AI Act Explained: What is the AI act?

You may already be using AI, such as a chatbot or a smart search function. If you use these tools, as a company you are expected to comply with the European AI regulation. In this blog you can read exactly what this regulation (law) entails. And for whom these new rules apply.

The AI Act is the European regulation (also called a Law) that governs the use of artificial intelligence. It is officially also known as Regulation (EU) 2024/1689. It sets out rules for AI systems that are placed on the market or used in the EU. The aim of the law is to limit risks to safety and fundamental rights.

A European regulation applies in all EU countries. Organisations from outside the EU can also fall under the law, for example if the output of their AI system is used in the EU.

The AI Act classifies AI applications based on risk. The greater the potential risk to safety or fundamental rights, the stricter the rules. The European Commission distinguishes AI in the following categories: prohibited applications, high-risk systems, transparency obligations and minimal risk. The table below shows examples and what the classification means.

The risk category depends on the purpose and use of an AI system. A system that assesses job applicants or helps decide whether someone receives a benefit has a greater impact than, for example, an internal document generation system. Because such decisions have a major impact on someone's ability to work or access to a public service, it is important to carefully assess how the AI is used in AI for recruitment and benefits.

Transparency means that you can recognise when you are working with AI. For example, when you use an AI assistant, it must be made clear that you are not talking to a real person.

For AI-generated content, the transparency rules distinguish between two types of disclosure:

• Digital marking: machine-readable markers in AI-generated text, images, audio or video. An example is a digital watermark in an image. This is not visible to the user but can be recognised in the content's data.

• Visible AI label: a clear notice for people. In the case of a deepfake, such as a fabricated video in which someone appears to say something they never said, it must be made clear from the start that the content has been generated or manipulated by AI.

The AI Act sets out various obligations for providers and users of AI tools. A provider places a system on the market under its own name. A deployer (in Dutch: 'gebruiksverantwoordelijke') uses such a system under its own responsibility. Only private use falls outside these rules.

If you buy a ready-made AI tool for work, you are usually a deployer rather than the provider. Rules can still apply in that case. If you change the intended purpose or substantially modify the system, your role may change as well.

Not only organisations have to deal with the law. Residents of the EU can complain to a supervisory authority about a breach of the AI Act. This can happen if they want insight into how, for example, sensitive data is processed.

The rules of the AI Act do not all apply from the same date. The timeline below shows the most important application dates. The Dutch Data Protection Authority also describes a transition period for digital marking in certain systems that were already on the market.

The deadlines for certain high-risk systems were changed in 2026. The European Commission has included these dates here.

The European AI Act applies directly in the Netherlands. The Netherlands must also determine which authorities supervise the rules and how they are enforced.

National supervisory authorities check, among other things, the prohibited AI applications, the requirements for high-risk systems and the transparency rules. The European AI Office supervises the obligations for providers of general-purpose AI models. This is how supervision is divided between the Netherlands and the EU.

Start with an overview of the AI systems your organisation uses. For each system, note its purpose, who works with it and who is affected. Then check whether an application is prohibited, may be high-risk or falls under the transparency rules. Would you like help with this? Then get in touch!

If you use a high-risk AI system, extra tasks may apply. Think of following the provider's instructions, human oversight, suitable input data and reporting serious incidents. Exactly which tasks apply depends on your role and the applicable date. If you process personal data, also check the use against the GDPR.

Make sure there is AI literacy that suits employees' tasks, the context and the risks. For a practical basis for safe use of AI, you can take the AI-Wijzer course.