Regulation (EU) 2024/1689
EU AI Act
The first law that binds the company using AI as much as the company building it. The catalog carries its requirements as controls, so readings from the AI providers you connect, and the policies your people acknowledge, land on them as evidence.
Does it apply to you?
Almost certainly. The question is which of its roles you hold, and whether any of your uses is high-risk.
In scope
You use AI at work.
Assistants, copilots and models in your tools make you a deployer. That brings AI literacy for your people, transparency towards the people who meet your AI, and a ban on a short list of practices.
In scope, more so
You build or brand an AI product.
Selling an AI system under your own name, or putting your name on one built on a general-purpose model, makes you a provider: documentation, risk management and, for high-risk systems, conformity assessment.
Look closer
You use AI for hiring, credit, education or essential services.
These uses are high-risk under Annex III. A deployer then owes human oversight, logging, monitoring and instructions followed to the letter, even for a tool bought off the shelf.
What the regulation asks of a company that uses AI
Article 4
AI literacy
Providers and deployers make sure the people who operate or use AI on their behalf have a sufficient level of AI literacy for their role.
Article 5
Prohibited practices
Manipulative techniques, exploitation of vulnerabilities, social scoring and untargeted scraping of faces are banned for everyone, whatever the size of the company.
Article 26
Obligations of deployers of high-risk AI
Use the system as instructed, keep human oversight, keep the logs it generates, monitor it, and inform the people subject to it.
Article 50
Transparency
A person interacting with an AI system is told so. AI-generated or manipulated content is marked as such. Emotion recognition and biometric categorisation are disclosed.
When it applies
In stages, the bans first and the high-risk duties last. Read the regulation.
- 1 August 2024Entered into force, twenty days after publication in the Official Journal.
- 2 February 2025Prohibited practices and AI literacy apply.
- 2 August 2025Obligations for providers of general-purpose AI models and the governance rules apply.
- 2 August 2026Most obligations apply, including transparency and the high-risk duties for Annex III systems.
- 2 August 2027High-risk duties apply to AI built into products covered by other EU product legislation.
How the evidence lands
The AI in use
Which assistants and models your company uses, read from the providers you connect. Anthropic today, more on the way. The inventory an authority asks for first.
Who can reach it
Members, roles and keys at each AI provider, so access is a reading rather than a spreadsheet.
Policy and literacy
An acceptable-use policy adopted from the catalog, published to your people, with every acknowledgement kept. That is the literacy duty, evidenced.
The supply chain
Each AI provider's sub-processors from its published list, so you know where a prompt goes after it leaves your tools.
See the AI Act controls on your own tools
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.