EU AI Act: what it really requires from companies
Regulation (EU) 2024/1689 unpacked: roles, risk categories, operational obligations and a 90-day action plan for companies in the EU.
Regulation (EU) 2024/1689 does not legislate technology in the abstract, but specific applications defined by their level of risk and by each organisation's position in the value chain. Most companies sit as users of systems built by third parties, not as providers. The operational priority is therefore to audit which tools are in use, for what purposes, under what data processing and who carries technical responsibility in each case. Note: this text is informational only and is not legal advice. Whether these rules bite depends on the specific scenario, so any strategy should be validated with specialists and checked against the official text of the Regulation, the European Commission and the competent national authorities.
In short
- The Regulation is structured by risk of use, not by technology: the same model can be out of scope in one case and high risk in another.
- The first step is not a legal opinion: it is an inventory of AI systems and agents with an owner, a purpose and its data.
- Most companies are deployers, with lighter obligations than a provider, but not zero.
- There is a cross-cutting obligation of AI literacy for staff who use these systems.
- Regulatory fit rests on the same things as operational quality: traceability, permissions and human oversight.
What is the EU AI Act and who does it actually bind?
It is Regulation (EU) 2024/1689, the European framework governing the placing on the market and the use of artificial intelligence systems in the Union. Being a regulation, it applies directly, with no national transposition needed.
It binds along the whole chain: whoever develops the system, whoever imports it, whoever distributes it and whoever uses it in a professional capacity. It also reaches companies outside the EU when the system's output is used inside the Union.
The useful question for a company is not "does it apply to me?", but "in which role and for which uses?".
Am I a provider or a deployer?
| Role | Who it is | Usual burden |
|---|---|---|
| Provider | Whoever develops an AI system and places it on the market or into service under their own name or brand | High: technical documentation, risk management, data quality, conformity |
| Deployer | Whoever uses an AI system in their professional activity | Medium: use in line with instructions, human oversight, information to affected people |
| Importer and distributor | Whoever brings an AI system from a third party into the EU or markets it | Medium: verifying that the system complies |
A practical warning: the role can change. A company that buys a model and modifies it substantially, or markets it under its own brand, may come to be regarded as a provider. That is one of the checks worth running with legal advice before launching a product with AI embedded.
How is the risk of an AI system classified?
The Regulation organises uses into four broad blocks. This table is indicative; the specific classification has to be done against the official text.
| Block | General idea | Typical business example |
|---|---|---|
| Prohibited practices | Uses considered unacceptable for their impact on fundamental rights | Manipulative techniques or exploiting vulnerabilities |
| High risk | Uses in sensitive areas listed in the Regulation (among others, employment, education, credit, critical infrastructure, certain regulated products) | Automated screening of job applications |
| Transparency risk | Interaction with people or generation of synthetic content | A customer service chatbot, AI-generated content |
| Minimal risk | Everything else | Internal invoice classification, summarising internal documents |
The operational consequence is clear: most internal superagents in an SME (posting entries, reconciling, documenting, preparing reports) fall into the lower blocks. The problems appear when AI touches decisions about people: selection, promotion, evaluation, access to credit or to essential services.
What practical obligations does a company that only uses bought-in AI have?
Without going into the letter of the text, the block of obligations that most affects a deployer translates into five management tasks:
- Use the system in line with the provider's instructions and do not repurpose it for uses it was not intended for.
- Ensure effective human oversight, with people who have the competence, the authority and the real means to intervene or stop the system.
- Control the quality and relevance of the input data the company supplies to the system.
- Inform the people affected where applicable, particularly in employment and public-facing contexts.
- Keep logs of the system's operation to the extent they are under the company's control.
On top of that sits a cross-cutting obligation many companies overlook: AI literacy for the staff who operate or are affected by these systems. It is not a ChatGPT course: it is that whoever supervises understands the limits of what they are supervising.
What about general-purpose AI and about agents?
The Regulation includes a specific chapter for general-purpose AI models, with documentation and transparency obligations for their providers, and additional requirements for those with systemic risk.
For a company that buys, the practical reading is different: an autonomous agent is not a category of its own in the Regulation. A Superagent is classified by what it does. If its process is documentary and internal, the regulatory risk is low. If it takes part in a decision about a person, it has to be analysed. And because the agent executes actions, a second front appears: AI agent security.
What timeline and which authorities apply?
The Regulation came into force in 2024 and applies in stages: different blocks of obligations become enforceable at different moments. The specific deadlines have been the subject of debate and of proposed adjustments at European level, so do not take any date from a blog article: check the current calendar in the official text and at the European Commission.
Supervision is carried out by the national authorities each member state designates, together with the competent sector regulators. In Spain, for example, that role sits with AESIA, the Spanish agency for the supervision of artificial intelligence, one of the first dedicated national AI authorities in the EU. Where personal data is involved, the data protection authority keeps its competence; we cover that in GDPR and artificial intelligence.
On penalties: the Regulation provides for a sanctions regime with maximum amounts tied to a percentage of worldwide annual turnover, more severe in the case of prohibited practices. Check the official text for the exact amounts applicable to each type of infringement.
What should you do in the next 90 days?
- Inventory. List every AI system and agent in use, including those a department contracted on its own. Shadow AI is the first real risk.
- Use classification. For each system: purpose, data it processes, decisions it influences, people affected.
- Role assignment. Determine, with legal advice, whether your company acts as a deployer or as a provider in each case.
- Agent record. Document the owner, purpose, permissions, limits of authority and withdrawal plan of each agent. The full template is in AI governance and the agent registry.
- Oversight and training. Name a responsible person per system and train the staff who supervise it.
- Review. Set a quarterly review of the inventory and an annual legal validation.
How NEXTAI does it
At NEXTAI, regulatory fit is not a final phase: it is layer 5 of the Enterprise Brain and phase 5 of the NEXT-5 Roadmap. Every superagent is born with an owner, permissions, limits of authority, KPIs and a record in the agent registry, and the Governance axis carries 20 of the 100 points of the IMAN (AI-Native Maturity Index). NEXTAI does not provide legal advice: it prepares the technical and organisational evidence so the client's legal adviser can work on documented facts.
Frequently asked questions
Does the EU AI Act affect an SME that only uses ChatGPT? It may, mainly through the transparency block and the AI literacy obligation for staff. The level of demand depends on what it is used for: summarising internal documents is not the same as screening job applications. Check your case with a legal adviser.
Is a superagent "high risk" because it is autonomous? Not for that reason. Classification depends on the use, not on the degree of technical autonomy. An agent that reconciles invoices and one that decides on a job application have very different regulatory profiles even if they share an architecture.
What is the first thing I should have ready? The inventory of AI systems and agents with owner, purpose, data and affected decisions. Without that inventory, no later legal analysis can be reliable, because nobody knows what there is to analyse.
Who supervises this? The national authority each member state designates, together with the competent sector regulators, and the data protection authority where personal data is involved. Check the current allocation in official sources, as the institutional framework is still being rolled out.
Making sure every member of staff who touches these tools is AI-literate is not optional. Beyond ticking a regulatory box, that training prevents critical operational errors: a supervisor who does not know the system's technical limits is not exercising real control, only signing off results uncritically. To get a rigorous inventory of your AI systems and move towards solid corporate governance, take our free Digital Audit.