The wild west of AI is coming to an end. With the European AI Act (Regulation 2024/1689), government is actively engaging with the accessibility, safety and transparency of AI. The regulation entered into force on 1 August 2024 and applies in phases: the prohibitions and the AI-literacy obligation since 2 February 2025, the rules for general-purpose AI models since 2 August 2025, and the general application date was 2 August 2026. For directors this is no longer an IT topic, but a board-level question.
AI Act — the European law that classifies AI applications by risk: prohibited practices, high risk with strict requirements, limited risk with transparency duties, and minimal risk without extra requirements. The more far-reaching the application, the heavier the obligations.
From freedom to accountability
For years there was one rule for generative AI: there were no rules. Companies experimented freely and nobody asked the hard questions. That period is over. Systems that assess people, in recruitment, credit decisions or fraud detection, fall into the highest category, with requirements on documentation, human oversight and data quality. Unacceptable applications, such as manipulation or social scoring, are simply prohibited.
What has and has not been postponed
At the end of 2025 the European Commission proposed, through the so-called Digital Omnibus, to let the heaviest obligations for high-risk AI start later, to give organisations more time. What has not been postponed: the transparency duty. Since 2 August 2026, users must know they are dealing with an AI system, for example a chatbot on your website. The duty to make employees sufficiently AI-literate already applies as well.
What the boardroom must arrange now
- Inventory all AI use, including the "shadow AI" that crept in outside IT.
- Set governance and policy: who may do what, with which data, and who is accountable.
- Classify the risk and the associated obligations per application.
- Safeguard data and privacy: AI and the GDPR are inseparable.
- Make AI a standing item at board level and record decisions.
SMEs are not exempt either
Those who buy AI tools or sit in a supply chain get the requirements passed on, just as with NIS2 for cybersecurity. Clients will demand demonstrable control. Organisations that get their AI house in order now will be ahead; those who wait will be chasing the facts.
Frequently asked questions
Does the AI Act apply if we only use ChatGPT or Copilot?
Yes, as a user you have obligations: AI literacy of employees, transparency towards customers where applicable, and careful use of personal data. The heaviest requirements rest with providers and with high-risk applications.
What does AI literacy mean in practice?
That employees understand what the tools can and cannot do, which data may go in and how to check the output. A short training plus an internal AI policy covers this for most organisations.
Where do I start as a director?
With an inventory: which AI is used, by whom, with which data. Then policy and one accountable person. Qteco helps with the inventory and with AI solutions that run inside your own secured environment.
Government is awake. The question is whether your boardroom is too. Read how secure AI development works at Qteco, or book a call.
Sources
- Verordening (EU) 2024/1689 (AI-verordening) — EUR-Lex (2024-07-12)
- Regels voor betrouwbare artificiële intelligentie in de EU (samenvatting) — EUR-Lex
- Voorstel Digital Omnibus AI, COM(2025) 836 — EUR-Lex
Read also
Ready to run worry-free?
Book a no-obligation introduction. We map your IT and security and show where the difference lies.
Book a call →