AI Act: the 4 pillars to know
The AI Act isn't a single text to tick off, but 4 distinct obligations, some with deadlines that have already passed.
Governance
In force since 2 August 2025You use or develop AI systems: the AI Act requires dedicated governance (system inventory, designated owner, documentation), regardless of each system's risk level.
Prohibited practices
In force since 2 February 2025Certain uses are prohibited: social scoring, behavioral manipulation, exploitation of vulnerabilities, real-time remote biometric identification in public spaces, emotion recognition at work or in schools, biometric categorization of sensitive characteristics. Sanctions up to €35M or 7% of global revenue.
High-risk
From 2 December 2027If your sector (public administration, justice, migration, education, healthcare, social services, employment) falls under one of the 8 Annex III domains, check whether any of your AI systems genuinely matches it: stricter obligations then apply.
Transparency
Since 2 August 2026Your users must be informed when they're interacting with an AI system (e.g. a chatbot), and any content generated or manipulated by AI, including deepfakes, must be labeled as such. A 4-month technical grace period (until 2 December 2026) exists for digital watermarking of already-deployed content.
Source: Regulation (EU) 2024/1689 (AI Act), art. 5 (prohibited practices), Annex III (high-risk), art. 50 (transparency)