Products sold into Europe increasingly include AI features such as chat assistants, generated descriptions and document summaries. The EU AI Act applies to anyone who places AI systems on the EU market or whose AI output is used in the EU, wherever the company is based. This is a practical summary, not legal advice. Talk to a lawyer about your specific product.
The timeline
The Act entered into force on 1 August 2024 and applies in stages. The Digital Omnibus amendments, in force since 27 July 2026, moved some later dates.
- 2 February 2025: bans on prohibited practices and the AI literacy duty apply.
- 2 August 2025: obligations for providers of general-purpose AI models apply.
- 2 August 2026: most remaining rules apply, including the Article 50 transparency rules, and enforcement starts.
- 2 December 2026: deadline for systems already on the market before August 2026 to meet the Article 50(2) marking rules for generated content.
- 2 December 2027: rules for high-risk systems listed in Annex III apply.
- 2 August 2028: rules for high-risk AI built into regulated products apply.
What applies to a typical product team
Most small teams build on top of models from large providers. That usually makes you a "deployer" or a provider of an AI system, not a provider of a general-purpose model. For common features, the transparency rules are the part that matters now:
- Chatbots: people must know they're talking to an AI unless it's obvious from context. A clear label in the chat window handles this.
- Generated content: systems that generate synthetic text, audio, images or video need to mark the output as AI-generated in a machine-readable way where technically feasible.
- Deepfakes and public-interest text: extra disclosure rules apply if you generate realistic images of people or publish AI-written text on matters of public interest.
Check whether you're high-risk
Annex III lists high-risk uses, including AI used in hiring and recruitment, credit scoring, education and access to essential services. If your product screens CVs or scores applicants, you fall in that category and face much heavier obligations from December 2027: risk management, documentation, logging, human oversight and conformity assessment. Start planning well ahead of that date.
What we do on client projects
- Add a visible "AI assistant" label and a short explanation to every chat interface.
- Store a record of which content the system generated, and mark generated media with metadata where the format supports it.
- Log inputs and outputs in a way that supports audits, with retention that fits the client's privacy policy.
- Keep a one-page description of each AI feature: what it does, which model it uses, what data it sees and who reviews its output.
- Flag any feature that touches hiring, credit or education early, so the client can get legal advice before building it.
AI literacy applies to you too
Since February 2025, organisations that use AI systems must take steps so their staff understand them well enough for their role. For most businesses that means basic training for the people who operate or rely on the AI features, and a written note of who received it.
Sources: EU AI Act Service Desk: implementation timeline, European Commission: Navigating the AI Act.
