AI Act · Status as of 1 September 2026

Who does the EU AI Act really apply to?

Almost every company where someone uses AI at work. Even if it is just ChatGPT for emails. Here is a checklist that tells you in a minute.

The AI Act, EU Regulation 2024/1689, distinguishes two roles. A provider develops AI and places it on the market. That means OpenAI, Google or Microsoft, and most of the regulation is aimed at them. A deployer uses AI in their activities. And today that is almost every company.

Checklist: does the AI Act apply to your company?

  • Does anyone at your company write emails, texts or summaries in ChatGPT or a similar tool?
  • Do you have Microsoft 365 with Copilot or Google Workspace with Gemini?
  • Does your marketing team create graphics or copy with AI?
  • Does anyone at your company screen CVs with AI?

One yes is enough to make your company a deployer. If you feel nobody at your company uses AI, it is worth asking. Surveys from neighbouring markets show that roughly one in five people use it at work. In companies where it has never been officially addressed, the share tends to be higher. Nobody mentions it because they don’t think it matters.

Does it apply to sole traders too?

Yes. A deployer is any natural or legal person using AI under their own authority. The only exception is purely private use at home. The European Commission has clarified that business, trade, the practice of a profession or regular economic benefit all mean professional activity.

The regulation has no size threshold, no limit on headcount or turnover. The only thing that changes is what is proportionate in your situation.

No need to wait for national laws

The AI Act is a regulation, not a directive. It applies directly in every EU country, however far national legislation has got. National law only decides who will supervise and by what procedure.

What this means for you

Out of more than a hundred articles, three affect an ordinary company.

  • Article 4, AI literacy. People who work with AI should understand it to a proportionate level. Since the Digital Omnibus amendment in July, this is an obligation of effort, not of result. It was neither scrapped nor postponed.
  • Article 50, transparency. A chatbot has to tell customers right at the start that it is a machine. Generated images, audio or video that look realistic must be labelled when published.
  • Article 5, prohibited practices. For an ordinary company, mainly the ban on emotion recognition in the workplace.

We cover them in more detail on the AI Act page.

Frequently asked questions

Does the AI Act apply without a national law?

Yes. The regulation applies directly in every member state. National law only decides who will supervise and by what procedure.

Is it enough that one person uses ChatGPT?

Yes. A company becomes a deployer by using AI in its activities. The regulation sets no minimum headcount or turnover.

Do we need a certificate?

No. The Commission has said directly that one isn’t required. You should, however, keep internal records of training and measures.

Not sure what applies to you? Message us and we’ll tell you straight.

Message us on WhatsApp