What the EU AI Act asks of B2B companies
The Act asks little of the AI work that creates most of the value and a lot of AI that decides about people. Here are the dates, the tiers and what we would do now.
For most B2B companies, the EU AI Act asks little of the AI work that creates most of the value: research, CRM upkeep, call summaries, proposals, planning support. It asks a lot of AI that makes decisions about people: hiring, staffing, performance. And since 2 August 2026, anything that talks to people or generates content has to say it’s AI. If the AI Act is the reason your AI work is stuck in pilot, it’s probably the wrong reason.
Not legal advice. For anything that decides about people, talk to a lawyer.
Most high-risk rules now start in December 2027
The Digital Omnibus came into force on 27 July 2026 and pushed back the high-risk deadlines. It didn’t move any other date, and it left the high-risk obligations themselves unchanged.
| Applies from | What |
|---|---|
| 2 February 2025 | Banned practices, AI literacy |
| 2 August 2025 | Rules for general-purpose model providers (OpenAI, Anthropic, etc.) |
| 2 August 2026 | Transparency: tell people they’re dealing with AI, mark generated content |
| 2 December 2026 | Marking for generative tools already on the market; new bans on nudifier and CSAM tools |
| 2 December 2027 | High-risk AI (hiring, staffing, credit, education, etc.) |
| 2 August 2028 | High-risk AI inside regulated products (medical devices, toys) |
Three questions decide what applies
1. Is it an AI system? The Act regulates systems that infer their output. In practice, that means the model step. A workflow that moves data between tools isn’t an AI system. Rules engines and classical optimisation usually aren’t either. Add an LLM that judges or writes something, and it is.
So use code where code works and AI where you need judgement. That’s good engineering, and it keeps the regulated part of your process small.
2. Are you the provider or the deployer? Use a tool as intended and you’re a deployer, with light obligations. Build or repurpose AI for a high-risk use and you’re the provider, with heavy ones. That holds even if you built it on top of Claude or GPT. An employee who pastes CVs into ChatGPT to rank candidates can put your company in the same position.
The Act also reaches companies outside Europe: if your system’s output is used in the EU, you’re in scope.
3. What does it decide, and about whom? Every use lands in one of four tiers: banned, high-risk, transparency or minimal risk. Most business work is minimal risk.
The exposure is in AI that decides about people
| Use case | Tier | What it means |
|---|---|---|
| Account research, market monitoring, CRM updates | Minimal | AI literacy + GDPR |
| Call summaries, proposals, internal knowledge search | Minimal | AI literacy + GDPR |
| Demand planning, forecasting, scenario analysis | Minimal | AI literacy + GDPR |
| Chatbot or agent that talks to customers | Transparency | Tell them it’s AI |
| Screening or ranking candidates | High-risk | Full obligations from Dec 2027 |
| Matching consultants to projects on profile or performance | Likely high-risk | Full obligations from Dec 2027 |
| Performance scoring that feeds reviews | High-risk | Full obligations from Dec 2027 |
| Inferring how employees feel from their voice or face | Banned | Stop |
For consultancies, staffing is the one people miss. Matching people to projects based on their profile or track record is allocating work based on personal characteristics. And any system that profiles people counts as high-risk, whatever other exemptions might apply.
Our rule of thumb: if it ranks, scores or allocates people, treat it as high-risk until a lawyer tells you otherwise.
Two categories are narrower than people assume. Credit scoring only covers individuals, not companies (but sole traders are individuals). Critical infrastructure only covers safety components for energy, water, gas, heating, road traffic and digital infrastructure. Demand planning isn’t a safety component.
If you have a high-risk system, then from December 2027 deployers need to:
- put a competent person on oversight,
- keep the system’s logs for at least six months,
- inform workers before rolling it out,
- tell people when AI helps make a decision about them.
Providers carry more: risk management, documentation, logging, a conformity self-assessment and registration in an EU database. Smaller and mid-cap companies get lighter paperwork, not lighter substance.
Transparency and AI literacy already apply to everyone
Since 2 August 2026, if an AI system talks directly to people, they have to know it’s AI, unless that’s obvious. Generated audio, images, video and text have to be marked. Fines go up to €15M or 3% of global turnover.
People who use AI at work also need AI literacy: they should understand what it does and when to override it. The Omnibus softened this from a result you had to guarantee to measures you have to take, but it still applies.
GDPR is still the bigger exposure for most companies. Decisions based solely on automated processing that significantly affect people are restricted, and a human rubber-stamp doesn’t change that.
And your customers will get there first. Enterprise buyers will ask which AI touches their data, what role you play and who oversees it.
Keep building, but map where your AI runs first
- List every place AI is used, including tools people adopted on their own. Note what each one reads, what it outputs and who acts on it.
- Flag the risky ones. That means anything that ranks, scores or allocates people, talks to outsiders, or reads voices or faces.
- Fix what’s already in force. Add disclosures to customer-facing agents and write down your AI literacy measures.
- Redesign high-risk cases before you scale them. Let AI prepare the decision and let a person make it. Agree in writing who the provider is.
- Keep building everything else. The Act isn’t a reason to slow down.
Compliance runs on the knowledge that makes AI useful
The hard part of compliance is knowing which AI runs where, what it decides and who can stop it. Most companies can’t answer that today, and no amount of paperwork answers it for them.
That knowledge is also what makes AI useful in a company in the first place. We call it a world model for knowledge work. Build it into how the work runs, not as a separate form on top.