The EU AI Act is the European Union's law on artificial intelligence: it sorts AI uses by risk and sets duties for the companies that build and use them. If your practice, law firm or small business uses an AI assistant for drafting, research or admin, you are a "deployer" under the Act. For most everyday uses that means a short list of duties: make sure your staff understand the AI they use, be open with people when they are dealing with AI, and keep a human in charge of decisions.
An everyday example
A made-up GP practice, Praxis Dr. Lehmann, uses an AI assistant to draft referral letters and a chatbot on its website to answer questions about opening hours.
- The drafting assistant is low risk. Dr. Lehmann reads every letter and signs it. Her duty is to make sure the team knows how to use the tool and where it can go wrong.
- The website chatbot talks to the public. Patients must be able to tell they are talking to an AI, not a receptionist.
- If the practice ever let an AI system decide on its own who gets an appointment first, that would be a different, much stricter category.
Same technology, different duties. The AI Act regulates what you use AI for, not the technology in itself.
The EU AI Act in plain terms
What it is. Regulation (EU) 2024/1689. As a regulation, it applies directly in every EU member state, without a national law to transpose it. It entered into force on 1 August 2024 and applies in stages.
Who it applies to. Two roles matter:
- A provider develops an AI system or model, or puts it on the market under its own name (for example, the company behind a chatbot).
- A deployer uses an AI system under its own authority in a professional context. Almost every practice, law firm and SME that uses AI is a deployer.
The four risk tiers.
- Unacceptable risk: prohibited. For example social scoring, AI that manipulates people below the level of awareness, untargeted scraping of facial images from the internet, and emotion recognition at work or in education (with narrow exceptions). These bans apply since 2 February 2025.
- High risk: strict rules. AI that helps decide important things about people, for example in hiring and employment, education, access to credit or essential services, law enforcement, the administration of justice, or as a safety part of products like medical devices. Providers need risk management, documentation, data governance and human oversight. Deployers must use the system as instructed, assign human oversight to people with the right competence, and monitor how it works.
- Limited risk: transparency. Chatbots and AI that generates content. People must be told when they are interacting with an AI, and AI-generated content must be identifiable as such (Article 50).
- Minimal risk: no specific duties. Spam filters, spell checkers, most everyday AI features.
The timeline.
- 1 August 2024: the Act enters into force.
- 2 February 2025: the bans on prohibited practices apply, and so does the AI literacy duty (Article 4).
- 2 August 2025: the rules for general-purpose AI models (the large language models behind chatbots) apply to their providers, along with the rules on governance and penalties.
- 27 July 2026: the "Digital Omnibus" (Regulation (EU) 2026/1744) entered into force. It softened the AI literacy duty in Article 4 to taking measures that support it, and moved the high-risk timeline back.
- 2 August 2026: the transparency rules in Article 50 apply, for example telling people they are talking to an AI. Generative systems already on the market before then have until 2 December 2026 for machine-readable marking.
- 2 December 2027: the rules for stand-alone high-risk systems (Annex III, e.g. hiring, education, credit scoring) apply.
- 2 August 2028: the rules for high-risk AI built into regulated products (Annex I) apply.
AI literacy (Article 4). Since the Digital Omnibus took effect on 27 July 2026, providers and deployers must take measures to support the AI literacy of staff who work with AI, taking into account their knowledge, training and the context of use. Before that, the text required them to ensure a sufficient level of AI literacy. In practice: people should know what the tool does, where it makes mistakes, and what data must not go into it. A short internal training and a written AI policy are a sensible start. This duty already applies.
The sanctions. Fines for using prohibited practices can reach €35 million or 7% of worldwide annual turnover. Breaches of most other obligations can reach €15 million or 3%. For SMEs, the lower of the two amounts applies.
Human oversight. For high-risk systems, Article 14 requires that people can understand, question, correct and override the AI's output. As a working principle it belongs in every regulated profession: the AI drafts, a person decides and signs.
This is general information, not legal advice.
What the AI Act does not protect
The AI Act regulates how AI systems are built and used. It is not a data protection law, and it does not decide what a provider may do with the content you type in. That is the job of the GDPR, professional secrecy rules and the provider's own terms.
And there is a gap between those, too. The GDPR protects information that identifies a person. Recital 26 GDPR says it does not apply to anonymous information. If a provider's terms grant it a licence to reuse what you upload, it can remove the names, and the rest (a diagnosis and its treatment, a contract's price and liability cap, a salary for a role in a city) is no longer personal data. It can then be pooled, licensed and sold legally. A tool can comply with the AI Act and the GDPR and still do this.
We show this step by step on the data trail, with sources on legal to sell.
What this means when you use AI tools
A short checklist for a practice, a firm or an SME:
- Train your staff (AI literacy). Who uses which tool, what data may go in, how to check the output. Write it down.
- Label AI where people meet it. A chatbot on your website should say it is an AI.
- Keep a human in the loop. AI drafts, a person decides, especially on anything that affects a patient, client or employee.
- Check where the data goes. Where it is processed, whether it is kept, whether it is used for training, and whether the terms let the provider reuse it.
- Sign a data processing agreement (Art. 28 GDPR) with every AI provider that processes personal data for you.
Where Wysor fits. Wysor is a private AI workspace for regulated professionals. It does not take over your AI Act duties, but it settles the data side. Wysor acts as a processor under Art. 28 GDPR, only on your instructions, and takes no licence to reuse your content: we never train on it and never sell it, anonymised or not. Every connected AI model provider runs with zero data retention. Data is encrypted in transit and at rest and hosted in the EU, and these commitments are in the contract, binding anyone who could ever own Wysor.
Frequently asked questions
What is the EU AI Act? It is the EU's law on artificial intelligence, Regulation (EU) 2024/1689. It sorts AI uses into four risk tiers, from prohibited to minimal, and sets duties for providers and deployers depending on the tier.
Does the EU AI Act apply to small businesses? Yes, if they use AI in their work. Most SMEs, practices and law firms are deployers of limited or minimal-risk AI, so their main duties are AI literacy for staff, transparency toward people who deal with an AI, and human oversight. The Act includes some relief for SMEs, such as the lower cap on fines.
When does the EU AI Act come into force? It entered into force on 1 August 2024 and applies in stages. The bans and the AI literacy duty apply since 2 February 2025, the rules for general-purpose AI models since 2 August 2025. The 2026 Digital Omnibus moved the high-risk rules to 2 December 2027 (Annex III) and 2 August 2028 (AI in regulated products).
Is ChatGPT high risk under the EU AI Act? Using a general-purpose chatbot for drafting or research is usually not high risk. The model behind it falls under the general-purpose AI rules, which bind the provider. It becomes high risk only if you use AI for a high-risk purpose, such as deciding on job applicants.
What is AI literacy under the EU AI Act? Article 4 requires providers and deployers to take measures that support the AI literacy of staff using AI, so they can use it competently and understand its risks. It applies since 2 February 2025, and since 27 July 2026 in the softer form set by the Digital Omnibus.
Further reading
- The data trail. What happens to a file once a provider may reuse it.
- GDPR AI compliance checklist. The data protection side of using AI at work.
- What is shadow AI?. When staff use AI tools the company never approved.
- What is sovereign AI?. Control over where your AI runs and what happens to your data.
- What is a DPIA?. The GDPR risk assessment that AI with sensitive data usually needs.
- NIS2 explained. The EU cybersecurity rules for critical sectors, including your AI suppliers.
- What is generative AI? Explained simply, with examples
Questions about applying this in your practice or firm? Write to [email protected] or use the contact form in the app.
