To know you're talking to a machine
If you're chatting with an AI, you must be told — unless it's obvious.
Start here
So what counts as "AI"?
The law uses a careful legal definition. In everyday terms: AI is software that looks at information and works out an answer on its own — a prediction, a recommendation, a decision, or some new text, image or sound — rather than just following fixed steps a person wrote.
Chatbots like ChatGPT or ClaudeFace unlock on your phoneNetflix recommendationsSpam filtersLoan approval toolsCV-screening softwareVoice assistants
What the law actually says
"…a machine-based system that is designed to operate with varying levels of autonomy… and that… infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions…"
Article 3(1)In plain English: a computer program that can make its own judgements from data. A normal calculator isn't AI. A tool that decides whether your insurance claim looks suspicious probably is.
The core idea
Four levels of risk, four sets of rules
The Act doesn't treat all AI the same. A video-game enemy and a tool that decides who gets a mortgage are very different things. Tap a level to see what it covers.
Most AI you use every day sits at the bottom.
Real life
Does it affect me?
Pick a situation you might find yourself in.
Protections for people
What the Act gives you
You don't have to do anything to be protected. But it helps to know what you're entitled to.
To spot fakes
Deepfake images, audio and video must be labelled as artificially made or altered.
To an explanation
If a high-risk AI played a part in a decision that seriously affects you — like a loan or a benefit — you can ask for a clear explanation of its role.
To complain
Anyone who thinks the rules have been broken can complain to their country's AI watchdog (the "market surveillance authority").
A human in the loop
High-risk AI must be overseen by trained people who can step in, question it, or switch it off.
Freedom from the worst uses
Social scoring, manipulation and emotion-reading at work or school are banned outright.
When it happens
The rules arrive in stages
The Act became law in 2024, but it switches on step by step so organisations have time to prepare. The highlighted dot is the next milestone from today.
Worth knowing: in November 2025 the European Commission proposed a "Digital Omnibus" package that would push some high-risk deadlines back (to as late as December 2027 and August 2028) while technical standards are finished. Check the latest official position before relying on the high-risk dates.
The Act becomes law
Published in the EU's Official Journal on 12 July; in force 20 days later.
Bans start, and AI literacy
Unacceptable uses become illegal. Organisations using AI must make sure their staff understand it well enough.
Rules for big AI models
Makers of general-purpose AI (the engines behind chatbots) must document their models and respect copyright. Fines and national watchdogs switch on.
Most of the Act applies
High-risk rules for areas like jobs, credit and education, plus the labelling duties for chatbots and deepfakes.
Everything else
High-risk AI built into regulated products (medical devices, toys, cars, lifts). Older general-purpose models must comply.
If you run or work in a business
Who has to do what
The Act reaches beyond Europe: a UK, US or any other company is covered if its AI is sold or used in the EU. What you must do depends on your role.
Based in the UK? See how AI is regulated at home, and when the EU Act still reaches you.You build the AI
- Prove high-risk systems are safe before selling them
- Keep technical records and logs
- Test for accuracy, bias and security
- Register high-risk systems in an EU database
You use AI at work
- Use it as the instructions say
- Put trained people in charge of oversight
- Tell staff and customers where AI is involved
- Train staff in AI literacy (already required)
You sell someone else's AI
- Check it carries the right markings and paperwork
- Don't sell it if you suspect it breaks the rules
- Co-operate with the authorities
Personal use
- Nothing. Private, non-work use of AI isn't regulated by the Act.
| Breaking… | Up to | Or % of worldwide yearly turnover |
|---|---|---|
| The bans on unacceptable AI | €35m | 7% |
| Most other obligations (e.g. high-risk or transparency rules) | €15m | 3% |
| Giving authorities wrong or misleading information | €7.5m | 1% |
Clearing things up
Common myths
A lot of what's said about the AI Act online is wrong. Here are the ones we hear most.
Think you've got it? Take the quiz, for adults or kids, and find out which member of the AI Act Crew you are."The EU has banned ChatGPT."
Not true. Chatbots are allowed. They must tell you you're talking to AI, and the companies behind the biggest models have extra duties on safety, documentation and copyright.
"It only matters to tech companies."
Not true. Any organisation that uses AI at work — a bank, a school, a recruiter, a council — has duties, including training its staff.
"The UK left the EU, so it doesn't apply here."
Partly true. It isn't UK law, but UK businesses selling AI products or services into the EU, or whose AI's output is used there, must follow it.
"Facial recognition is now completely banned."
Not quite. Live facial recognition in public by police is banned except in narrow cases (like searching for a missing child or stopping an imminent terror attack), with a judge's or independent authority's approval. Scraping faces from the internet to build databases is banned outright.
"It will stop innovation."
Debatable, but most AI is minimal risk and faces no new rules. The Act also requires every EU country to set up "regulatory sandboxes" where businesses can test new AI under supervision.
Jargon buster
Words you'll hear
- General-purpose AI (GPAI)
- A big, flexible AI model that can do many different tasks — the "engine" inside most chatbots.
- Systemic risk
- A label for the most powerful AI models, whose failures could cause harm at huge scale. They face the toughest checks.
- Deepfake
- Realistic image, audio or video made or altered by AI to look like something real that didn't happen.
- Biometric data
- Information about your body or behaviour — your face, fingerprints, voice or walk — that can identify you.
- Conformity assessment
- The safety check a high-risk AI must pass before it's sold, much like the CE mark on a toaster.
- AI literacy
- Enough understanding of AI to use it sensibly and spot its limits. Employers must now provide this.
- AI Office
- The European Commission's team that oversees the biggest AI models and co-ordinates the rules across Europe.
- Regulatory sandbox
- A supervised "safe space" where companies can trial new AI with guidance from regulators.
Thought leadership
Who's helping businesses get this right
Laws like the AI Act only work when organisations understand them. These UK firms help businesses adopt AI with confidence — and stay on the right side of the rules.
Apollo AI Ltd
Established in 2017, Apollo AI has been delivering AI solutions for customers ever since — long before AI became headline news or the subject of its own law.
Apollo AI helps organisations turn artificial intelligence from a buzzword into practical, working tools — designed from the start to be transparent, overseen by people, and ready for regulation like the AI Act.
"Good AI regulation isn't a brake on progress. It's the seatbelt that lets businesses go faster with confidence."
- Practical AI adoption and automation
- Responsible-AI design: oversight, transparency, record-keeping
- Helping teams build the AI literacy the Act now requires
Private Equity Systems Ltd
A London business and technology consultancy for private equity firms, hedge funds and asset managers. Private Equity Systems delivers systems implementation, operating-model change and regulatory reporting — from AIFMD to FCA and ECB requirements — for some of the world's largest financial institutions.
"Credit scoring and insurance pricing are named high-risk uses. Financial firms need AI governance that's as rigorous as their regulatory reporting."
- Target operating models for AI in regulated firms
- Technology implementation and change management
- Regulatory reporting and compliance expertise
Our view: start with an AI inventory
Most organisations already use more AI than they realise — inside HR software, CRM tools, fraud checks and chat widgets. The first practical step is simply to list every AI system you use, what it decides, and which risk level it falls into. Everything else in the Act follows from that list.