AI glossary for businesses
EU AI Act
In short
The EU AI Act (Regulation (EU) 2024/1689) is the European Union's law on artificial intelligence. It sorts AI systems by risk, bans a small set of harmful practices, sets strict duties for high-risk systems and adds transparency rules for tools like chatbots. It applies to companies that build AI and to those that use it at work.
How the AI Act works
The AI Act regulates uses, not technology as such. The same model can be harmless in one setting and risky in another. So the law asks one main question: what is this system used for, and who could it harm?
A useful analogy is food safety rules. A sandwich stand and a hospital kitchen both handle food, but the hospital faces far stricter checks because more is at stake. The AI Act works the same way, in four broad tiers:
Unacceptable risk: a short list of banned practices, such as social scoring or manipulative techniques that cause harm.
High risk: uses in areas like recruitment, credit scoring, education and critical infrastructure, with strict duties. See high-risk AI system.
Limited risk: transparency duties, for example telling people they are talking to a chatbot or that content is AI-generated.
Minimal risk: most everyday tools, like spam filters or writing assistants, with no specific new duties.
The law also separates providers (who build or sell an AI system) from deployers (who use it in their work). Most SMEs are deployers.
In practice for a small business
A 30-person marketing agency in Athens uses ChatGPT for drafts, Canva for visuals and a chatbot on a client's e-shop. Most of this is minimal or limited risk. The agency's main tasks are to train its staff, which is the AI literacy duty that has applied since 2 February 2025, and to make sure the chatbot tells visitors they are talking to AI. If the same agency started using an AI tool to screen job applicants, that use would be high-risk and would need much more care.
Why it matters and what to watch out for
Timeline. The Act entered into force in August 2024 and applies in stages. The bans and the AI literacy duty already apply. Obligations for high-risk systems phase in through 2026–2027. Dates can shift, so follow official EU sources.
It works alongside GDPR. The AI Act does not replace data protection law. If your AI use involves personal data, both apply.
Keep a simple inventory. List which AI tools you use, for what and by whom. It makes any later check much easier.
This is not legal advice. Classification depends on the details. Check with your DPO or legal advisor before using AI in sensitive areas.