Since the EU AI Act passed into force, the coverage has oscillated between two extremes: catastrophising about €35M fines on one side and dismissive “it won’t apply to us” optimism on the other. Neither is particularly useful.

This article is a practical briefing. What the Act actually requires, who it applies to, what the deadlines mean in practice, and the three decisions every EU business needs to make before August 2026.

Unacceptable Risk — Prohibited. AI systems that manipulate people unconsciously, enable mass surveillance by public authorities, or use social scoring by governments. These are banned outright. Most businesses don’t touch these categories.

High Risk — Full Compliance Required. This is where most of the compliance work sits. High-risk AI includes systems used in: hiring and employment decisions, credit scoring and financial services, educational assessment, healthcare and medical devices, law enforcement, border control, and AI in safety-critical infrastructure. If you use AI in any of these contexts — or your AI vendor does — you have significant compliance obligations including technical documentation, human oversight procedures, and conformity assessment.

Limited Risk — Transparency Obligations.

Chatbots and AI that interacts directly with people must disclose that the user is talking to AI. This is the minimum bar — and one that many customer-facing AI deployments are not currently meeting.

Minimal Risk — No Specific Requirements.

Spam filters, AI-powered recommendation engines for content, most productivity AI tools. These sit here. But “minimal risk” doesn’t mean zero obligation — you still need to know what you’re running and be able to demonstrate you’ve assessed the risk.

Organisations that handle this well treat it as a governance programme rather than a one-off project. They build an AI inventory that stays current as new tools are adopted. They create an AI governance policy that applies to procurement as well as deployment — so new AI purchases trigger a classification assessment before they enter the business. They implement human oversight procedures that are documented and practiced, not just written down.

They also recognise that compliance and competitive AI deployment are not in tension. The organisations that build proper governance infrastructure are typically better at AI implementation overall — because the discipline that compliance requires is the same discipline that good AI project management requires.

The August 2026 deadline is real. The fines — up to €35M or 7% of global annual turnover — are real. But for most EU businesses, the path to compliance is clearer than the headlines suggest. It starts with knowing what you’re running.