Jun 19, 2026 · CloudMount editorial
Looking For an EU AI Act Summary? Here Are 10 Things You Should Know
The essentials of the EU AI Act for business owners, in plain English: inventory your tools, classify risks, and secure your data.
1–2. Start with scope and your role
1. The AI Act is not a single checklist for everything labelled AI. First establish whether the technology falls within the Act’s definition of an AI system and whether the activity is within scope. Some exclusions apply, including certain research activities and purely personal, non-professional use.
2. Your role affects your duties. A business using a third-party system under its authority will commonly be a deployer. A business developing a system, commissioning one under its name or making certain changes may have provider responsibilities. Importers and distributors have separate obligations.
3–4. Some duties started before the main application date
3. Under the enacted 2024 Regulation’s timetable, Chapters I and II have applied since 2 February 2025. That includes Article 4 on AI literacy. Providers and deployers must take measures, to their best extent, towards sufficient literacy among relevant staff and others operating systems on their behalf.
4. Prohibited practices also became applicable on 2 February 2025. Article 5 includes workplace emotion inference, except where intended for medical or safety reasons, alongside other specifically defined prohibitions. Read the conditions and exceptions rather than treating every controversial use as automatically prohibited.
5–6. High-risk classification needs context
5. “High-risk” is a legal classification, not simply a description of a powerful tool. Article 6 covers specified product-related systems and Annex III use cases, including certain employment, education and essential-service applications. Some Annex III systems can fall outside high-risk classification under Article 6(3), subject to its conditions; profiling of natural persons removes that exception.
6. Providers and deployers of high-risk systems have different responsibilities. Providers face requirements concerning risk management, documentation and conformity assessment. Deployers have obligations concerning use instructions, competent human oversight and monitoring. Fundamental rights impact assessments are required for specified deployers and uses, not universally.
7–8. Transparency and model obligations are distinct
7. Article 50 contains targeted transparency duties. Depending on the circumstances, people must be informed when they interact with AI; providers of systems generating synthetic content have marking obligations; and deployers have disclosure duties for deepfakes and certain public-interest text. These are not blanket requirements to label every AI-assisted document.
8. General-purpose AI models have a separate regime, with additional duties for models presenting systemic risk. Under the enacted timetable, the relevant model provisions began applying on 2 August 2025, with transitional arrangements for models already on the market. An organisation using an AI application should distinguish its duties from those of the model provider.
9–10. Track the phases and keep other laws in view
9. The enacted 2024 timetable sets 2 August 2026 as the general application date. Article 6(1) and corresponding obligations for specified product-related high-risk systems apply from 2 August 2027. Article 111 also contains transitional arrangements. Verify the current legislation and any enacted amendments before relying on a deadline; proposals alone do not amend the law.
10. AI Act compliance does not replace GDPR, employment, equality or other applicable obligations. Begin with an inventory recording each system’s purpose, supplier, users, information inputs and decision-making role. Assign an owner to classification and keep evidence of the reasoning as the system or its use changes.
Sources and further reading
General information only, not legal advice. Regulatory obligations depend on your role, context and the provisions in force.
Want to talk about your compliance?
Book a review