# EU AI Act: what companies using AI must do > AI Act: obligations for companies that use AI, timeline, high-risk uses, AI literacy (Article 4). The guide for leadership teams and IT departments. URL: https://aiorigin.io/en/guides/ai-act-entreprise - Method - The AI Act for companies GUIDE · AI COMPLIANCE # AI Act: what a company that uses AI must do. Most companies do not develop AI: they use it. The AI Act calls them “deployers”. Their obligations depend on the risk level of their uses. Here are the essentials, and how to get organized. Talk about your project Read the essentials A 30-minute conversation with the team that will run your project, with no commitment. - Regulation (EU) 2024/1689, official text cited - AI literacy required since February 2, 2025 THE AI ACT FOR COMPANIES For Leadership, IT, DPO, legal Reading time 7 minutes Updated October 15, 2026 THEY TRUST US - Celio - Plein Sens - Shiseido - Green-Got - Promologis - Bridgestone IN BRIEF ## What does the AI Act require of a company? The AI Act, Regulation (EU) 2024/1689, classifies AI uses by risk level. Some practices have been prohibited since February 2, 2025. Since the same date, every company that uses AI systems must ensure a sufficient level of AI literacy among its staff (Article 4). High-risk uses, listed in Annex III (recruitment, consumer credit, access to essential public services, life and health insurance, among others), bring stricter obligations for the company that uses them: human oversight, log retention, informing the people concerned. Their application timeline was adjusted in 2026: check the deadline in force. For most everyday uses (writing, summarizing, searching your documents, preparing files reviewed by a person), the essentials come down to three steps: list your uses, train your teams, set clear rules. Transparency obligations apply when a person interacts directly with an AI or receives generated content. THREE STEPS List your uses and their risk level · Train your teams · Set rules and keep them up to date. - Executive management - IT department - DPO - Legal - Compliance Updated October 15, 2026. WHAT LEADERS ASK ## The AI Act worries people, often needlessly. The four questions we hear most. SCOPE Are we affected if we do not develop AI? RISK Are our uses high-risk? TIMELINE What already applies, and when? PROOF How do we show we are compliant? WHO IT’S FOR Executive management, IT departments, DPOs, lawyers and compliance officers at companies that use AI tools. - Executive management - IT department - DPO - Legal - Compliance WHAT YOU DO ## Six actions to be compliant. They fit into our method, with your DPO and your legal team. ### List your uses Which AI tools, for what, with which data: mapping your operations does this team by team. ### Classify their risk level Prohibited, high-risk, transparency, everyday use: each use gets its category, approved by your legal team. ### Train your teams The AI literacy required by Article 4: hands-on sessions on the company’s tools and rules. ### Set the rules A short AI policy: approved tools, protected data, human review. ### Stay in control AI prepares, a person decides; every action is traced and logs are kept. ### Inform people Say when an interaction or a piece of content involves AI, as the transparency rules require. THE TIMELINE ## What applies, and when. AI Act application timeline for companies that use AI WHAT APPLIESWHAT YOU DO February 2, 2025Prohibited practices; AI literacy (Article 4).Check that no use is prohibited; train your teams. August 2, 2025Rules for general-purpose AI models, for their providers.Choose providers that document their models. August 2, 2026General application of the regulation, including transparency.Inform people who interact with an AI. Per the adjusted timelineObligations for high-risk uses (Annex III).Human oversight, logs, information, impact assessment if required. Guidance as of today. Check the deadlines in force with your legal team, as the timeline for high-risk uses has been adjusted. OUR METHOD ## Compliance is organized around uses. The four steps of our method, in a loop. Each can be done on its own; together, they organize AI across the whole company. ### Inspire your leadership team A keynote built on cases from your business. Your leadership decides where AI will be useful, and where it will not. ### Map your operations We spot the bottlenecks, rank use cases by gain and difficulty, and name the tools to adopt. ### Bring your teams on board In a hands-on session, everyone arrives with a real problem and leaves with the AI agent that solves it. An AI policy sets the shared rules. ### Build with the AI Factory Our engineers build AI-ready business tools with you. You keep the keys. YOUR QUESTIONS ## Questions about the AI Act. Is a company that uses ChatGPT or Copilot affected by the AI Act? Yes, as a “deployer”. For everyday uses, its obligations mainly concern AI literacy among its staff (Article 4) and transparency when a person interacts with an AI. High-risk uses bring stricter obligations. Which uses are high-risk? Those listed in Annex III, for example recruitment and employee management, credit assessment of individuals, access to essential public services, and pricing in life and health insurance. Preparing documents reviewed by a person is generally not one of them. What does AI literacy under Article 4 mean? That the people who use AI in the company understand how it works, its limits and the rules for using it, at a level suited to their role. Hands-on training and an AI policy address this. What penalties does the AI Act provide for? The regulation provides for administrative fines graduated by severity; the highest target prohibited practices. Enforcement is entrusted to the designated national authorities. Do you need to appoint an AI lead? The regulation does not require it as such, but a lead who keeps the list of uses, tools and rules makes compliance much easier. How does the AI Act fit with the GDPR? Both apply together: the GDPR as soon as personal data is processed, the AI Act according to the risk level of the use. Your DPO is your first point of contact. SOURCES ## The texts and studies cited on this page. Every figure on the site is sourced. See all our sources. European Union, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), June 13, 2024. eur-lex.europa.eu European Commission, AI literacy – Questions & Answers (Article 4 of the AI Act), 2025. digital-strategy.ec.europa.eu European Commission, AI Act: regulatory framework and application timeline. digital-strategy.ec.europa.eu European Union, Regulation (EU) 2016/679 on the protection of personal data (GDPR), April 27, 2016. eur-lex.europa.eu CNIL, Comment déployer une IA générative ? La CNIL apporte de premières précisions, 2024. cnil.fr LET’S TALK ABOUT YOUR PROJECT ## Let’s organize your AI compliance. Thirty minutes to list your uses and tell you what applies to you. Your contact The AI Origin team that runs the projects You talk directly with the people who will run your project, from scoping to go-live. No specific project yet? Start with a hands-on session: everyone brings a real problem and leaves with the AI agent that solves it. See step 3, Bring your teams on board Thank you, we have received your request. We will get back to you to schedule a time. ### Write to us in two lines. Your company, the AI tools you use, your questions. We will get back to you to schedule a time. Write to contact@aiorigin.io Or book a time slot Or write to us: contact@aiorigin.io