Which rules apply when your business uses AI?

The EU AI Act: what applies when

The AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and applies in stages. Regulation (EU) 2026/1744, the “Digital Omnibus on AI,” in force since July 27, 2026, moved some of the later dates.

1. February 2, 2025Prohibited AI practices and the AI literacy duty apply. Since the Digital Omnibus, providers and deployers must take measures to support their staff’s AI literacy, without having to guarantee a specific level (Art. 4).[1][4]
2. August 2, 2025Obligations for providers of general-purpose AI models apply.[1]
3. August 2, 2026Most rules apply, including the transparency duties in Article 50: disclosing chatbots, marking AI-generated content and labeling deepfakes.[1][2]
4. December 2, 2026New bans on AI systems that create non-consensual intimate images and child sexual abuse material apply; providers of content-generating AI systems placed on the market before August 2, 2026 must meet the marking duty in Article 50(2).[1][4]
5. December 2, 2027Rules for high-risk AI systems listed in Annex III (for example, in hiring, education and credit scoring) apply.[1][4]
6. August 2, 2028Rules for high-risk AI built into products covered by Annex I (for example, machinery and medical devices) apply.[1][4]

The AI Act also applies to businesses outside the EU when their AI system’s output is used in the EU (Art. 2(1)(c)).[3]

GDPR: the data protection baseline

Any AI workflow that touches customer data is also a data protection question.

1. Since May 25, 2018The GDPR applies, including to businesses outside the EU that offer goods or services to people in the EU (Art. 3(2)).[5]
2. TransfersSending personal data to an AI service outside the EU/EEA needs an adequacy decision or a safeguard such as standard contractual clauses (Art. 45–46).[5][6][7]
3. FinesUp to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches such as unlawful transfers (Art. 83(5)).[5]