Act is a product law with an organizational core. It regulates the conditions under which AI systems may be placed on the European market and used, and it does so on the basis of the risk an application poses to health, safety and fundamental rights. The higher that risk, the heavier the requirements.
The law uses a broad definition of an AI system: a machine-based system that operates with some degree of autonomy, that may be adaptive after deployment and that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions. That definition covers much more than generative AI. A model that scores applications, a tool that estimates the probability of default and software that optimizes rosters all fall under it. Traditional software with fixed rules generally falls outside it, although the boundary is not always sharp in practice. In early 2025 the European Commission published guidelines to clarify that boundary.
The law applies to everyone who places AI systems on the European market or uses them within the Union, regardless of where the provider is established. An American vendor of recruitment software selling to Dutch employers falls under it. Exempted are, among others, military applications, scientific research and development before a system is placed on the market, and purely personal, non-professional use.
Four roles, two that matter
The AI Act distinguishes between several roles in the chain. Providers develop an AI system, or have it developed, and place it on the market under their own name. Deployers are organizations that use an AI system under their own responsibility. The law also recognizes importers and distributors, whose main task is to check whether a provider has met its obligations.
For most Dutch organizations the deployer role is the relevant one. A municipality that uses an algorithm to prioritize applications, a hospital that deploys a triage tool or an employer that pre-screens applications with software falls into that category. They rarely build models themselves. They do use systems that fall under the law, often without anyone having mapped that.
Watch out for one pitfall. A deployer becomes a provider when it places a high-risk system on the market under its own name, substantially modifies it, or changes its intended purpose in a way that makes it high-risk. An organization that builds a generic language model into its own application for assessing applications can unknowingly take on the heaviest obligations in the law.
Four risk classes
The law takes a risk-based approach. The greater the risk to health, safety or fundamental rights, the heavier the obligations.
- Unacceptable risk. Prohibited practices, including social scoring of people by public bodies and companies, manipulative techniques that cause harm, exploiting the vulnerabilities of, for example, children or the elderly, predicting criminal behavior solely on the basis of profiling, untargeted scraping of facial images from the internet and emotion recognition in the workplace or in education, with limited exceptions for medical and safety purposes. This ban has applied since 2 February 2025.
- High risk. Systems in the domains listed in Annex III of the law: biometrics, critical infrastructure, education and vocational training, recruitment and workforce management, access to essential public and private services (including benefits, creditworthiness and insurance), law enforcement, migration and border management, and the administration of justice and democratic processes. AI that is a safety component of products covered by existing EU product legislation, such as medical devices and machinery, also falls here. This class carries extensive requirements on risk management, data quality, documentation, human oversight and registration.
- Limited risk. Systems with transparency obligations: people must know they are dealing with AI. Think of chatbots, and of synthetic images, audio or text that must be recognizable as such.
- Minimal risk. The vast majority of applications, from spam filters to text suggestions. The law sets no specific requirements here, although the general AI literacy obligation still applies.
One important nuance: an application in one of the Annex III domains is not automatically high-risk. The law contains an exception for systems that only perform a narrow, preparatory or procedural task and do not materially influence the outcome of a decision. A tool that sorts incoming applications by date is something different from a tool that ranks candidates by suitability. Profiling of people, however, is always high-risk. Anyone relying on this exception must document it.
View as table
| Risk class | Ban | Risk management and documentation | Human oversight | Transparency | Registration and logging | AI literacy (Art. 4) |
|---|---|---|---|---|---|---|
| Unacceptable risk | Prohibited: Since 2 February 2025. For example social scoring and emotion recognition at work. | Not applicable | Not applicable | Not applicable | Not applicable | Not applicable |
| High risk | Not applicable | Fully required: Providers: risk management system, technical documentation, data quality. Deployers: use as instructed and monitor. | Fully required: Oversight by competent, trained people. | Fully required: Inform affected people and workers. | Fully required: Registration in the EU database; keep logs for at least six months. | Fully required: Applies to everyone deploying AI. |
| Limited risk | Not applicable | Recommended: Voluntary codes of conduct. | Recommended: Good practice, no legal requirement. | Fully required: Tell people they are interacting with AI; label synthetic content. | Not applicable | Fully required: Applies to everyone deploying AI. |
| Minimal risk | Not applicable | Recommended: Recommended as good practice. | Recommended: Recommended as good practice. | Recommended: Recommended as good practice. | Not applicable | Fully required: Applies to everyone deploying AI. |
Source: Regulation (EU) 2024/1689. Summary, not legal advice.
The question is rarely whether the AI Act applies to your organization. The question is which systems you already use and which class they fall into.
General-purpose models
Besides AI systems, the law also regulates general-purpose AI models, the large language and image models that underpin many different applications. Since 2 August 2025, providers of such models must maintain technical documentation, provide information to parties building on their model, operate a policy for respecting copyright and publish a summary of the training data. Models with systemic risk, in practice the very largest models, face additional requirements on evaluation, incident reporting and security. In the summer of 2025 the Commission published a code of practice to help providers comply.
For organizations that use such models, for example through a subscription to a generative AI service, the direct obligations are limited. What does count: choosing a vendor whose documentation is in order, contractual agreements on data use, and the transparency obligations that apply as soon as staff publish AI-generated content.
The timeline
The law applies in phases. The key dates:
View as table
| Date | Milestone | What applies |
|---|---|---|
| 1 August 2024 | Entry into force | The AI Act enters into force. From this point the obligations start applying in phases. |
| 2 February 2025 | Prohibited practices and AI literacy | The ban on AI practices with an unacceptable risk applies. The AI literacy obligation (Article 4) now also applies to every organization that uses AI. |
| 2 August 2025 | General-purpose models and supervision | Obligations for providers of general-purpose AI models apply. The European AI Office and national authorities are operational and the penalty provisions apply. |
| 2 August 2026 | High-risk systems (Annex III) and transparency | Most remaining obligations apply, including those for Annex III high-risk systems (such as recruitment, education and public services) and the transparency obligations. |
| 2 August 2027 | High-risk systems in regulated products | Extended transition period for high-risk systems that are part of products covered by existing EU product legislation (Annex I), such as medical devices and machinery. |
Source: Regulation (EU) 2024/1689, Article 113. Simplified overview.
Since 2 August 2025 the obligations for providers of general-purpose AI models apply and the supervisory structure is in place, with the European AI Office and national authorities. Most remaining obligations, including those for Annex III high-risk systems and the transparency obligations, have applied since 2 August 2026. High-risk systems that are part of products covered by existing EU product legislation have a longer transition period, until 2 August 2027.
One caveat is in order. In the autumn of 2025 the European Commission proposed linking parts of the deadlines for high-risk systems to the availability of technical standards. For a specific high-risk system, check the current state of that amendment. The obligations around prohibited practices, AI literacy and transparency are not in question.
What is asked of deployers
For organizations deploying high-risk systems, the obligations in Article 26 broadly come down to this:
- Use the system according to the provider's instructions and take appropriate technical and organizational measures to ensure that.
- Organize human oversight by people with the right authority, training and support. Oversight on paper does not count; the person overseeing must actually be able to intervene.
- Ensure that input data are relevant and representative for the intended purpose, to the extent the organization controls them.
- Monitor the system's operation, inform the provider of risks or incidents and report serious incidents to the authority.
- Keep the logs the system generates, as a rule for at least six months.
- Inform workers and their representatives before a system is deployed in the workplace.
- Inform people who are subject to a decision taken with the help of the system.
- For public bodies and certain private parties: carry out a fundamental rights impact assessment before the system goes into use, and register the use in the EU database.
In practice this means an organization needs an owner for each high-risk system, a file with the instructions for use and the measures taken, a work instruction for human oversight and a process for reporting incidents. That is not a legal exercise. It is simply good management of a system that affects people.
The fundamental rights impact assessment
Article 27 requires public bodies, organizations delivering public services and organizations using AI for credit scoring or risk assessment in life and health insurance to assess the impact on fundamental rights before putting a high-risk system into use. That assessment describes the processes in which the system is used, for how long and how often, which groups of people may be affected, which specific risks of harm exist, how human oversight is organized and what the organization does if a risk materializes.
Organizations that already carry out data protection impact assessments under the GDPR will recognize the format. The fundamental rights impact assessment is broader: it looks at equal treatment, access to services and the ability to object, in addition to privacy. Set up well, both assessments can be combined in one process.
Transparency: people must know
Article 50 contains the transparency obligations that many organizations encounter first. Anyone deploying a chatbot or other AI that people interact with directly must make clear that it is AI, unless that is already evident from the context. Anyone distributing synthetic images, audio or video that look real, the so-called deepfakes, must disclose that. Anyone publishing AI-generated text on matters of public interest must make that known, unless a person has reviewed the text and holds editorial responsibility. And anyone using emotion recognition or biometric categorization where that is permitted must inform the people concerned.
Providers of generative systems must also ensure that outputs are marked as artificial in a machine-readable way. For deploying organizations the practical lesson is simple: record where in the organization AI generates content that goes out, and agree on how that is disclosed.
AI literacy: the obligation that touches everyone
Regardless of risk class, Article 4 requires all providers and deployers to ensure a sufficient level of AI literacy among staff who work with AI systems. That obligation has applied since 2 February 2025 and is the most underestimated one in practice.
The law does not prescribe a course, an exam or a certificate. It asks that people understand what the systems they work with do, which risks are attached and how to weigh the outputs, and it ties the required level to the role and the context in which someone works.
How to meet that obligation per role, which four levels of depth we distinguish and which mistakes organizations make along the way is explained in the article AI literacy has been an obligation since 2025. Here is how to approach it. One thing holds in any case: whoever documents nothing can demonstrate nothing.
AI literacy is the cheapest obligation in the entire law, and the first one you can put in place.
Supervision and fines
Supervision of the AI Act is shared. The European AI Office, part of the Commission, supervises providers of general-purpose models and coordinates implementation. For AI systems the member states are responsible, through national market surveillance authorities. In the Netherlands the Dutch Data Protection Authority and the Dutch Authority for Digital Infrastructure have been given a coordinating role, alongside the existing sector regulators who continue to watch over their own domains.
The sanctions are substantial. Violating the prohibitions can lead to fines of up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. For most other obligations the maximum is 15 million euros or 3 percent. Supplying incorrect information to authorities carries 7.5 million euros or 1 percent. For SMEs and start-ups the lower of the two amounts applies.
More important than the fines is the reputational risk. An organization that disadvantages an applicant or a citizen with a system nobody properly understood has more to lose than a fine. Earlier experiences with algorithmic decision-making in the Netherlands show how long such damage lingers.
Interplay with the GDPR and other rules
The AI Act comes on top of existing legislation; it replaces nothing. For most organizations the interplay with the General Data Protection Regulation matters most. As soon as an AI system processes personal data, both regimes apply at the same time. The GDPR sets requirements on the legal basis, purpose limitation and the rights of data subjects, and restricts fully automated decisions with legal effects. The AI Act sets requirements on the system itself and on the way it is deployed. A data protection impact assessment and a fundamental rights impact assessment complement each other and can be carried out in one exercise.
Sector rules continue to apply as well: the rules for medical devices in healthcare, financial supervision in lending and insurance, employment law and the role of the works council for systems that affect employees. Dutch public bodies also work with the national Algorithm Register, which gives insight into the algorithms they use. The AI Act makes such an overview mandatory and European for high-risk systems.
What this means per sector
Public sector. Municipalities, executive agencies and regulators use AI for prioritization, fraud detection, services and enforcement. Many of those applications fall under Annex III. For public bodies the fundamental rights impact assessment and the registration duty come on top. The public sector has the most obligations and, at the same time, the most experience with the consequences of opaque algorithms.
HR and recruitment. Systems that recruit, select or evaluate candidates or influence promotion and dismissal are high-risk. That also affects organizations that receive such features through their recruitment software without having consciously chosen them. Emotion recognition in job interviews or in the workplace is prohibited.
Healthcare. AI in medical devices falls under product legislation and therefore under the longer transition period until 2027, but also under the strictest requirements. Applications outside the medical domain, such as roster planning or administrative support, usually fall into the lower classes.
Financial sector. Credit scoring of natural persons and risk assessment in life and health insurance are high-risk, including the fundamental rights impact assessment. Fraud detection is exempted from the high-risk class, but remains under financial supervision.
Education. Systems that determine access to education, assess learning outcomes or monitor exams are high-risk. Emotion recognition in education is prohibited.
Five misconceptions
"We do not build AI, so the law does not affect us." Most obligations apply to use, not only to building. Whoever deploys a system carries responsibility.
"Our vendor takes care of compliance." The provider has its own obligations, but the deployer remains responsible for oversight, logging, informing staff and correct use.
"This only starts when the high-risk rules apply." The prohibitions and the AI literacy obligation have applied since 2 February 2025, and most other obligations since 2 August 2026. Anyone who has done nothing yet is behind.
"Generative AI is outside the law." Generative AI falls under the transparency obligations, under the rules for general-purpose models and, depending on the application, under the high-risk class.
"We have a policy, so we are done." A policy document without an inventory, ownership and training proves little. Regulators look at what happens in practice.
Where to start
Our conversations with organizations keep producing the same picture: nobody has a complete overview of which AI is already in use. An HR team uses a screening tool that came with the recruitment software. A department has built its own chatbot on a language model. A vendor has quietly switched on a "smart" feature. Without an inventory, compliance is a guess.
A workable approach fits in a quarter.
The first thirty days: overview. Inventory all AI systems in use, including features inside existing software. Determine for each system the organization's role (provider or deployer) and the risk class. Ask vendors for their documentation. Appoint a provisional owner per system.
Day thirty to sixty: basics in place. Draw up guidelines for the use of AI tools by staff. Determine the required level of AI literacy per role and plan the first training. Set up a light process for assessing new applications, so the next chatbot does not appear unseen again. Document what you have done.
Day sixty to ninety: high-risk first. Map the obligations for the high-risk systems: instructions for use, human oversight, logging, informing workers and affected people. Carry out the fundamental rights impact assessment where required. Decide which systems you want to keep, adapt or phase out.
Organizations that set this up properly now gain something beyond compliance: an overview of where AI is really being used in the organization and who is responsible for it. That overview is the starting point of every serious AI strategy. The law forces organizations to do something they should have been doing anyway.
Compliance with the AI Act is the first step towards AI an organization can rely on.
This article is a general explanation, not legal advice. For your specific situation, consult the text of the regulation and a legal specialist.
Farisch Hanoeman
Farisch works on everything that touches strategy. He advises organizations on how to implement AI: where to start and how to keep it from stalling after the pilot. He looks past the technology, at decision-making and at who in the organization becomes the owner of the result. That way he turns the ambition of a board into a course the rest of the organization can act on.
