Prohibited practices
The AI Act prohibits specific uses considered unacceptable. Before starting a project, check that its purposes and operating arrangements do not fall within those prohibitions.
Responsible AI · A guide for SMEs
EU AI Act.
From rules to operational choices.
Using AI in business means understanding your role, the use case and the risks. An introductory guide to help align technology, people and responsibilities.
Context matters more than the label.
The same model can be used for very different tasks. Local execution and data protection do not replace an assessment of the purpose, roles and applicable obligations.
Verified on 3 November 2026
What the AI Act regulates
Regulation (EU) 2024/1689 introduces a European framework for the development and use of artificial intelligence systems. Its approach considers risk: certain practices are prohibited, some uses are classified as high-risk, and specific interactions or generated content are subject to transparency obligations.
Before choosing software, describe the task the AI will perform. Who receives the output? Which decision might it influence? Who can correct or stop the action? These questions help turn a technical choice into a project that can be governed.
The European Commission’s overview is the official starting point for checking the framework and its updates.
Provider or deployer: clarify your role
Those who develop, make available, integrate or use a system may have different responsibilities. A business adopting a solution should not assume that every obligation is covered by the model’s producer. Substantial modifications, purposes and integration arrangements also need attention.
For an operational project, it is useful to appoint a responsible person, describe the system’s functions and distinguish the role of the model, the application and its users. Legal classification needs to be assessed case by case. Definitions are available in Article 3 of the Regulation.
An initial look at risk
Different uses call for different approaches.
High-risk uses
Areas such as employment, access to essential services, education and certain regulated products may involve specific obligations. Classification depends on the use and the conditions set out in the rules.
Transparency
People must be informed about certain interactions with AI systems and some generated or manipulated content. The applicable text sets out the obligations and exceptions.
For further detail on risk assessment: Article 5, prohibited practices and Article 6, classification of high-risk systems.
AI literacy: capabilities connected to real work
Article 4 concerns measures to support the AI literacy of staff and people acting on behalf of providers and deployers. Experience, training and context of use matter: a manager approving an output and an employee querying documents may have different needs.
A useful programme can cover recognising errors, handling confidential information, checking sources, understanding the limits of automation and managing escalation. It makes sense to document participants, content and updates without turning a single course into a general promise of compliance.
Sources: Article 4 and the Commission’s AI literacy questions and answers. For practical application, explore our business training.
Transparency: making AI interaction recognisable
Article 50 sets out obligations for certain interactions and content, including specific cases involving synthetic or manipulated content. It does not mean that every text always carries the same labelling requirement: the type of content, its use and the exceptions matter.
When designing the experience, make it clear when an AI system is being used, explain how to check the output and provide a route for human review. Information should appear where it helps people understand what is happening.
Source: Article 50, transparency obligations.
Timelines: check the current text
The Regulation entered into force on 1 August 2024, with phased application. The Commission gives 2 August 2026 as the general application date, with exceptions: AI literacy and the first prohibitions from 2 February 2025; governance and GPAI obligations from 2 August 2025.
In the official overview consulted on 3 November 2026, the timelines for high-risk uses reflect the AI Omnibus changes: 2 December 2027 for some sensitive areas and 2 August 2028 for systems embedded in regulated products. For a specific project, check the text in force and the relevant category.
Local AI, GDPR and compliance
An on-premise system can provide greater control over infrastructure and data flows. Permissions, permitted documents, retention, external connections and decisions supported by the system still need to be governed. The AI Act and data protection have distinct scopes that can overlap.
Brain Company is presented as an architecture in research and development. Its technical characteristics are not described on this page as certification of AI Act compliance. Measures need to be designed and verified for each deployment.
Would you like a clear approach to adopting AI?
We start with the use case, the people involved and the data. Technical work and training can be organised into a process that can be verified.
Informational content updated on 3 November 2026. To classify a system or determine specific legal obligations, consult the text in force and appropriately qualified professionals.