On 21 May, the Council of the EU gave its final approval, and Europe now officially has the world’s first law dedicated to artificial intelligence: the AI Act. Almost a year ago I wrote about what Europe was preparing on AI regulation. Since then the text has gone through long negotiations, and what was a draft has become a regulation.
Since I founded AI Expo Europe, the question I hear most often from entrepreneurs is no longer “what can AI do?” but “what am I allowed to do with AI?”. So I tried to put down, as practically as possible, what the law means for an ordinary company. One important caveat: I am an entrepreneur, not a lawyer. What follows is a map to help you find your way, not legal advice. For your specific situation, talk to a lawyer who knows the regulation.
What was adopted, in short
The European Parliament voted for the AI Act on 13 March 2024, and on 21 May the Council of the EU gave it final approval. It will be published in the Official Journal in the coming weeks and will enter into force 20 days after publication. Because it is a regulation, not a directive, it applies directly in every member state, Romania included, without waiting for national legislation.
The core idea is simple: it does not regulate the technology itself, but how it is used. The higher the risk to people, the more obligations apply.
The risk categories
- Unacceptable risk (banned). Social scoring, manipulative techniques that exploit people’s vulnerabilities, untargeted scraping of facial images from the internet or CCTV to build databases, emotion recognition in workplaces and schools (with some exceptions) and, for the most part, real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions).
- High risk. Systems used in sensitive areas: recruitment and employee management, credit scoring, education and student assessment, access to essential services, critical infrastructure and more. Requirements here are serious: risk management, data quality, documentation, human oversight.
- Limited risk. Mainly transparency duties: people must know when they are talking to a machine or when content has been generated artificially.
- Minimal risk. Most applications: spam filters, product recommendations, writing tools. In practice, no new obligations.
Separately, there are rules for general-purpose AI models, the large models that tools like ChatGPT are built on. These are overseen by an AI Office set up within the European Commission.
Provider or deployer? You are probably the second
The law draws a distinction that matters a lot. A provider is whoever develops an AI system and places it on the market. A deployer is the company that uses the system in its business. If you run an online store with a chatbot bought from someone else, you are a deployer. If you build your own AI product and sell it, you become a provider, and the obligations grow.
The good news for most small businesses: the heaviest obligations fall on providers. The less good news: deployers have responsibilities too, especially if they use high-risk systems. And if you substantially modify a system or put it on the market under your own name, you may end up being treated as a provider.
A practical checklist for your company
- Take inventory. List every AI tool your company uses: the chatbot on your website, writing assistants, image generators, CV screening tools, scoring systems, automated analytics. Include what employees use “on their own”.
- Classify them by risk. For each one, ask: which category does it fall into? Most will be minimal or limited risk.
- Check the sensitive areas. Do you use AI to screen candidates, evaluate employees, decide who gets credit or grade students? Then you are very likely in high-risk territory. And make sure nothing you do touches the banned practices.
- Be transparent. Tell customers clearly when they are talking to a chatbot. Label images, videos and voices generated or altered with AI, especially those that look real. I wrote about the risks in my piece on deepfakes and elections.
- Train your team. The law requires a sufficient level of AI literacy for the people working with these systems. They do not all need to be engineers, but they should know what the tools can and cannot do, where they make mistakes and what data must never be fed into them.
- Document. Keep a simple record: which system you use, for what purpose, who is responsible for it, what checks you run. If someone asks, a document beats an improvised explanation every time.
- Review your vendor contracts. Ask vendors whether their product is ready for the AI Act, which risk category it falls into and what documentation they can give you. Get it in writing.
- Do not forget GDPR. The AI Act does not replace data protection. If your AI processes personal data, all the GDPR rules still apply. If you went through GDPR preparation back in 2018, part of the work is already done.
The timeline: not everything applies tomorrow
Obligations phase in gradually, counted from the date the regulation enters into force:
- after 6 months: the bans on unacceptable-risk practices;
- after 12 months: the rules for general-purpose AI models;
- after 24 months: most obligations;
- after 36 months: certain obligations for high-risk systems.
That sounds like plenty of time, but GDPR taught us that companies that leave everything to the last minute end up paying consultants in a panic. And the fines are far from symbolic: for banned practices they can reach 35 million euros or 7% of global annual turnover, whichever is higher.
My take: a reasonable framework, with a real risk
I think the risk-based logic is right. I do not want to live in a society with social scoring, or one where street cameras recognise and track me for no reason. And I believe customers have a right to know whether they are talking to a person or a program. On this, Europe has chosen well.
The risk lies elsewhere: bureaucracy. A corporation hires a compliance team. A five-person startup cannot. If interpretations get convoluted and every national authority asks for something different, small firms will be discouraged precisely where they could innovate the most. The regulation provides for regulatory sandboxes, environments where startups can test products under the supervision of the authorities. How they are implemented will matter enormously: if they are real and accessible, they can make the difference.
One more thing. Europe is very good at rules, but AI is not won with rules alone. We need investment in research, in computing power, in startups and in people. Otherwise we risk having the best-regulated AI market in the world, full of products built somewhere else.
What you can do this week
Do not panic, and do not ignore it. Take inventory, put a risk label next to each tool and discuss only the areas that stand out with your lawyer. For most small businesses the conclusion will be reassuring: you can keep using AI for everyday automation, with a bit of transparency and plenty of common sense.
Which AI tools does your company use, and have you already checked which category they fall into?