EU AI Act for Business: Obligations, Deadlines and a Practical Checklist

For companies, the EU AI Act is best understood as a risk-based compliance framework. It does not mean that ordinary AI use is automatically banned. What matters is what an AI system is used for, what role your organisation plays and whether the specific use falls into a prohibited, general-purpose AI or high-risk category.

What the EU AI Act changes in practice

The key business question is shifting from “Can we use AI?” to “How should this particular AI use case be classified?”

An internal summarisation tool should not be assessed in the same way as a system that screens job applications, evaluates employee performance or helps make decisions about individuals. The sources describe the AI Act as a phased regime: first prohibited practices, then obligations for general-purpose AI models, known as GPAI, then most high-risk obligations and later certain AI systems built into already regulated products.

For most organisations, the practical assessment starts with three questions:

1. Use case: What does the AI actually do, what data does it use and how much influence does it have on decisions?
2. Role: Are you a deployer or user of an AI system, a provider of an AI system or a provider of a GPAI model?
3. Risk: Is the use case potentially prohibited, GPAI-related, high-risk or lower-risk?

Key deadlines for business planning

This timeline is not a substitute for legal advice, but it highlights the dates most relevant for company planning.

Timing	What becomes relevant	What it means for companies
Since February 2025	Prohibited AI practices	Companies should first rule out whether any use case falls into a prohibited category. This phase addresses particularly harmful AI practices early in the implementation schedule.
From August 2025	Obligations for GPAI models	Providers of general-purpose AI models need to assess the GPAI rules. One source also states that GPAI products not released before August 2025 must follow the new regulation from August 2025.
From 2 August 2026	Many high-risk AI obligations	For high-risk AI systems listed in Annex III, the full compliance framework applies from 2 August 2026. One source identifies this as the principal deadline for many businesses.
2027/2028, depending on the product regime	Certain high-risk AI systems in regulated products	For high-risk AI systems embedded in products already covered by EU product safety legislation, one source describes longer transition periods running to 2027 and 2028, depending on the applicable product regime.

The real test: use case, role and risk

1. What does the AI actually do?

Do not start with the brand name of the tool. Start with the purpose.

The fact that a product uses AI does not, by itself, tell you which obligations apply. The more important questions are whether the system assesses people, affects access to opportunities or services, supports safety-critical processes or simply helps with routine internal work.

Companies should review sensitive uses early. The sources identify areas such as biometrics, critical infrastructure, education, employment and public services as fields where high-risk questions may be especially relevant.

2. What role does your company play?

A business may play different roles in different AI projects. If you buy an AI tool, you may mainly be a deployer or user. If you put your own AI-enabled product on the market, provider obligations may become relevant. If you develop or make available a general-purpose AI model, specific GPAI questions come into play.

This role mapping matters because obligations do not depend only on the risk of the system. They also depend on whether your organisation provides the AI, deploys it or acts as a model provider.

3. Which risk category is plausible?

A practical first review can follow four steps:

1. Exclude prohibited practices: If a use case falls into a prohibited category, it is not a later compliance issue; it is already critical.
2. Check the GPAI link: Are you providing a GPAI model yourself, or are you only using someone else’s model inside a specific application?
3. Check for high-risk indicators: Does the use case sit in a sensitive area or influence decisions about individuals?
4. Check the product regime: Is the AI embedded in a regulated product where special transition periods may apply?

What companies should set up now

Build an AI inventory

The first practical step is a complete AI inventory. Do not capture only large strategic AI projects. Include internal assistant tools, AI features in purchased SaaS products, automation workflows, in-house product features and models used by teams.

A useful AI inventory should include at least:

• the name of the tool or system
• its purpose and business function
• whether it is internally or externally provided
• the categories of data used
• affected people or groups
• the level of influence on decisions
• the vendor, internal owner and responsible teams
• an initial view on prohibited-risk, GPAI, high-risk or lower-risk status

This inventory gives you the foundation for assessing roles and risk categories in a traceable way for each use case.

Prioritise sensitive use cases

Not every AI application needs the same level of attention. Give priority to systems that assess people, influence access to opportunities or services, or operate in sensitive areas such as biometrics, critical infrastructure, education, employment and public services.

In practice, this often means looking early at HR tools, candidate screening, performance assessment, safety-related applications and systems that help prepare decisions about people. Whether a specific case is actually high-risk depends on the exact workflow and your organisation’s role.

Prepare governance and documentation

For high-risk systems, the sources refer to requirements such as risk management, technical documentation and conformity assessment. The exact tasks that fall to your company depend on its role and the system involved. For Annex III high-risk systems, the full compliance framework becomes relevant from 2 August 2026.

Useful preparation includes:

• naming responsible teams in the business, IT, privacy, legal and compliance
• introducing an approval process for new AI tools
• requesting vendor documentation, technical information and contractual commitments
• documenting purpose, data, risks, human oversight and changes
• getting legal input early for borderline cases

Do not underestimate AI literacy

AI literacy is not only a high-risk AI issue. One source describes AI literacy as a broad obligation for providers and deployers regardless of risk level; even organisations using only minimal-risk AI systems must address AI literacy requirements and avoid prohibited practices.

In practical terms, employees who choose, configure or use AI should understand the system’s limits, common failure modes and when human review is needed.

Three common business scenarios

Scenario 1: You use an AI assistant only internally

The key question is what the tool is used for. Internal drafting, summarisation or research support is different from using AI in HR, evaluation, access to services or other sensitive processes. Even so, these tools belong in the AI inventory, and AI literacy plus clear usage rules remain relevant even for lower-risk uses.

Scenario 2: You build a SaaS product with an AI feature

You should assess whether your company is a provider of an AI system and whether the feature could fall into a high-risk context. For high-risk systems, requirements such as risk management, technical documentation and conformity questions become particularly relevant from 2026.

Scenario 3: You use AI in recruiting, scoring or customer support

Recruiting and other employment contexts deserve early review because employment is identified in the sources as an area where high-risk questions may arise. For scoring or customer support, the answer depends heavily on whether the AI merely assists staff or helps prepare, influence or automate decisions about individuals. Without a precise description of the workflow, a reliable classification is not possible.

Practical checklist: what to do next

1. Map your AI uses: Document all tools, models, product features and automations.
2. Triage use cases: First rule out prohibited practices, then check GPAI links and possible high-risk scenarios.
3. Define your role: For each application, decide whether you are a deployer, provider or GPAI model provider.
4. Prioritise sensitive areas: Review HR, biometrics, critical infrastructure, education, public services and other decision-related processes early.
5. Review vendors: For purchased AI, clarify what documentation, risk information, updates and contractual commitments the provider supplies.
6. Set up governance: Establish responsibilities, approvals, training and documentation.
7. Plan for high-risk preparation: For possible Annex III systems, treat 2 August 2026 as a central planning date.

Bottom line

For businesses, the most useful question about the EU AI Act is not “Are we allowed to use AI?” It is: “What is the specific use case, what role do we play and which deadline applies?”

If your organisation uses only a few internal AI tools, the workload may be manageable, but an AI inventory, usage rules and AI literacy are still sensible and, in some respects, directly relevant. If you use AI in sensitive areas, offer an AI product or provide GPAI models, do not wait until 2026 to start the assessment.