What are the risk levels of the AI Act?

Four. Unacceptable risk (banned — e.g. social scoring); high risk (allowed under strict conditions — e.g. AI in recruitment, healthcare, credit); limited risk (transparency obligations — e.g. chatbots, which must disclose that they are AI); minimal risk (unrestricted — the majority of uses). Most business applications are limited or minimal risk.

Is my business affected by the AI Act?

Probably, as soon as you develop, deploy or use an AI system in the EU, even one provided by a third party. The level of obligation depends on your role (provider or deployer) and the risk of the use case. A support chatbot mainly falls under transparency; an AI that screens job applications or medical files falls into the high-risk category, with heavy obligations.

What concretely must businesses do to be compliant?

Map their AI uses, classify them by risk level, inform users when they interact with an AI, document the systems, ensure human oversight over important decisions, control training and processing data, and keep a register. For high-risk uses, an impact assessment, testing and enhanced traceability are added.

What is the AI Act implementation timeline?

The AI Act is being applied in stages since 2025: the bans (unacceptable risk) first, then the obligations for general-purpose models, and finally the full rules for high-risk systems on a timeline extending to 2027. Businesses therefore have every interest in mapping and documenting their uses now, without waiting.

Does the AI Act prevent innovation with AI?

No. The vast majority of business uses (writing, automation, RAG, support) are limited or minimal risk and remain unrestricted, subject to transparency. The AI Act mainly structures sensitive uses. Handled well, it becomes a trust asset: showing that your AI systems are documented and supervised reassures your clients and partners.

EU AI Act: what businesses must do (2026)

Definition

What is the EU AI Act?

The EU AI Act is the European regulation on artificial intelligence, the world's first comprehensive legal framework for AI. It classifies systems by risk level and imposes proportionate obligations: transparency, documentation, human oversight, data governance. It concerns businesses that develop or use AI in the European Union.

In other words: the more an AI use can affect people's rights or safety, the stronger the obligations. A spell-checker is not treated like an AI that screens job applications. The challenge for you is to identify where your uses sit.

Classification

The 4 risk levels

Level	Examples	Regime
Unacceptable	Social scoring, manipulation	Banned
High	AI in recruitment, healthcare, credit	Allowed under strict conditions
Limited	Chatbots, generated content	Transparency obligation
Minimal	Filters, suggestions, automation	Unrestricted

AI Act risk levels — the majority of business uses are limited or minimal. Lumyniq, 2026.

Obligations

What businesses must do

Concretely: map your AI uses, classify them by risk, inform users that they are interacting with an AI, document the systems, ensure human oversight over important decisions, control the data, and keep a register. For high-risk uses, an impact assessment, testing and enhanced traceability are added.

Map all your AI systems, including those provided by third parties.
Classify each use by risk level.
Inform — clearly flag interactions with an AI.
Document & oversee — traceability and human validation of sensitive decisions.
Register & data — keep a register and control the data used.

Timeline

When do you need to be ready?

The AI Act is being applied in stages since 2025: first the bans, then the obligations for general-purpose models, finally the full rules for high risk on a timeline extending to 2027. A wait-and-see approach is risky: mapping and documentation take time. It's better to start now.

It's a systematic part of our AI consulting and of our projects in regulated sectors — legal, healthcare, HR.

FAQ

Frequently asked questions about the EU AI Act

The EU AI Act is the European regulation on artificial intelligence, the world's first comprehensive legal framework for AI. It classifies AI systems by risk level (unacceptable, high, limited, minimal) and imposes obligations proportionate to that risk: transparency, documentation, human oversight, data governance. It applies to businesses that develop or use AI in the European Union.

EU AI Act: what businesses must do in 2026

What is the EU AI Act?

The 4 risk levels

What businesses must do

When do you need to be ready?

Frequently asked questions about the EU AI Act

Sources

Let's talk about your project

Contact details