AI Act: Establishing the rules for using artificial intelligence

The AI Act (Artificial intelligence act) is the European Union’s regulation governing the development and use of artificial intelligence in the EU. The regulation entered into force on August 1, 2024, and its requirements have been introduced gradually. The first prohibitions took effect on February 2, 2025, followed by rules for general-purpose AI models on August 2, 2025, and transparency obligations on August 2, 2026. It is the world’s first comprehensive AI law, establishing common rules for developing and using AI technology.

The age of AI needs common ground rules

AI has rapidly become part of our everyday lives. Just a few years ago, we could hardly have imagined how quickly AI would develop or how many different ways we would be able to use it.

This is not the first time technological advances have transformed the way we operate. The internet, search engines, and smartphones changed how we work, communicate, and use digital services. Now AI is driving another wave of change.

OpenAI released its first GPT language model in 2018, but AI gained widespread public attention with the launch of ChatGPT, powered by GPT-3.5, in November 2022. Since then, AI adoption has grown rapidly in both everyday life and business.

AI offers enormous opportunities, but what about the risks?

AI offers enormous opportunities for businesses, from automating processes and processing information to developing entirely new services.

At the same time, the technology raises new ethical and security concerns. How can we ensure that AI-driven decisions are fair? Who is responsible when something goes wrong? And how can we prevent AI from being misused?

These questions call for common ground rules. The AI Act is the EU’s response to the rapid development of AI and the risks associated with it. The regulation aims to promote the safe and responsible use of AI while protecting fundamental human rights.

What does the AI Act cover?

The AI Act establishes requirements for AI system developers, providers, and deployers. These obligations depend primarily on how AI is used and the risks associated with its intended purpose.

The regulation also takes into account the administrative and financial burden on businesses. As a result, not all AI systems are subject to the same requirements.

The four AI risk levels

The AI Act takes a risk-based approach, dividing AI systems into four risk levels based on their potential impact on individuals and society.

1. Unacceptable risk

AI systems classified as posing an unacceptable risk are prohibited because they are considered to pose serious threats to people’s safety or fundamental rights.

Prohibited practices include:

• Manipulating people or exploiting their vulnerabilities in ways that may cause significant harm.
• Social scoring that evaluates individuals based on their behavior or personal characteristics in ways prohibited by the regulation.
• Assessing an individual’s risk of committing a crime solely on the basis of profiling or personal characteristics.
• Creating facial recognition databases by indiscriminately scraping facial images from the internet or surveillance cameras.
• Recognizing emotions in workplaces and educational institutions, except in certain medical or safety-related situations.
• Biometric categorization intended to infer certain sensitive personal characteristics.
• Real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, subject to narrowly defined exceptions.

Two additional prohibitions will take effect on December 2, 2026. They concern systems used to create or modify realistic intimate content depicting identifiable individuals without appropriate consent, as well as systems used to generate child sexual abuse material.

2. High risk

High-risk AI systems may have a significant impact on people’s health, safety, or fundamental rights.

Examples of applications include:

• Safety-related functions in critical infrastructure.
• Education and student assessment.
• Recruitment and employee evaluation.
• Creditworthiness assessment.
• Certain uses involving biometric identification and emotion recognition.
• Law enforcement, migration management, and judicial processes.
• Safety-related components of certain regulated products.

High-risk systems are subject to strict requirements, including comprehensive risk management, high-quality data, technical documentation, traceability, and appropriate human oversight.

The aim is to ensure that these systems operate reliably and that potential errors or harmful effects can be identified and corrected.

3. Limited risk (transparency risk)

This category includes AI-powered chatbots and other systems that interact directly with people.

The key requirement is transparency. Users must be informed when they are interacting with AI unless this is already obvious from the context.

Transparency obligations also apply to the publication of deepfakes and certain AI-generated texts. These requirements are discussed in more detail later in this article.

4. Minimal risk

Most AI systems fall into the minimal-risk category. Examples include spam filters and AI features in video games.

These systems are generally not subject to the AI Act’s specific risk-based requirements. However, companies are encouraged to follow responsible AI principles and good practices even when they are not explicitly required by law.

Other applicable obligations may still apply to an AI system regardless of its risk classification.

How does the regulation affect general-purpose AI models?

General-purpose AI models are already used in a wide range of applications and digital services. For example, ChatGPT and Claude are services powered by language models that can also be integrated into companies’ own solutions.

The AI Act places obligations on providers of these models concerning transparency, copyright compliance, and technical documentation. Particularly powerful models that pose systemic risks are subject to additional safety and risk management requirements.

Companies that integrate AI models into their own applications must also understand their responsibilities.

For example, using a language model in customer service, recruitment, or decision-making may introduce different obligations. Their scope depends on the application’s intended purpose, risk level, and the company’s role as a provider or deployer.

It is therefore worth identifying the requirements that apply to a planned AI solution at the beginning of a development project. This allows them to be addressed during technical implementation rather than requiring changes just before deployment.

What does the AI Act mean for businesses in practice?

The AI Act clarifies how responsibilities are divided between those developing AI systems and those using them.

System providers are responsible for matters such as regulatory compliance, documentation, and necessary safety measures. Deployers, in turn, must ensure that AI is used in accordance with the applicable requirements.

Human oversight, system monitoring, and the identification of potential problems are particularly important for high-risk systems. Serious incidents must also be reported to the authorities as required by the regulation.

In certain situations, companies must also be transparent about their use of AI and the content it generates.

In practice, responsible AI use requires companies to plan more carefully. They need to understand what information a system processes, how its operation is monitored, and who is responsible for addressing potential problems.

When will the AI Act become fully applicable?

The EU AI Act entered into force on August 1, 2024, but its requirements are being introduced in stages. Most of the regulation has applied since August 2, 2026. The final major transitional periods will end in 2028.

Key AI Act dates:

• August 1, 2024: The AI Act entered into force.
• February 2, 2025: The first prohibitions on unacceptable AI practices and AI literacy obligations became applicable.
• August 2, 2025: Rules concerning general-purpose AI models began to apply.
• August 2, 2026: Transparency obligations and several other provisions became applicable.
• December 2, 2026: New prohibitions concerning nonconsensual intimate content and child sexual abuse material will become applicable. The transitional period for machine-readable labeling requirements will also end for certain systems previously placed on the market.
• December 2, 2027: Specific requirements for high-risk AI systems will begin to apply to areas such as employment, education, and creditworthiness assessment.
• August 2, 2028: Requirements for high-risk AI systems associated with regulated products, such as certain machinery and medical devices, will become applicable.

The AI Omnibus amendment, adopted in 2026, postponed the application dates for requirements concerning high-risk AI systems. The aim is to give companies and authorities more time to prepare for the requirements and the standards supporting their implementation.

It is worth following regulatory developments, as practical interpretations of the rules continue to evolve. Up-to-date information is available on the European Commission’s AI Act website.

New transparency obligations for labeling AI-generated content

One of the most visible changes introduced by the AI Act concerns disclosing the use of AI and labeling AI-generated content.

The transparency obligations under Article 50 of the regulation have applied since August 2, 2026. In certain situations, they cover AI-generated or modified images, videos, audio, and text, as well as interactions with AI systems.

What do the AI transparency obligations mean?

The AI Act requires the use of AI and the content it generates to be disclosed in certain situations. Labeling requirements apply, for example, to realistic AI-generated or modified images, videos, and audio, as well as certain texts concerning matters of public interest.

The obligations apply to both AI system providers and deployers. Providers are responsible for ensuring that AI-generated content can be technically identified, while companies publishing such content must clearly disclose the use of AI when required. Users must also be informed when they are interacting with an AI-powered chatbot, unless this is already obvious.

The transparency obligations became applicable on August 2, 2026, and do not require content published before that date to be labeled retroactively. Not all AI-generated content needs to be labeled, and the requirements include exceptions.

The European Commission has also published a voluntary code of practice to help providers and deployers meet the transparency requirements. In Finland, compliance is primarily supervised by Traficom, which provides further information in its official guidance.

AI agents must be transparent about their actions

AI agents are one of the fastest-growing applications of artificial intelligence. They can perform tasks independently on behalf of users, such as processing orders, sending messages, or making reservations.

As AI agents become more common, transparency about their actions becomes increasingly important. When an agent interacts with a person, the recipient must be able to recognize the involvement of AI in situations where the AI Act requires disclosure. It is also important to know which organization the agent is acting on behalf of.

The European Commission’s guidelines published on July 20, 2026 address interactions between AI agents and people, including how transparency obligations should be considered when designing these systems.

AI agents offer businesses significant opportunities, but systems that operate independently also require careful consideration of access permissions, oversight, and responsibilities.

Clearer AI rules are a welcome development

It is encouraging to see AI ethics being widely discussed and common rules being established across the EU for the safe and responsible use of artificial intelligence. The EU aims to be a global leader in trustworthy AI, and shared regulation provides a foundation for responsible AI development.

AI continues to advance rapidly, and new ways to use it are constantly emerging. At the same time, we need to ensure that the technology is used responsibly and that people can trust how it operates. Transparency, data security, and people’s ability to influence AI systems are important considerations for businesses as well.

The ethical use of AI is also an important topic for us at Hurja. We have established our own ethical principles for AI to guide our development work and responsible use of the technology. We consider the security, transparency, and reliability of our solutions from the very beginning of the design process.

We want to help businesses make the most of AI in practical, sensible ways. At its best, AI improves business efficiency, reduces manual work, and enables entirely new kinds of digital services.

Are you planning an AI-powered solution for your business? We can help you identify suitable use cases and develop a tailored AI solution that meets your business needs while taking security and responsible AI use into account.