EU AI Act: obligations for businesses using AI

The EU AI Act (Regulation (EU) 2024/1689) applies to companies that use artificial intelligence, not only to those that build it. If your company runs a chatbot, a voice agent or a document extraction tool, two obligations matter today: train your staff and tell people when they are talking to an AI. If AI plays a part in decisions about hiring, credit or access to services, the system may be high-risk, and those obligations apply from 2 December 2027.

For a broader introduction, read our guide to AI agents for business first.

What the AI Act is and who it applies to

Regulation (EU) 2024/1689 regulates AI systems according to their risk. It entered into force on 1 August 2024 and applies in phases, directly in every member state. It covers any company that uses AI in a professional activity in the EU, and non-EU providers whose systems are used in the EU. Purely personal use is out of scope.

Provider or deployer: which role do you have?

The Act assigns obligations by role. Two roles matter for almost every company (Article 3):

Most companies are deployers, with some important nuances:

• If you commission a custom system and put it into service under your own name, you may be its provider even if another company writes the code. The definition of provider includes anyone who “has an AI system developed”.
• If you modify a high-risk system, put your brand on it, or change its purpose so that it becomes high-risk, you take on the provider’s obligations (Article 25).
• If you use a model such as GPT, Claude or Gemini through an API, you are not the provider of the model. You are the provider or deployer of the system you build on top of it.

Before you commission an AI project, agree in writing who is the provider and who is the deployer. That decision sets who documents the system, who assesses conformity and who answers to the regulator.

The four risk levels

1. Prohibited practices (Article 5)

Banned since 2 February 2025. The ones most relevant to businesses:

• Subliminal or deceptive manipulation that causes significant harm.
• Exploiting vulnerabilities linked to age, disability or economic situation.
• Emotion recognition in the workplace or in education, except for medical or safety reasons.
• Biometric categorisation to infer race, political opinions, religion or sexual orientation.

The 2026 amendment adds a ban, from 2 December 2026, on systems that generate non-consensual intimate images of identifiable people or child sexual abuse material (European Commission).

Example: a voice agent that analyses your employees’ tone of voice to gauge their emotional state is prohibited.

2. High-risk (Annexes I and III)

There are two kinds of high-risk systems:

• Annex I: AI that is a safety component of products already regulated by EU law (machinery, medical devices, toys, lifts and so on).
• Annex III: AI used in sensitive areas. For private companies, the most common are:
  • Employment: targeted job ads, analysing and filtering applications, evaluating candidates, decisions on promotion or dismissal, task allocation based on behaviour, and performance monitoring.
  • Access to essential services: creditworthiness assessment of individuals, and risk assessment and pricing for life and health insurance.
  • Education: admissions, assessing students or detecting cheating in tests.
  • Biometrics: remote biometric identification or emotion recognition.

An Annex III system is not high-risk if it does not materially influence the decision, for example when it performs a narrow procedural task or a preparatory task (Article 6(3)). That exception never applies when the system profiles individuals.

3. Transparency risk (Article 50)

Most conversational AI projects fall here. From 2 August 2026:

• Chatbots and voice agents: people must be told they are interacting with an AI, unless it is obvious. The notice must come at the latest at the first interaction.
• AI-generated content (audio, images, video or text): the provider must mark it in a machine-readable format. Systems placed on the market before 2 August 2026 have until 2 December 2026 to comply.
• Deepfakes and AI-generated text on matters of public interest: whoever publishes them must disclose it. Text is exempt if a person takes editorial responsibility.

4. Minimal risk

A spam filter or an internal document classifier only carries the AI literacy obligation. The GDPR applies if it processes personal data.

AI literacy (Article 4)

Since 2 February 2025, providers and deployers must take measures so that their staff have sufficient knowledge of AI. The 2026 amendment softened the wording: companies must now “support” AI literacy in proportion to the context, without guaranteeing a specific level for each person, and the Commission will publish practical examples (amending text on EUR-Lex).

In practice, document a short training for anyone who uses or oversees each system: what it does, its limits, when to check its output and who to alert when it fails.

General-purpose AI models (GPAI)

General-purpose models (large language models) have their own obligations since 2 August 2025: technical documentation, information for companies that integrate them, a copyright policy and a summary of training data. They fall on the model provider (OpenAI, Anthropic, Google, Mistral and others), not on the company that calls the model through an API. Your job is to ask for that documentation and review the vendor’s data processing terms.

The current timeline (2026 update)

The original timeline changed in 2026. Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI” or “AI Omnibus”, was adopted on 8 July 2026 and entered into force on 27 July 2026. It postpones the high-risk obligations. According to the European Commission, the timeline now is:

The delay is not a reason to wait: a recruitment tool you commission today will still be running in December 2027, and retrofitting it costs more.

Deployer obligations for high-risk systems

If you use a high-risk system, Article 26 requires you, among other things, to:

• Use it according to the provider’s instructions and monitor its operation.
• Assign human oversight to people with the right training and authority.
• Keep the logs under your control for at least six months.
• Inform workers’ representatives and affected workers before using it at work.
• Inform the people about whom the system makes, or helps make, decisions.

Companies that assess creditworthiness, price life and health insurance or provide public services must also carry out a fundamental rights impact assessment (Article 27).

Fines (Article 99)

For SMEs and start-ups, the lower of the two figures applies. Each member state sets and enforces the actual penalties.

Spain: AESIA and the national law

Spain’s AI supervisory agency, AESIA (Agencia Española de Supervisión de Inteligencia Artificial), is based in A Coruña. Its statute gives it inspection, verification and sanctioning powers over AI (Royal Decree 729/2023), and it publishes practical guidance on the Act. The Spanish Data Protection Agency (AEPD) remains the authority for anything involving personal data.

The Spanish law meant to implement the Act has not been passed. The government approved the Organic Law bill on the good use and governance of AI in May 2026. Parliament registered it as 121/000096, but its official record shows it as “Concluded - (Lapsed)” since 6 October 2026. The AI Act applies regardless, because it is an EU regulation.

The AI Act and the GDPR

The AI Act does not replace the GDPR. If your system processes personal data, you comply with both:

• GDPR Article 22: people have the right not to be subject to decisions based solely on automated processing that significantly affect them. Keep genuine human review in decisions about candidates, customers or employees.
• GDPR Article 35: a data protection impact assessment (DPIA) is mandatory when processing is likely to result in a high risk, which is common with AI that evaluates people. The AI Act requires high-risk providers to give you the information you need for it (Article 26(9)).
• GDPR Article 28: the model or platform vendor acts as your processor. You need a data processing agreement and must know where data is processed.

Checklist for an SME by use case

For every case:

1. Build an inventory of the AI systems your company uses, including general-purpose assistants.
2. Classify each one and define your role: provider or deployer.
3. Document training for the staff who use them.
4. Review vendor contracts and revisit everything once a year.

How we apply it at LCApps

At LCApps, a software consultancy based in Spain, we design and operate all our AI projects in line with the GDPR and the EU AI Act. In the voice agents we have built, the agent explains how data is processed at the start of the call and we log every conversation. In our multichannel chatbots (web, WhatsApp, SMS and Telegram), the agent queries real business data with only the permissions it needs. In document extraction, we process documents with AI, extract the relevant information and load it directly into the case file, with human review where the data is critical.

If you commission a custom AI system, compliance starts at design time: which data it sees, which actions need confirmation and how each decision is logged. We treat it like any other custom software project, and the cost depends on those decisions, as we explain in custom software development cost.

Frequently asked questions

Does the AI Act apply to an SME that only uses ChatGPT?

Yes, but the obligations are light. You must support your staff’s AI literacy and comply with the GDPR for the data you enter. If you publish deepfakes, or AI-generated text on matters of public interest without editorial review, you must disclose it.

Do I have to say that my chatbot is an AI?

Yes, from 2 August 2026, unless it is obvious to a reasonably well-informed person. The notice must come at the latest at the first interaction. A clear opening message, in the chat or at the start of the call, is the simplest way to comply.

Has the AI Act been postponed?

Only in part. Regulation (EU) 2026/1744, in force since 27 July 2026, moves Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028. Prohibitions, AI literacy, general-purpose models and transparency keep their dates.

Is using AI to screen CVs high-risk?

Usually, yes: Annex III covers analysing and filtering applications and evaluating candidates. The high-risk obligations apply from 2 December 2027, but GDPR Articles 22 and 35 already apply today.

Conclusion

The AI Act does not ban chatbots, voice agents or document extraction. It requires you to know your role, tell people when they deal with an AI and train your team. The heavy lifting comes with systems that make decisions about people.

At LCApps we build chatbots, voice agents, document data extraction and AI agents that comply with the GDPR and the AI Act by design. Tell us which process you want to improve.