GUIDE · AI COMPLIANCE

AI Act: what a company that uses AI must do.

Most companies do not develop AI: they use it. The AI Act calls them “deployers”. Their obligations depend on the risk level of their uses. Here are the essentials, and how to get organized.

Talk about your project Read the essentials

A 30-minute conversation with the team that will run your project, with no commitment.

  • Regulation (EU) 2024/1689, official text cited
  • AI literacy required since February 2, 2025
THE AI ACT FOR COMPANIES
For
Leadership, IT, DPO, legal
Reading time
7 minutes
Updated
October 15, 2026

THEY TRUST US

  • Celio
  • Plein Sens
  • Shiseido
  • Green-Got
  • Promologis
  • Bridgestone

IN BRIEF

What does the AI Act require of a company?

The AI Act, Regulation (EU) 2024/1689, classifies AI uses by risk level. Some practices have been prohibited since February 2, 2025. Since the same date, every company that uses AI systems must ensure a sufficient level of AI literacy among its staff (Article 4).

High-risk uses, listed in Annex III (recruitment, consumer credit, access to essential public services, life and health insurance, among others), bring stricter obligations for the company that uses them: human oversight, log retention, informing the people concerned. Their application timeline was adjusted in 2026: check the deadline in force.

For most everyday uses (writing, summarizing, searching your documents, preparing files reviewed by a person), the essentials come down to three steps: list your uses, train your teams, set clear rules. Transparency obligations apply when a person interacts directly with an AI or receives generated content.

THREE STEPS

List your uses and their risk level · Train your teams · Set rules and keep them up to date.

  • Executive management
  • IT department
  • DPO
  • Legal
  • Compliance

Updated October 15, 2026.

WHAT LEADERS ASK

The AI Act worries people, often needlessly.

The four questions we hear most.

  • SCOPE

    Are we affected if we do not develop AI?

  • RISK

    Are our uses high-risk?

  • TIMELINE

    What already applies, and when?

  • PROOF

    How do we show we are compliant?

WHO IT’S FOR

Executive management, IT departments, DPOs, lawyers and compliance officers at companies that use AI tools.

  • Executive management
  • IT department
  • DPO
  • Legal
  • Compliance

WHAT YOU DO

Six actions to be compliant.

They fit into our method, with your DPO and your legal team.

  • List your uses

    Which AI tools, for what, with which data: mapping your operations does this team by team.

  • Classify their risk level

    Prohibited, high-risk, transparency, everyday use: each use gets its category, approved by your legal team.

  • Train your teams

    The AI literacy required by Article 4: hands-on sessions on the company’s tools and rules.

  • Set the rules

    A short AI policy: approved tools, protected data, human review.

  • Stay in control

    AI prepares, a person decides; every action is traced and logs are kept.

  • Inform people

    Say when an interaction or a piece of content involves AI, as the transparency rules require.

THE TIMELINE

What applies, and when.

WHAT APPLIESWHAT YOU DO
February 2, 2025Prohibited practices; AI literacy (Article 4).Check that no use is prohibited; train your teams.
August 2, 2025Rules for general-purpose AI models, for their providers.Choose providers that document their models.
August 2, 2026General application of the regulation, including transparency.Inform people who interact with an AI.
Per the adjusted timelineObligations for high-risk uses (Annex III).Human oversight, logs, information, impact assessment if required.

Guidance as of today. Check the deadlines in force with your legal team, as the timeline for high-risk uses has been adjusted.

OUR METHOD

Compliance is organized around uses.

The four steps of our method, in a loop. Each can be done on its own; together, they organize AI across the whole company.

  1. Inspire your leadership team

    A keynote built on cases from your business. Your leadership decides where AI will be useful, and where it will not.

  2. Map your operations

    We spot the bottlenecks, rank use cases by gain and difficulty, and name the tools to adopt.

  3. Bring your teams on board

    In a hands-on session, everyone arrives with a real problem and leaves with the AI agent that solves it. An AI policy sets the shared rules.

  4. Build with the AI Factory

    Our engineers build AI-ready business tools with you. You keep the keys.

YOUR QUESTIONS

Questions about the AI Act.

Is a company that uses ChatGPT or Copilot affected by the AI Act?

Yes, as a “deployer”. For everyday uses, its obligations mainly concern AI literacy among its staff (Article 4) and transparency when a person interacts with an AI. High-risk uses bring stricter obligations.

Which uses are high-risk?

Those listed in Annex III, for example recruitment and employee management, credit assessment of individuals, access to essential public services, and pricing in life and health insurance. Preparing documents reviewed by a person is generally not one of them.

What does AI literacy under Article 4 mean?

That the people who use AI in the company understand how it works, its limits and the rules for using it, at a level suited to their role. Hands-on training and an AI policy address this.

What penalties does the AI Act provide for?

The regulation provides for administrative fines graduated by severity; the highest target prohibited practices. Enforcement is entrusted to the designated national authorities.

Do you need to appoint an AI lead?

The regulation does not require it as such, but a lead who keeps the list of uses, tools and rules makes compliance much easier.

How does the AI Act fit with the GDPR?

Both apply together: the GDPR as soon as personal data is processed, the AI Act according to the risk level of the use. Your DPO is your first point of contact.

SOURCES

The texts and studies cited on this page.

Every figure on the site is sourced. See all our sources.

LET’S TALK ABOUT YOUR PROJECT

Let’s organize your AI compliance.

Thirty minutes to list your uses and tell you what applies to you.

Your contact

The AI Origin team that runs the projects

You talk directly with the people who will run your project, from scoping to go-live.

No specific project yet? Start with a hands-on session: everyone brings a real problem and leaves with the AI agent that solves it. See step 3, Bring your teams on board

Let’s prepare the conversation.

Three fields are enough: name, company, email.

Your information is used only to reply to you. We never sell it. Privacy policy

Write to us in two lines.

Your company, the AI tools you use, your questions. We will get back to you to schedule a time.

Write to contact@aiorigin.io

Or write to us: contact@aiorigin.io

Talk about your operations