Digee / Wiki / Law and security
Overview
AI Act: what it means for your business.
The AI Act is EU Regulation (EU) 2024/1689, which regulates artificial intelligence according to the level of risk. For most small and medium-sized businesses using AI for admin work, the obligations are light. Still, it is worth knowing where your use falls.
In short
- The AI Act sorts uses of AI by risk: prohibited, high-risk, subject to transparency obligations, and minimal.
- Everyday admin (sorting mail, transcribing documents) mostly falls under minimal risk.
- In 2026 the rules for high-risk systems were postponed to December 2027 and August 2028 respectively.
On this page
Four risk categories
| Category | Examples | What it means |
|---|---|---|
| Unacceptable risk | Social scoring, manipulation of vulnerable people, emotion recognition in the workplace | Prohibited |
| High risk | Screening job applicants, credit scoring, access to education and public services | Strict obligations: risk management, documentation, human oversight, data quality |
| Limited risk | Chatbots, generated content | Transparency obligation: people must know they are dealing with AI |
| Minimal risk | Sorting mail, transcribing documents, drafting texts, spam filtering | No special obligations |
Deadlines: what applies from when
- 1 August 2024 The regulation entered into force.
- 2 February 2025 Ban on unacceptable practices and the obligation concerning staff AI literacy.
- 2 August 2025 Rules for general-purpose AI models (e.g. large language models) and the penalty framework.
- 2 August 2026 Most other obligations, including transparency for chatbots and generated content.
- 2 December 2027 Obligations for stand-alone high-risk systems (Annex III) – postponed by the Digital Omnibus package.
- 2 August 2028 Obligations for AI as a safety component of regulated products (Annex I).
The delay came from an amendment to the AI Act under the ‘Digital Omnibus’ package, which entered into force on 27 July 2026. The same amendment softened the wording of the AI literacy obligation and extended relief for small and medium-sized enterprises.
What it means for an ordinary business
If you use AI for admin and operations (typically an AI agent for sorting mail or processing documents), you act as a so-called deployer and mostly fall into the minimal-risk category. In practice:
- Transparency – if customers communicate with AI (a chatbot, automatic replies), they must know they are not dealing with a person.
- AI literacy – people who work with AI should understand what it can do and where it makes mistakes. Practical training on the tool they use is enough.
- Take care with HR and finance – sorting CVs or assessing creditworthiness may fall under high risk. Stricter rules apply there, and human oversight is required.
Fines
Fines can reach up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% of turnover for breaches of other obligations. For small and medium-sized enterprises, the lower of the two amounts applies.
The AI Act in the Czech Republic
The regulation applies directly; Czech law mainly deals with supervision and penalties. Implementation is led by the Ministry of Industry and Trade; under the government bill, the main supervisory authority is to be the Czech Telecommunication Office. GDPR continues to apply alongside it.
Status as of 27 September 2026. This article is a general overview, not legal advice.
Frequently asked questions
Does the AI Act apply to small businesses too?
Yes, but the obligations depend on how you use AI. For everyday admin they are minimal – mainly transparency towards customers and basic training for the people who work with AI.
When do the rules for high-risk AI systems start to apply?
After the 2026 amendment, they apply to stand-alone high-risk systems from 2 December 2027 and to AI in regulated products from 2 August 2028.
Do I have to tell customers that AI is replying to them?
Yes. If they communicate with AI directly, for example through a chatbot, they must be told – unless it is obvious from the circumstances.
Want to know where AI would save you time?
We go through a normal week with you and find the first task worth handing to an agent. No obligation.
Related articles
AI and GDPR: what a business must watch out for
A practical guide for businesses: legal basis, processing agreements, data transfers outside the EU, automated decisions and DPIAs when deploying AI.
→Explainer · 3 minHuman-in-the-loop: a person decides
Human-in-the-loop means AI prepares the work and a person approves it. How to set an agent’s limits so it saves time without making costly mistakes.
→Explainer · 4 minWhat is an AI agent
An AI agent does more than answer: it finishes a task. It reads an email, finds the details, prepares the output and hands it to a person to approve.
→