What the AI Act means for your business

The AI Act is the European AI regulation: Regulation (EU) 2024/1689. In Dutch it's also called the AI-verordening. It entered into force on 1 August 2024 and applies directly in all member states, so without the Netherlands first having to transpose it into a law of its own. Each country does arrange supervision and penalties itself.

The law works with risks. The greater the risk to people's health, safety and fundamental rights, the stricter the rules. A spam filter hardly falls under it. A system that decides who gets invited to a job interview does.

The AI Act applies to everyone who places AI on the European market or uses it in the EU, even if the company behind it is based outside the EU. It comes on top of the GDPR, not instead of it. If you work with personal data, both apply.

The rules take effect in phases, and in July 2026 the law was amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744). Further down you'll find the timeline as it applies now.

The AI Act classifies AI applications by risk. In addition, there are separate rules for the large AI models themselves.

1. Unacceptable risk: prohibited

Since 2 February 2025, a limited list of applications has been prohibited (Article 5). These include:

• Manipulation or deception that can cause people harm
• Exploiting vulnerabilities, for example due to age or a disability
• Social scoring: assessing people on their behavior or personality, with adverse consequences
• Collecting facial images in an untargeted way for facial recognition
• Emotion recognition in the workplace and in education, with some exceptions

For an average SME, the chance that you do any of this is small. Do check it, especially with tools that analyze employees or customers.

The Digital Omnibus added a prohibition on AI systems that create non-consensual intimate images or child sexual abuse material. That prohibition applies from 2 December 2026.

2. High risk: strict requirements

High risk covers AI systems that are a safety component of products with their own European rules, such as medical devices, machinery and toys (Annex I). And AI systems in sensitive applications (Annex III), including:

• Work and staff: recruitment and selection, evaluating, promoting, dismissing, allocating tasks and monitoring
• Education: admission, assessment and monitoring during tests
• Access to essential services, such as creditworthiness assessment
• Biometrics, critical infrastructure, law enforcement, migration and the administration of justice

Not everything in those domains is automatically high risk. If a system only performs a narrow, preparatory task and doesn't materially influence the decision, it may fall outside it (Article 6). If the system profiles people, that exception doesn't apply. If in doubt, have a lawyer assess it.

3. Limited risk: transparency

Transparency rules apply to chatbots, deepfakes and AI-generated content (Article 50). People need to know that they're talking to AI or looking at AI content. Those rules have applied since 2 August 2026.

4. Minimal risk: no new rules

Spam filters, AI in games, a tool that summarizes your email or drafts a quote: most applications in an average business fall here. No additional requirements apply to them, apart from the AI literacy measures that apply to every organization.

And the large AI models?

Since 2 August 2025, the makers of general-purpose AI models, such as OpenAI, Google and Anthropic, have had their own rules. Those rules are for them, not for you as a user.

Your obligations depend on your role. The AI Act names several, but for almost every business it comes down to two.

• The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. OpenAI is the provider of ChatGPT, Microsoft of Copilot.
• The deployer uses an AI system under its own authority in a professional context. If you use ChatGPT for your work, that's you.

Most SMEs are deployers. But watch out for three situations.

You sell software with AI in it

If you build AI into your own product and sell it to customers, you are the provider of that system.

You have something custom-built

If you have an AI system built for your own organization and use it under your own name, you may count as a provider yourself. In that case, agree beforehand who picks up which obligation: documentation, testing, human oversight.

You modify a high-risk system

If you put your name on a high-risk system, change it substantially, or use an ordinary AI system for a high-risk purpose, you may count as a provider yourself under Article 25, with the heavier obligations that come with it. An example: you have a general-purpose chatbot assess CVs and draw up a shortlist. Then you're using AI for recruitment and selection, and that is generally high risk. If you're considering something like that, have a lawyer look at it beforehand.

Always

• AI literacy (Article 4): take measures so that your people, and others who work with AI on your behalf, know enough to use it responsibly. Since the Digital Omnibus, the text has been worded differently: you don't have to guarantee a level per person. A certificate isn't needed. How to arrange this is on AI literacy.
• No prohibited applications (Article 5): check that nothing you use falls within the list above. Emotion recognition of your staff, for example, is prohibited.

Transparency, since 2 August 2026

• Do you create a deepfake, meaning image, audio or video that looks real but was generated or manipulated by AI? Then make it clear that it's AI.
• If you publish AI-generated text to inform the public on matters of public interest, disclose that. Unless a human has reviewed the text and holds editorial responsibility for it.
• If you use emotion recognition or biometric categorization, where that's allowed, inform the people concerned.

With high risk, from 2 December 2027

If you use a high-risk system from Annex III, for example for recruitment and selection, Article 26 asks for, among other things:

• Use the system in accordance with the provider's instructions for use
• Assign human oversight to people with the right knowledge, authority and support
• Make sure the input data is relevant and representative, to the extent you control it
• Monitor how it works, and report risks and serious incidents
• Keep the automatically generated logs for at least six months
• Inform employees and their representatives before you use such a system in the workplace
• Tell people that a decision about them is being made with the help of a high-risk system

Some organizations, such as public authorities, must also assess beforehand what the system means for people's fundamental rights (Article 27). If you use or are considering a high-risk system, have a lawyer check exactly which obligations apply to you.

If you're a provider, it again depends on the risk.

With limited risk

• You design a chatbot or other AI that talks to people so that people know they're dealing with AI, unless that's obvious
• You mark content that your AI system generates (text, image, audio, video) as AI-generated in a machine-readable way. For systems that were already on the market before 2 August 2026, that obligation applies from 2 December 2026

With high risk

Then the strictest requirements apply, from 2 December 2027 for Annex III and 2 August 2028 for AI in products (Annex I). Think of risk and quality management, good data, technical documentation, built-in human oversight, a conformity assessment with CE marking and continued monitoring after launch. That's a project in itself, and not a job for a Friday afternoon. Get legal advice on it.

For SMEs there are a few concessions, such as a simplified form of the technical documentation and priority access to the regulatory sandboxes of supervisory authorities.

The Digital Omnibus on AI was adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, signed on 8 July 2026 and entered into force on 27 July 2026. This is the timeline as it applies now:

• 1 August 2024: the AI Act enters into force
• 2 February 2025: prohibited applications and AI literacy
• 2 August 2025: rules for the makers of general-purpose AI models, plus the rules on supervision and penalties
• 27 July 2026: the Digital Omnibus enters into force; Article 4 gets a new text
• 2 August 2026: transparency (Article 50) and most of the other rules; supervision by national supervisory authorities
• 2 December 2026: watermarking obligation for AI systems that were already on the market, and the new prohibition on AI for non-consensual intimate images
• 2 December 2027: high risk in sensitive applications (Annex III), originally 2 August 2026
• 2 August 2028: high risk in products (Annex I), originally 2 August 2027

Note: many articles online predate the Digital Omnibus and still give 2 August 2026 for high risk. That's no longer correct. If in doubt, check the current status with the Dutch government (Rijksoverheid) or a lawyer.

The Netherlands arranges supervision in the Uitvoeringswet AI-verordening, the Dutch act implementing the AI Act. It was open for online public consultation from 20 April up to and including 1 June 2026 and had not yet been adopted in October 2026. Under the proposal, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and the Dutch Authority for Digital Infrastructure (Rijksinspectie Digitale Infrastructuur, RDI) become the coordinating supervisory authorities. In addition, existing supervisors oversee their own sectors, such as the AFM and DNB for financial institutions.

The AI Act itself sets these maximum fines (Article 99):

• Prohibited applications: up to € 35 million or 7 percent of worldwide annual turnover, whichever is higher
• Most other obligations: up to € 15 million or 3 percent of worldwide annual turnover
• For SMEs and startups, the lower of the two amounts applies (Article 99(6))

The AI Act doesn't set a separate fine amount for AI literacy. For that, the Dutch draft opts for corrective sanctions such as an order subject to a penalty payment (last onder dwangsom), not a fine. That may still change during the legislative process.

No reason to panic, but a reason for an afternoon of work. Don't let it drive you crazy. Start small.

1. 01Make a list of all the AI you use: tools like ChatGPT and Copilot, but also AI features in your existing software.
2. 02For each application, write down what you use it for and who works with it.
3. 03Determine your role for each application: deployer or provider. If you sell software with AI or have something custom-built, take a closer look.
4. 04Check that nothing prohibited is among them, such as emotion recognition of your staff.
5. 05Flag everything that touches on decisions about people: recruitment, staff evaluation, creditworthiness. That may be high risk, from 2 December 2027. Have a lawyer assess it.
6. 06Arrange AI literacy per role: a foundation for everyone, more depth for those who work with AI daily or make decisions about it.
7. 07Record ground rules in a short AI policy: which tools, which data, where a human checks.
8. 08Check transparency: do you create deepfakes or publish AI text on matters of public interest? Disclose it.
9. 09Use business licenses with a data processing agreement; the GDPR still applies. More on that in ChatGPT and the GDPR.
10. 10Record what you've done, and put a date in the calendar to review it again in a year.