The EU AI Act sets the framework for regulating AI in the EU.

Responsible AI is not only about selecting an appropriate AI tool. It also concerns how people use AI, how AI-generated material is presented, when outputs should be reviewed by a person, and whether people understand when they are interacting with AI.

Article 50 of the EU AI Act introduces transparency requirements for specific AI systems and situations. Depending on the use, organisations may need to inform people when they are interacting directly with AI or make certain AI-generated or manipulated content identifiable.

For businesses, responsible AI therefore also becomes a question of everyday practice: when should AI be disclosed, when should a human check the output, and how should AI-generated material be presented to colleagues, customers and the public?

Potentially. Certain AI systems used in employment and recruitment can fall within the high-risk framework, as can certain systems used in areas such as education, essential services, biometrics, critical infrastructure, law enforcement and other sensitive contexts.

Where the high-risk requirements apply, organisations may need to address areas such as risk management, data quality, logging, technical documentation, human oversight, accuracy, robustness and cybersecurity.

Whether a particular system is high-risk depends on the system and its intended purpose, rather than simply on the fact that it uses AI.

Buying an AI system from another organisation does not automatically remove your responsibilities.

Your organisation should understand what the system is designed to do, how it is classified, what instructions and documentation the provider supplies, and which responsibilities belong to the provider and which apply to your organisation as the deployer.

Your responsibilities can also depend on how the system is actually used within your business.

Organisations that develop AI systems, have systems developed for them, or place certain AI systems on the EU market or put them into service under their name can have provider responsibilities under the AI Act.

The obligations depend on the type of system and its classification. Some systems are subject to relatively limited requirements, while high-risk systems have substantially more detailed obligations.

General-purpose AI models have specific obligations under the AI Act, particularly for their providers.

These obligations can include technical documentation, information for downstream providers, copyright-related requirements and information about training content. Models presenting systemic risk are subject to additional requirements.

For a business using a general-purpose AI model, the important question is also how the organisation is using it. The use case may create separate responsibilities under other parts of the AI Act.

Yes. AI literacy requirements have applied since 2 February 2025.

Providers and deployers must take measures to ensure an appropriate level of AI literacy among people dealing with AI systems, taking account of their knowledge, experience, training and the context in which the AI system is used.

For organisations, this means people using or overseeing AI should have enough understanding to use it appropriately in the context of their work.

Article 50 introduces transparency requirements for certain AI-generated and manipulated content.

Depending on the circumstances, this can include requirements relating to deepfakes and AI-generated or manipulated text that is published to inform the public about matters of public interest.

Article 50 transparency obligations apply from 2 August 2026, subject to the specific conditions and exceptions in the regulation.

For businesses, the practical question is not simply whether content was produced with AI, but whether the particular use falls within an Article 50 transparency obligation.

Potentially.

The AI Act can apply to organisations outside the EU in specific circumstances. This includes situations where an AI system or general-purpose AI model is placed on the EU market, or where the output produced by an AI system is used in the EU.

A company's physical location therefore does not by itself determine whether the AI Act is relevant.

No general prohibition on using personal data for AI training is created by the AI Act.

However, using personal data with AI remains subject to applicable data-protection law, including the GDPR.

Organisations therefore need to consider the AI Act alongside the separate rules governing personal-data processing, including whether there is a lawful basis for the processing and whether applicable rights and safeguards are respected.

Start by establishing what AI is already being used across the organisation, including third-party tools.

Identify what each system is being used for, who is responsible for it, what role your organisation has under the AI Act, and which risk category may apply.

From there, review whether any prohibited practices are involved, whether transparency or AI-literacy requirements apply, what supplier responsibilities exist, and whether additional requirements apply to high-risk or general-purpose AI.

A simple inventory of AI use is often a useful starting point for understanding what needs attention.

Start with the classification rules in Article 6 and the relevant annexes of the AI Act.

Some systems are specifically identified as high-risk through Annex III, while certain AI systems connected with regulated products are covered through Article 6(1) and Annex I.

For certain Annex III systems, Article 6(3) provides a specific route for determining whether the system should nevertheless not be considered high-risk, subject to the conditions set out in that provision.

The assessment should therefore be based on the particular system and its intended purpose, rather than simply the technology being used.

AI systems, business uses and regulatory requirements can change.

Organisations should keep their AI inventory, supplier information, risk assessments and governance arrangements under review.

Particular attention may be needed when an AI system is substantially changed, repurposed, introduced into a new business process or used for a different purpose.

Keeping a clear record of what AI is being used, why it is being used and who is responsible for it can make ongoing review much easier.