EU AI Act

What it is

The AI Act is a horizontal regulation, meaning it applies across sectors rather than to one industry. It sorts AI uses into tiers: prohibited practices, high risk systems, systems with transparency obligations such as chatbots and synthetic media, and everything else with minimal duties. It also sets separate requirements for providers of general purpose AI models, including documentation and copyright related policies.

Why it matters

Marketing and discovery teams increasingly use AI for content generation, personalisation, lead scoring, targeting and customer support, so the rules touch everyday work. Transparency duties affect how AI generated content and AI assistants are labelled to users, which has direct implications for trust and brand safety. The Act also applies to organisations outside the EU whose AI systems or outputs are used in the EU, so it is not only a European compliance question.

How it works

Teams usually start with an inventory of every AI tool and use case, then classify each one against the Act's tiers to see which obligations bite. High risk uses require documentation, risk management, human oversight, data governance and record keeping, while lower risk uses mainly need clear disclosure and sensible internal policy. Most organisations handle this with a cross functional group covering legal, security, data and marketing, supported by vendor due diligence on the AI suppliers they rely on.

When it applies

It applies to providers, deployers, importers and distributors of AI systems where the system or its output is used in the EU, with duties phased in over several years from the Act's entry into force. Review your position whenever you adopt a new AI tool, change how an existing one is used, or use AI in decisions affecting people such as recruitment, credit or access to services.

Examples

• A retailer labels AI generated product descriptions and chatbot replies so customers know they are interacting with or reading AI output.
• An HR team reviews an AI CV screening tool and finds it falls into the high risk category, so it adds human review and formal documentation.
• A marketing team adds AI specific questions to its vendor assessment, asking suppliers for model documentation and details of training data policies.

How it is measured

• Share of AI use cases inventoried and risk classified against the Act's tiers
• Number of high risk systems with complete technical documentation and human oversight in place
• Percentage of AI vendors with signed terms covering AI Act responsibilities
• Completion rate for internal AI literacy and policy training