Artificial intelligence has been a hot topic for a while now. As it develops at breakneck speed, questions about legal boundaries and accountability are coming up more and more often. How do you use AI in compliance with the law? Where's the line between acceptable and unacceptable use? And who's actually responsible for the decisions an AI system makes? These are questions we increasingly hear from companies planning to roll out artificial intelligence.
The trouble is, AI moves much faster than legislation. That's why the European Union adopted the EU AI Act – the world's first comprehensive regulation governing the use of artificial intelligence. Its goal isn't to slow down innovation, but to set out rules that allow AI to be developed and used in a safe, responsible, and trustworthy way.
So what exactly is this act, who does it apply to, and what obligations does it place on organizations? Below, we've rounded up the key things worth knowing before you kick off an AI project.
The AI Act (Artificial Intelligence Act) is an EU regulation that sets out uniform rules for developing, placing on the market, making available, and using AI systems across the Union. In other words, it standardizes something every organization used to interpret a little differently.
Its main goal is to limit the risks tied to AI use while still supporting innovation and market growth. The EU AI Act is also meant to protect fundamental rights, health, safety, and the interests of citizens and businesses.
Importantly, the regulation doesn't ban the use of artificial intelligence outright. Instead, it introduces obligations whose scope depends on the level of risk tied to a given AI application – and that logic is the key to understanding the whole act.
One of the most common misconceptions is that the EU AI Act only applies to companies building their own AI models. In reality, the regulation covers several different groups, including:
What obligations an organization ends up with mostly depends on the role it plays and the type of AI system it's using – the act clearly separates the responsibilities of providers from those of deployers. That's why a company deploying a customer-service chatbot faces different obligations than an organization building its own AI model, or a manufacturer of a device that relies on artificial intelligence.
The EU AI Act follows a risk-based approach. That means not every AI system is held to the same standard: the greater a solution's potential impact on people's safety or rights, the more obligations the regulation imposes. In practice, the act defines four risk levels.
Systems covered by so-called prohibited practices – including social scoring, certain forms of biometric identification and categorization in public spaces, and harmful AI-based manipulation or exploitation.
Systems used in areas such as recruitment, education, healthcare, law enforcement, or critical infrastructure. These face the most stringent requirements under the act.
Systems subject to transparency obligations – chatbots, deepfakes, or content-generation tools, where users simply need to know they're interacting with AI.
Most everyday AI tools fall here, and they're not subject to any additional obligations under the EU AI Act.
Organizations wanting to check for themselves which category their solution falls into can use tools like the AI Act Compliance Checker or the AI Act Explorer. They're a solid starting point for an initial assessment, though neither replaces a full legal analysis.
Sources: Art. 5, Chapter III, and Art. 50 of Regulation (EU) 2024/1689 (AI Act); European Commission – AI Act Overview.
While the AI Act is a piece of legislation, its impact reaches far beyond the legal department. The new rules apply to every organization using artificial intelligence, whether it builds its own solutions or relies on off-the-shelf tools.
One of the most common mistakes is assuming that using a commercial AI product shifts all responsibility onto its vendor. In fact, the EU AI Act clearly distinguishes between the roles of provider and deployer, meaning some obligations fall on the organization using the AI too. Advisory firms, including Deloitte, have found that awareness of this split in responsibility is still lacking in many organizations – and that awareness is exactly what determines whether a rollout goes smoothly.
Since responsibility is now spread across multiple parties, the approach to deploying AI is changing too. What matters isn't just which solution an organization picks, but how it was designed, implemented, and used day to day. That's why, alongside functionality, security, transparency, and regulatory compliance are becoming just as important.
That's also exactly why choosing the right technology partner now matters just as much as choosing the AI tool itself.
This is one of the first questions we hear from companies starting out with AI – and also one of the most commonly misunderstood. Many organizations assume that because they're using an off-the-shelf solution, all the responsibility for EU AI Act compliance sits with the vendor.
In practice, responsibility is shared. The regulation sets out obligations for both AI system providers and the organizations that use them, and who's accountable for what depends on the role each party plays in the process.
Put another way: safe, compliant use of artificial intelligence is a responsibility shared across the whole ecosystem – from the technology provider, through the implementation partner, to the organization using the solution. Each of these parties has its own obligations under the regulation, and market surveillance authorities are there to make sure they're actually followed.
That's why AI Act compliance starts as early as choosing the technology and the implementation partner – the question isn't just "which AI tool should we pick?" anymore, but also "will the partner deploying it help us meet the AI Act's requirements?"
Responsible AI deployment starts long before the first model goes live. First, you need to answer a few basic questions: what business problem is AI meant to solve, what data will be used, where will it be processed, and who will have access to it. These decisions shape everything that follows – the solution's security, its compliance assessment, and the obligations it triggers under the EU AI Act.
The next step is choosing the right architecture and technical requirements. Not every organization can, or should, rely on public AI models – in many cases it's necessary to deploy solutions that offer greater control over data, users, access, and AI usage history, including the right AI safety components.
Just as important is preparing the organization itself to work with AI systems: setting usage policies, assigning appropriate permissions, training employees, and continuously monitoring how AI is being used. The act explicitly requires that people working with AI systems have an adequate level of AI literacy.
So it's clear that a technology partner's job today goes well beyond just switching a solution on. They should help design the whole process – from choosing the technology, through architecture and integrations, to meeting the AI Act's requirements.
A successful AI rollout starts with asking the right questions – not about the model or the feature count, but about how the solution will actually function inside the organization:
The AI Act isn't an obstacle to adopting artificial intelligence in your company – it shows where the boundaries of safe, responsible AI use actually lie. Compliance isn't a box you check once; it's the ongoing, deliberate management of data, access, and roles, starting on day one of deployment. The earlier an organization asks itself questions about risk, responsibility, and architecture, the easier it will be to meet EU AI Act requirements later on, without having to rebuild everything from scratch.
It's also worth remembering that this kind of order is much easier to maintain when AI in your company isn't scattered across random subscriptions, but instead runs in a single, managed environment – with full control over data, access, and cost.
AI Hub is a ready-made, open-source-based platform where your company can run its own knowledge base and AI agents, keeping data inside your own infrastructure with full visibility into who's using what, and how.
Explore AI Hub
