Regulation· Verdieping
The European AI Regulation Explained: Risk Classes and Preparation
The AI Act operates with different risk levels. What an organisation must do depends on the role, the application and when rules apply.
Evergreen deep-dive — sources checked on 5 November 2026; no new release announcement.
The European AI Regulation, often called the AI Act, is not a general licensing requirement for every algorithm. The core is a risk-based approach: the greater the possible impact on health, safety or fundamental rights, the stricter the requirements. The regulation entered into force on 1 August 2024 and is being applied in phases. This makes both the precise application and the role of an organisation relevant. [1]
What the source confirms
The European Commission describes four broad levels. Many applications with minimal risk, such as spam filters, receive no specific obligations under the AI Act according to the Commission. For transparency risks, information or labelling obligations may apply, for example when someone communicates with a chatbot. High-risk systems must meet stricter requirements; the Commission mentions risk management, data quality, information for users and human oversight, amongst others. Applications with unacceptable risk, such as certain forms of social scoring, are prohibited. The concrete legal classification follows from the law and the circumstances, not from a product name or marketing claim. [1]
Practical consequences
Roles matter too. Developers and providers have different responsibilities than organisations that use or deploy a system. An organisation that purchases an existing tool should therefore not assume that all obligations lie with the supplier. Map out what the system is used for, who the target audience is, which decisions it influences and what human control exists. Ask suppliers for documentation about the intended use, limitations, data and relevant conformity information. [1]
Control points
The phased implementation makes a timeline essential. The AP states that since 2 February 2025 certain AI systems have been prohibited and organisations must ensure AI literacy of employees. The AP also mentions 2 August 2026 for additional requirements for certain systems and states that the regulation will be fully in force on 2 August 2027. Check current official information for the provisions that apply to your situation: legal timelines can be complex and exceptions or sector-specific rules may be relevant. [1]
Consideration
Preparation need not begin with a large compliance project. First create a register, appoint a responsible person and classify applications based on function and context. Then document how risks are assessed, how employees are made AI-literate, how users are informed and how incidents or undesirable outcomes are addressed. The AI Act moreover does not automatically replace other legislation, such as privacy law. A good preparation process therefore treats the AI Regulation as one component of a broader governance approach. This article is a guide and not legal advice. [1]
Further reading
View our Claude and code deep-dive and AI Act explanation.
Sources
- [1]Europese Commissie: Officiële documentatie / beleidsbron (1 August 2024)
- [2]Autoriteit Persoonsgegevens: Officiële documentatie / beleidsbron
This article was produced with AI assistance from the original sources cited and checked against our editorial policy. Editorial policy