What the Act actually covers

The EU AI Act (Regulation (EU) 2024/1689) doesn't regulate "AI" in the abstract — it regulates specific uses. The same model can be low-stakes in one context and high-risk in another. A chatbot answering FAQs is different from a chatbot that decides loan eligibility.

Every AI system your company builds or uses falls into one of four tiers:

• Prohibited — a short list of banned practices (social scoring, manipulative or exploitative systems, most real-time biometric surveillance). Already illegal.
• High-risk — systems in sensitive areas: employment, credit, education, law enforcement, critical infrastructure, and others listed in Annex III. Heavy documentation and oversight duties, mostly from 2 December 2027.
• Limited risk — chatbots, deepfakes, AI-generated content. Must be disclosed as AI from 2 August 2026.
• Minimal risk — everything else (spam filters, demand forecasting). Few specific duties, but Article 4 still applies.

What this means day to day

• Don't paste confidential or personal data into public AI tools unless your company has approved that tool for that purpose. Once it's in a prompt, you've likely lost control of it.
• AI output can be confidently wrong. Treat it as a draft from a fast, occasionally-mistaken colleague — verify anything factual, legal, or numeric before it goes anywhere that matters.
• Tell people when they're talking to AI if your role involves customer-facing chatbots or generated content — this is a legal disclosure duty from August 2026, not just good manners.
• If an AI system affects a real decision about a real person (hiring, credit, benefits, discipline), flag it to whoever owns compliance at your company — that's very likely a high-risk system with real obligations attached.
• Know who to ask. If something about an AI tool feels off — a biased result, an unclear decision, a use case nobody signed off on — raise it. That instinct is exactly what Article 4 literacy is for.

What's flatly banned

A short, specific list under Article 5 — already enforceable:

• Social scoring of people by public authorities
• Manipulating people through subliminal or deceptive techniques that cause harm
• Exploiting vulnerabilities of children, older people, or people with disabilities
• Real-time remote biometric identification in public spaces, with narrow law-enforcement exceptions
• Scraping the internet or CCTV to build facial recognition databases
• Emotion-recognition in the workplace or in education (with narrow safety/medical exceptions)

If a use case you're aware of resembles any of these, that's a "stop and ask compliance" moment, not a "figure it out yourself" one.