EU AI Act for organisations: the overview

What does the EU AI Act regulate?

The AI Act (Regulation (EU) 2024/1689) applies directly in all EU member states. It does not regulate the technology but its use: the higher the risk to health, safety and fundamental rights, the more obligations. It affects companies as well as authorities, hospitals and associations.

Level	Examples	What applies
Prohibited (Art. 5)	social scoring, emotion recognition in the workplace, manipulative techniques	must not be used
High-risk (Art. 6, Annex I and III)	selection of job applications, decisions on social benefits, AI as a medical device	extensive obligations for providers and deployers
Transparency (Art. 50)	chatbots, generated images and videos, published texts on matters of public interest	disclosure and labelling obligations
Other AI	drafting, summarising and translating texts, answering questions	AI literacy (Art. 4)

What role does your organisation have?

The regulation mainly distinguishes two roles:

• Provider (Art. 3(3)): develops an AI system or has it developed and places it on the market or puts it into service under its own name, including for its own use.
• Deployer (Art. 3(4)): uses an AI system under its own authority, for example a hospital that uses an AI assistant for doctor’s letters.

Most organisations are deployers. If you build your own AI applications or repurpose a system for a high-risk purpose, you can become a provider. The guide Do our own AI apps make us a provider? explains this.

Which deadlines apply after the Digital Omnibus?

With Regulation (EU) 2026/1744 (“Digital Omnibus on AI”), published in the Official Journal on 24 July 2026 and in force since 27 July 2026, the EU postponed several deadlines. As of 11 October 2026:

Since or from	What applies
2 February 2025	prohibitions (Art. 5) and AI literacy (Art. 4)
2 August 2025	obligations for providers of general-purpose AI models, penalties
27 July 2026	Art. 4 reworded: measures to promote AI literacy
2 August 2026	transparency obligations (Art. 50)
2 December 2026	new prohibitions on sexualised deepfakes; labelling for systems placed on the market before 2 August 2026 (Art. 111(4))
2 December 2027	high-risk AI under Annex III (Art. 113)
2 August 2028	high-risk AI under Annex I, such as AI in medical devices
2 August 2030	high-risk systems of public authorities that were already in use before (Art. 111(2))

The Commission published guidelines on classification as high-risk as a draft in May 2026. Before important decisions, check whether the final version is available by now.

What must you already do today?

1. Record AI systems: Which systems are in use, for what, with which data?
2. Promote AI literacy: Training and documentation under Art. 4. Details in the guide AI literacy under Art. 4.
3. Rule out prohibited practices: No use that falls under Art. 5.
4. Check transparency: Chatbots for citizens, patients or customers, generated images, published texts. See Transparency obligations under Art. 50.
5. Identify high-risk uses: There is time until December 2027, but procurement and preparation need lead time. See Identifying high-risk AI.

In addition, the GDPR, professional secrecy and co-determination by the works council or staff council continue to apply.

Which fines apply?

Art. 99 provides for up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for breaches of other obligations, such as those of deployers or under Art. 50. For small and medium-sized enterprises, the lower amount applies in each case. Whether and how public authorities pay fines is decided by each member state: in Germany, authorities and public bodies are exempt under § 17(2) KI-MIG. The regulation provides no separate fine for Art. 4.

How does this work with basebox?

basebox is a platform, not a high-risk system. Which obligations you have depends on the use. For the EU AI Act, you receive training, logs and a model register: the developer, version and licence of every model are documented, the audit log records who used which assistant and which connector, and write actions by agents require approval by a person. Booked training sessions also cover AI literacy under Art. 4. Details on Security.

Not legal advice: This overview reflects the situation as of 11 October 2026. The AI Act is continually supplemented by guidelines, standards and national laws. Check your use with your legal advisers or your data protection officer.