1. The AI Act Sorts AI Into Four Risk Levels
The idea behind the law is simple: the more damage an AI could do, the stricter the rules. The Commission groups AI uses into four risk levels: unacceptable risk, high risk, transparency risk, and minimal or no risk [1].
One reason for having rules at all is that it is often impossible to find out why an AI system made a particular decision. That makes it hard to tell whether someone was treated unfairly, for example when a company is choosing whom to hire, or when someone applies for help from the government [1].
The last box matters most for our question. The Commission says the Act adds no rules for AI of minimal or no risk, and that the vast majority of AI systems used in the EU fall into this group. Its own examples are AI-enabled video games and spam filters [1]. So the law does not "tie up" all AI. Most everyday AI is left alone, and the rules are saved for a few situations.
2. Which AI Is Banned Completely?
At the top level, AI that is seen as a clear threat to people's safety, livelihoods and rights is banned. The Commission lists nine banned practices. They include harmful AI that manipulates or deceives people, AI that exploits people's vulnerabilities, "social scoring" (rating people by their behavior), and building face-recognition databases by untargeted scraping of images from the internet or security-camera footage. They also include guessing emotions of people at work or at school, and AI "nudification" apps that create sexual images of someone without their consent [1].
The list is a set of specific uses, not a ban on a whole technology. Even face identification appears only in particular forms, such as real-time identification by law enforcement in publicly accessible spaces [1]. Banning a specific use is different from banning AI itself.
3. Which AI Is Watched Closely Because a Mistake Would Hurt?
The next level down is "high risk." These are uses where a wrong answer could seriously affect health, safety or basic rights. The Commission's examples include AI that is a safety part of transport systems, software that scores exams, AI inside surgical robots, programs that sort job applications, credit scoring that decides whether someone gets a loan, and AI that helps examine visa applications [1].
Notice what these have in common. In each one, a person's chances in life depend on the answer, and it is hard for that person to check or argue with it. The Commission says that from 2 December 2027, such systems face strict obligations before they can be put on the market, such as adequate risk assessment and mitigation, use good-quality data to limit unfair results, keep logs so results can be traced, write detailed documentation, and allow human oversight [1].
4. When Must an AI Tell You It Is an AI?
The third level is about honesty rather than danger. When you use a chatbot, you should be told that you are interacting with a machine. Providers of generative AI, meaning AI that makes text, images, audio or video, must make sure the content can be identified as AI-made. On top of that, certain AI-generated content, namely deepfakes and text published to inform the public about matters of public interest, should be clearly and visibly labeled [1]. The Commission's page also mentions exceptions, so the details depend on the case.
Ask yourself why this is its own level. A chatbot is not necessarily dangerous, but if you believe you are chatting with a person, you may trust it differently. The rule gives you the information to decide for yourself.
5. What Happens to Companies That Break the Rules?
Article 99 of the Act sets maximum fines in three steps. For using a banned AI practice, the limit is up to 35 million euros or, for a company, up to 7 percent of its worldwide yearly turnover for the previous year, whichever is higher. For breaking most other obligations, including the labeling rules in Article 50, it is up to 15 million euros or 3 percent. For giving incorrect or misleading information to the authorities, it is up to 7.5 million euros or 1 percent [3].
These are ceilings, not set prices. For small and medium-sized businesses and start-ups, the limit is whichever of the two numbers is lower, and the law tells authorities to weigh things like how serious the harm was, whether the company cooperated, and whether the breach was intentional [3]. Each EU member country sets up its own enforcement rules, so the details differ from place to place.
6. When Do the Rules Start, and What Moved in 2026?
The Act came into force on 1 August 2024, but its parts switch on in steps. The bans (numbers 1 to 8 on the Commission's list) applied from February 2025, and the rules for general-purpose AI models, models that can perform a wide range of tasks and are the basis for many AI systems, from August 2025 [1][2].
Then the schedule changed. As part of a package called the AI Omnibus, the Commission's page says that the ninth ban, on AI that creates sexual images of someone without their consent and child abuse material, comes into effect in December 2026, and that the strict duties for high-risk AI start on 2 December 2027 [1]. A timeline kept by the Future of Life Institute, an organization that follows the law closely, adds that high-risk AI built into products such as machinery or medical devices moves to 2 August 2028 [2].
The labeling rules did not wait. The Commission says the transparency rules take effect in August 2026, and the timeline says AI that makes synthetic audio, images, video or text and was already on the market before then has until 2 December 2026 to meet the content-marking duty [1][2]. So "the AI Act was postponed" is only partly true. Some parts were delayed and others were not.
7. Try Sorting the AI Around You Into the Four Boxes
You can test your understanding without any special equipment. Think of AI you have used or seen this week: a game opponent, a photo filter, a school exam marker, a chatbot, a spam filter. Put each in one of the four boxes, then ask two questions. If it gets something wrong, who is hurt, and can that person check the answer? And would you know you were dealing with an AI?
Then read the Commission's page and compare. It is written for the public and is a good place to start. You may find that your sorting is close to the law's, or that you disagree about a case. Both are good reasons to read more, and the Service Desk page in the sources lets you read the actual wording of the law, article by article [1][3].