Skip to content
Gathena
da

Learn · Explained

What does the EU AI Act ask of a company that uses AI?

Published 31 October 2026

Short answer. For a company that uses AI for ordinary office work, such as writing, analysis or preparing entries, one duty applies today: take measures to support your staff’s AI literacy. The bans on certain AI practices apply to everyone, and the transparency rules apply when you publish deepfakes or AI-written text for the public. Heavier duties apply only if you use AI for high-risk purposes, such as decisions about employees or credit scoring of people, and they start on 2 December 2027.

This guide explains each rule, when it applies, and what it asks of you, as the AI Act reads after the 2026 amendments.

Your company is a deployer

The AI Act calls a company that uses an AI system at work a deployer. Using Copilot, ChatGPT, Claude or an AI agent in your daily work makes your company a deployer of those systems. The companies that make the systems are their providers, and most of the Act’s technical duties fall on them.

If your company has an AI system built and puts it into use under its own name, it can also count as that system’s provider. For a system that is not high-risk, that adds little beyond the AI literacy and transparency rules below.

What applies when

Date What applies
2 February 2025 AI literacy, and the bans on certain AI practices
2 August 2025 Rules for providers of general-purpose AI models, such as the large language models behind chat tools
2 August 2026 Most of the Act, including the transparency rules, and enforcement
2 December 2026 New bans on AI-generated sexual deepfakes and child sexual abuse material
2 December 2027 The rules for high-risk uses listed in the Act’s Annex III, such as employment and credit scoring
2 August 2028 The rules for AI built into regulated products, such as machinery or medical devices

The December 2027 and August 2028 dates come from the Digital Omnibus on AI, Regulation (EU) 2026/1744, which moved them from August 2026.

The duty that applies now: AI literacy

AI literacy means the skills, knowledge and understanding that let people use AI with judgement: what it can do, where it goes wrong, and what is at stake.

Since 2 February 2025, a company that uses AI must take measures to support the AI literacy of its staff, and of others who use AI systems on its behalf. The measures should fit people’s technical knowledge, experience and training, the context the AI is used in, and the people it affects. Since the 2026 amendment, the Act says plainly that it does not require a company to guarantee any particular level for any one person.

The Act does not prescribe the measures. In practice, they often include:

  • training on the tools people actually use, for their own tasks
  • written rules for what may and may not go into an AI tool
  • a named person to ask when in doubt
  • a short record of what was done and when, so the company can show its measures

The amended Act also asks the European Commission to publish practical examples of how to meet this duty.

Is your use high-risk?

An AI system is high-risk when it is used for one of the purposes the Act lists in its Annex III. Three areas on that list are the ones a company outside the public sector is most likely to meet:

Area Examples on the list Starts
Employment Recruiting and filtering applications; decisions on promotion or dismissal; allocating tasks based on personal traits or behaviour; monitoring and evaluating staff performance 2 December 2027
Credit Assessing the creditworthiness or credit score of a person (detecting financial fraud is excluded) 2 December 2027
Insurance Risk assessment and pricing for a person’s life or health insurance 2 December 2027

Everyday finance, accounting and supply chain work is not on the list: reading invoices, preparing entries, reconciling accounts, reporting, forecasting stock. An AI agent doing that work is not high-risk under the Act, though the company’s other duties, such as bookkeeping law and GDPR, still apply. Read Who is accountable when an AI agent makes an entry?

If it is high-risk

From 2 December 2027, a company that uses a high-risk AI system must:

  1. Use it according to the provider’s instructions for use.
  2. Give the human oversight to people with the competence, training and authority to do it.
  3. Make sure the data it feeds in is relevant and sufficiently representative, where it controls that data.
  4. Monitor how the system works, and tell the provider and the authority, and stop using it, if it presents a risk.
  5. Keep the logs the system creates, where it controls them, for at least six months.
  6. Tell workers’ representatives and the affected employees before using it at work.

A company that uses AI to assess the creditworthiness of people, or to price their life or health insurance, must also assess the impact on people’s fundamental rights before it starts.

When you publish AI-made content

Since 2 August 2026:

  • If you publish a deepfake, an image, audio or video made or changed by AI to look real, you must say so.
  • If you publish AI-written text to inform the public on matters of public interest, you must say so, unless a person has reviewed and edited it and someone holds editorial responsibility for it.

The companies that make chat tools must also make sure people are told when they are talking to an AI, unless it is obvious.

What is banned for everyone

Some uses of AI have been banned since 2 February 2025, whoever uses them. The ones closest to ordinary business are:

  • recognising employees’ emotions at work, except for medical or safety reasons
  • scoring people on their social behaviour or personal traits in ways that lead to unfair treatment
  • manipulating people, or exploiting their vulnerabilities, in ways that cause them significant harm

Who supervises in Denmark

Denmark has named three authorities. Digitaliseringsstyrelsen, the Agency for Digital Government, is the single point of contact and supervises most of the banned practices. Datatilsynet, the Data Protection Agency, supervises the bans on biometric categorisation and on predicting crime. Domstolsstyrelsen, the Courts Administration, covers the courts’ own use of AI.

This is a summary, not legal advice.

Sources

Bring the AI tools and agents your company uses. We go through which rules apply to each, and what your people need to know.

Book a conversation