Know where AI is used
You cannot manage what you have not mapped. A living register of AI tools and use cases is the practical starting point — and the first thing an auditor or board will ask for.
REGULATION (EU) 2024/1689 · OFFICIAL JOURNAL, 12 JULY 2024
The EU AI Act: obligations, timeline and enforcement.
Regulation (EU) 2024/1689 — the Artificial Intelligence Act — entered into force on 1 August 2024 and applies in phases through 2027. It governs not only AI developers but every organisation that deploys AI systems in the EU. This page summarises the provisions most relevant to companies using AI, with references to the articles of the regulation.
THE TIMELINE
Four dates that decide your deadline.
Parts of the regulation already apply. The rest arrives on a fixed schedule.
- In force
Prohibitions & AI literacy
AI practices with unacceptable risk are banned (Art. 5). Article 4 requires every organisation using AI to ensure a sufficient level of AI literacy among staff — already a legal duty today.
- In force
GPAI & governance
Rules for general-purpose AI models and the EU governance structure (AI Office, national authorities) apply. Mainly relevant for model providers, but it means supervision is now operational.
- Next
Full application begins
The bulk of the regulation applies: transparency duties (Art. 50), obligations for deployers of high-risk systems, and national market surveillance with real enforcement powers.
- Upcoming
AI in regulated products
Requirements extend to AI embedded in products already covered by EU harmonisation legislation, such as medical devices and machinery.
WHAT IT MEANS FOR YOU
Five duties for companies that use AI.
As a deployer of AI systems, these are the obligations that land on your desk.
Ensure AI literacy (Art. 4)
Staff who use AI must understand its capabilities, limits and risks. This duty has applied since February 2025 and should be documented — who was briefed, on what, and when.
Use systems as instructed
When you deploy a high-risk system, you must follow the provider's instructions, ensure human oversight, and monitor operation. That requires knowing which of your uses are high-risk.
Be transparent (Art. 50)
People must be told when they interact with AI, and AI-generated content must be identifiable. Applies from August 2026 to chatbots, deepfakes and synthetic text published to inform the public.
Keep evidence
A disciplined process — screening rationale, approved policies, acknowledgements, supplier checks — is what demonstrates responsible use if a customer, authority or board asks.
THE FINES
What non-compliance can cost.
Fines are set as the higher of a fixed amount or a share of global annual turnover.
Prohibited AI practices (Art. 5)
Highest tier: up to €35 million or 7% of global annual turnover, whichever is higher.
Breaching most other obligations
Including deployer and provider duties for high-risk systems and transparency rules.
Supplying misleading information
Incorrect or misleading information to authorities.
COMMON QUESTIONS
What companies ask about the AI Act
Does the AI Act apply to us if we only use tools like Copilot or ChatGPT?
Yes, in practice. The moment your company uses AI, Article 4 (AI literacy) applies to you today, and transparency rules apply from August 2026. If any use case falls into a high-risk category — recruitment, credit scoring, biometric identification — deployer obligations apply too. What matters is how you use the tools, not which logo is on them.
Are we a 'provider' or a 'deployer'?
Most companies are deployers: they use AI systems built by others. You become a provider if you develop an AI system yourself, put your own name on an existing system, or substantially modify one. The screening in Mavenda flags when a use case might cross that line.
What is actually banned since February 2025?
Among others: manipulative or exploitative AI, social scoring, untargeted facial-image scraping, emotion recognition in workplaces and schools, and biometric categorisation inferring sensitive traits. If any tool you use does something like this, it must stop — regardless of size or sector.
What does 'AI literacy' mean in practice?
Article 4 requires a 'sufficient level of AI literacy' for anyone dealing with AI in your organisation — adapted to their role and the context of use. In practice: role-appropriate guidance on what AI can and cannot do, your rules for using it, and a record of who received it. That is exactly what the literacy briefings in Mavenda produce.
When can we actually be fined?
Enforcement of the prohibitions and AI-literacy duty is possible now. The main enforcement regime, including fines for deployer and transparency obligations, follows from August 2026 when national market surveillance authorities are fully operational.
Is this legal advice?
No. This page is a factual overview of Regulation (EU) 2024/1689, and Mavenda is a governance tool, not a law firm. For a binding assessment of a specific use case, consult a legal specialist.
WHERE TO START
Find out where your company stands.
Run the free 90-second check to see how the AI Act applies to your company — then let SmartStart™ take you to a documented baseline in under two hours.