AI Act: Complete Guide for Companies 2025

The European Union adopted in April 2024 the regulation on artificial intelligence, commonly called AI Act. This historic legislation establishes the first comprehensive legal framework in the world to govern the development and use of AI. For businesses, understanding and anticipating these obligations is no longer optional - it's a strategic necessity.

Application timeline: where are we now?

The AI Act adopts a progressive approach. Not all obligations come into force simultaneously, giving businesses time to prepare.

The four risk levels

The AI Act classifies artificial intelligence systems into four categories according to their risk level. This proportionate approach aims not to hinder innovation while protecting fundamental rights.

1. Unacceptable risk: prohibited practices

Since February 2, 2025, these AI uses are purely and simply prohibited in Europe:

2. High risk: documentation and compliance

High-risk AI systems are listed in Annex III of the regulation. They concern areas where AI can have a significant impact on people's rights:

• Biometrics: Identification, categorization, emotion recognition
• Critical infrastructure: Traffic management, energy, water
• Education: Access to institutions, assessment, cheating detection
• Employment: Recruitment, promotion, employee surveillance
• Essential services: Credit scoring, insurance, social benefits
• Law enforcement: Lie detection, profiling
• Migration: Border control, asylum applications

For these systems, providers must implement:

• A risk management system
• Training data governance
• Complete technical documentation
• Traceability mechanisms
• Appropriate human oversight
• CE marking after conformity assessment

3. Limited risk: transparency required

Certain AI systems present limited risk but require a transparency obligation:

• Chatbots: The user must know they are interacting with an AI, not a human
• Deepfakes: Synthetic content imitating real people must be clearly marked
• Categorization systems: Information about how they work
• Content generation: Mention that content was generated by AI

4. Minimal risk: no specific obligation

The vast majority of AI systems (spam filters, video games, basic productivity assistants...) present minimal risk and are not subject to any particular obligation.

GPAI obligations: ChatGPT, Claude, Gemini concerned

General-purpose AI models (GPAI - General Purpose AI) are subject to a specific regime. Since August 2, 2025, providers of these models must comply with transparency and documentation obligations.

Who is concerned?

GPAI provider obligations

• Technical documentation: Architecture, training process, energy consumption
• Usage policy: Authorized uses, restrictions, prohibitions
• Training data summary: Compliance with copyright
• Instructions for deployers: Integration guide and best practices

The case of systemic risk models

GPAI models exceeding the threshold of 10^25 FLOPs (training compute power) are considered to present systemic risk. They must additionally:

• Conduct model evaluations and adversarial testing
• Document and report serious incidents
• Ensure cybersecurity of the model and its infrastructure
• Notify the Commission within 2 weeks if the threshold is reached

GPT-5, Claude Opus 4.5, and Gemini 3.0 Pro likely fall into this category.

Penalties: deterrent amounts

For SMEs, reduced amounts are provided: the lower of the flat-rate fine and the turnover percentage applies.

How to achieve compliance?

Step 1: Map your AI systems

Essential first step: inventory all tools using AI in your organization:

• Business software with AI features
• Plugins and extensions (ChatGPT in your tools)
• Cloud services and third-party APIs
• Chatbots on your websites
• Marketing automation tools
• HR solutions (CV sorting, assessment...)

Step 2: Classify risks

For each identified system, determine its risk category according to the AI Act. Systems involving employment, credit, or security are generally high-risk.

Step 3: Document

For concerned systems, build a file including:

• System description and objectives
• Data used and its provenance
• Performance metrics
• Identified limitations and biases
• Human oversight measures

Step 4: Inform and train

• Update legal notices on your chatbots
• Inform employees of AI use in HR processes
• Train teams on responsible AI issues
• Designate an AI compliance officer

Impact on AI visibility and digital marketing

The AI Act has direct implications for AEO and GEO strategies:

• Marketing chatbots: Obligation to inform visitors
• AI-generated content: Potential marking obligation
• Compliance as a trust signal: Search engines and AI could favor responsible players
• Algorithmic transparency: Documentation of recommendation systems

FAQ: Frequently asked questions about the AI Act