Context
What is the EU AI Act and who does it apply to?
The EU AI Act is Regulation (EU) 2024/1689. It does not regulate the technology as a whole but specific uses: the more risk a use carries for people, the more obligations it brings.
It applies to whoever builds or sells an AI system under their own brand (the provider) and to whoever uses one in their professional activity (the deployer). A small business using a chatbot or a recruitment tool from another company is in scope too.
In 2026 it was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744. Among other changes, it pushed back the high-risk obligations and added a new prohibition on intimate images generated without consent.
Risk
The four risk tiers of the AI Act
Every use falls into one of these tiers. The agent decides yours with the rule table, not with a model.
| Criterion | Examples | What it implies |
|---|---|---|
| Prohibited | Inferring emotions of staff or students, social scoring | Cannot be used in the EU (Art. 5) |
| High risk | Recruitment, credit scoring, admissions | Requirements, human oversight and logs (Chapter III) |
| Transparency | Chatbots, deep fakes, generated content | Tell people or mark the content (Art. 50) |
| Minimal risk | Summaries, code, sales analysis | AI literacy of staff (Art. 4) |
The AI literacy duty of Article 4 applies to providers and deployers at every tier. The Omnibus reworded it: it asks for measures to support it, without guaranteeing any specific level for each person.
Timeline
EU AI Act implementation timeline after the Omnibus
This is the eu ai act implementation timeline 2026 and beyond, per Article 113 of the text consolidated on 27 July 2026.
Prohibitions and AI literacy
Chapters I and II apply: definitions, AI literacy and prohibited practices.
General-purpose models and penalties
Chapter V (general-purpose AI models) and Chapter XII (penalties), among others, apply.
General application and transparency
The rest of the Regulation applies, including Article 50: chatbots, deep fakes and generated content.
New prohibition and marking
Prohibition of intimate images without consent, and the deadline to mark content from systems already on the market (Art. 111(4)).
Annex III high risk
High-risk obligations for employment, credit, insurance, education or biometrics.
Annex I high risk
Obligations for AI that is a safety component of regulated products, such as machinery or medical devices.
A high-risk system already on the market before its date is only covered if its design later changes significantly (Art. 111(2)). High-risk systems intended for public authorities must comply by 2 August 2030 in any case.
Architecture
How does IA RIA work?
Like BOE AI: code decides what code can decide, and the models only explain and check.
Rule table
From your role and use case, it decides the risk tier, the obligations and their date. No AI.
Official text
It fetches the exact paragraphs those obligations cite, from the consolidated text.
Mistral explains
It explains each obligation for your case, only from those paragraphs, without changing tier or dates.
Jev checks
It reviews every sentence: if it adds something, overstates or gives legal advice, a larger model rewrites it.
You decide
Each obligation links to its article in the official explorer so you can confirm it with a specialist.
The model does not classify your case. A table you can read below does, so the same selection always gives the same tier and the same dates.
That is why answers are cached for a week: if someone already ran your combination, you get it instantly and at no cost.
Transparency
The rule table that decides your tier
This is the full table the agent uses. Each row cites the legal basis of its tier; you can review it line by line.
| Criterion | Tier | Legal basis | Applies from |
|---|---|---|---|
| Internal use: writing, summaries, code, analysis | Minimal risk | Article 4(1) | 2 Feb 2025 |
| Chatbot or assistant that talks to customers | Transparency | Article 50(1) | 2 Aug 2026 |
| Generating images, videos or texts to publish | Transparency | Article 50(2) · Article 50(4) | 2 Aug 2026 |
| Synthetic voice or image of real people | Transparency | Article 50(4) | 2 Aug 2026 |
| Screening CVs or selecting candidates | High risk | Annex III, point 4(a) | 2 Dec 2027 |
| Evaluating staff or allocating their tasks | High risk | Annex III, point 4(b) | 2 Dec 2027 |
| Creditworthiness or credit scoring | High risk | Annex III, point 5(b) | 2 Dec 2027 |
| Pricing life or health insurance | High risk | Annex III, point 5(c) | 2 Dec 2027 |
| Admissions or grading students | High risk | Annex III, point 3(a) · Annex III, point 3(b) · Annex III, point 3(c) · Annex III, point 3(d) | 2 Dec 2027 |
| Facial recognition to identify people | High risk | Annex III, point 1(a) | 2 Dec 2027 |
| Detecting customers’ emotions | High risk | Annex III, point 1(c) | 2 Dec 2027 |
| Detecting emotions of staff or students | Prohibited | Article 5(1)(f) | 2 Feb 2025 |
| Scoring people on their social behaviour | Prohibited | Article 5(1)(c) | 2 Feb 2025 |
| Safety component of a regulated product | High risk | Article 6(1)(a) · Article 6(1)(b) | 2 Aug 2028 |
It is a deliberate simplification for typical small-business uses. There are exceptions, such as Article 6(3) for Annex III systems that do not materially influence the decision, which the agent flags but cannot assess for you.
Reliability
Verification: three questions to Jev on every answer
Jev is a decision model by TypeSafe that returns probabilities. Every sentence of the explanation goes through one of these questions:
Does it add anything?
What each obligation “requires” is checked against its paragraphs: requirements, conditions, dates or exceptions that are not there count as a failure.
Does it overstate the duty?
The “why it applies” is checked so it does not turn an option into a duty, widen who is affected or drop conditions.
Does it give legal advice?
The conclusion cannot tell you with certainty what you must do in your case: it explains the rules and suggests you confirm them.
If it fails, another round
If any failure probability is above 70 %, a larger model (Mistral Medium) rewrites it and Jev checks again. If it still fails, it is flagged.
Privacy
Security and data
The same defences as the BOE AI agent, reviewed against the OWASP Top 10 for LLM applications.
You type nothing
You only pick closed options. None of your text reaches a model, so there is no personal data to leak and no instruction to inject.
No training on your data
Mistral, a French company, and Jev are used through an API with a pinned version. Nothing is trained on your queries.
Against abuse
The agent’s own ALTCHA proof of work, per-visitor and global limits, a daily cap on new queries and a one-week cache.
No tracking
Your IP is only used in memory for the limits and is never stored. ALTCHA uses no cookies and no third parties.
Honesty
Status and limits
What the agent does today and what it cannot do, plainly.
Works today
- Applies a table of 14 use cases and 3 roles with the dates of the text consolidated on 27 July 2026.
- Quotes and links each paragraph in the official AI Act Service Desk explorer.
- Checks every sentence of the explanation with Jev and rewrites it if it fails.
Limits
- It does not replace a legal assessment: it cannot see your system or your contracts.
- It does not cover general-purpose AI models (Chapter V) or the scope rules of Article 2.
- The table simplifies; Article 6(3) exceptions are flagged, not assessed.
- If the consolidated text changes, the table and the text must be updated by hand.
Commission guidelines and technical standards may specify how each obligation applies. The agent quotes the Regulation, not those guidelines.
What is behind it
- Rule table: From your role and use case, it decides the risk tier, the obligations and their date. No AI.
- Official text: It fetches the exact paragraphs those obligations cite, from the consolidated text.
- Mistral explains: It explains each obligation for your case, only from those paragraphs, without changing tier or dates.
- Jev checks: It reviews every sentence: if it adds something, overstates or gives legal advice, a larger model rewrites it.
- You decide: Each obligation links to its article in the official explorer so you can confirm it with a specialist.
FAQ
Frequently asked questions
What does EU AI Act compliance mean for a small business?
It depends on how you use AI. Internal use such as writing or summarising leaves AI literacy (Article 4); a customer chatbot adds transparency duties; using AI to decide about people, such as recruitment, makes it high risk. The agent tells you which applies.
Who does the AI Act apply to?
To providers, who build or sell an AI system under their own name or trademark, and to deployers, who use one under their authority except in a personal non-professional activity. Importers and distributors of high-risk systems also have obligations.
When do the high-risk obligations apply?
After the Digital Omnibus on AI, on 2 December 2027 for Annex III systems, such as recruitment or credit scoring, and on 2 August 2028 for AI that is a safety component of Annex I products.
What are the EU AI Act penalties?
Up to EUR 35 million or 7 % of worldwide turnover for prohibited practices, and up to EUR 15 million or 3 % for breaching other obligations such as Articles 26 or 50. For SMEs, the lower of the two figures applies.
Is this an official EU service?
No. It is an independent agent by José Galán that uses the consolidated text published by the European Commission’s AI Act Service Desk under CC BY 4.0. For the official questionnaire, the Commission offers its own Compliance Checker.
Can I rely on the answer?
The tier and dates come from a fixed table and every sentence is checked against the official text, but it is information, not legal advice. Confirm your case with a specialist before deciding.
Custom AI agents
Want an agent like this for your regulations?
I design agents that apply rules to specific cases with reviewable logic, official text and verification, for law firms, advisory firms and compliance teams.
Source of the legal text
Text of the AI Act consolidated on 27 July 2026, as published by the European Commission’s AI Act Service Desk. Reused under CC BY 4.0; the agent’s summaries are not official.
AI Act Explorer (European Commission)This article was created with the help of AI and reviewed by José Galán. I take great care over every post and every translation, but the odd mistake can still slip through. If you find one, write to me: you will be helping me improve.