eu ai act

A recruiter runs 400 applications for a remote developer role through an AI shortlister, then books three video interviews. The top candidate interviews well, clears the background check, and asks for the laptop to go to a new address.

Two of those steps involved AI, and both can fail in ways the recruiter never sees. The shortlister may have dropped qualified people for reasons nobody chose, and the person on camera may not be the person on the documents.

Most of the EU AI Act applies to a narrow set of high-risk systems. Article 4 is the exception, because it reaches every organization that builds or uses AI, no matter how harmless the tool looks.

It has applied since 2 February 2025, well ahead of the high-risk obligations, which the Digital Omnibus pushed back to December 2027. So while teams plan for the heavier duties, the literacy clause is already live.

The EU AI Act does not ban deepfakes. It treats them as a transparency problem, so the duty is not to stop synthetic media but to make sure people know when content is artificial.

That duty lives in Article 50, and it splits the responsibility between the company that builds the generation tool and the company that publishes the result. Getting the split wrong is how a marketing clip or a training video turns into a compliance gap.

Teams often treat the EU AI Act as a brand new rulebook that lands on a clean desk. It does not. If your AI system touches personal data, GDPR was already on that desk, and the AI Act stacks on top of it.

That stacking is where most of the confusion lives. The same project can owe a Data Protection Impact Assessment under one law and a Fundamental Rights Impact Assessment under the other, and nobody wants to run two parallel compliance tracks if one mapped program will do.

The EU AI Act does not treat every AI system the same way. It uses a risk-based design, so the obligations on a spam filter look nothing like the obligations on a CV-screening tool or a credit-scoring model.

That single decision, which risk category your system falls into, drives almost everything else: the controls you owe, the documentation you keep, and the size of the fine if you get it wrong.

The EU AI Act does not arrive on a single date. It applies in stages between 2024 and 2028, and each stage switches on a different set of obligations for the organizations that build or use AI systems in Europe.

The schedule also moved. The Digital Omnibus on AI, in force since 27 July 2026, pushed the high-risk regime for Annex III systems back to 2 December 2027, which gives most compliance teams extra runway while the obligations themselves still arrive.

Regulatory compliance is not optional. If you handle healthcare data, process payments, or serve European customers, specific frameworks mandate how you protect information. Security awareness training sits at the center of nearly every one of those requirements.

And yet most organizations treat compliance training as a checkbox exercise. Annual videos. Generic quizzes. Certificates that prove nothing except attendance. I’ve watched this pattern repeat for years, and it fails both the spirit and the letter of what regulators actually expect.

The organizations that get this right do something different. They build training that satisfies auditors and creates employees who understand why regulations exist, how their daily actions either protect or expose sensitive data, and what to do when something looks wrong.