The EU AI Act, in Plain Terms

The short version

• The AI Act is the world's first broad law on artificial intelligence. It regulates AI by how risky the use is, not by which industry you are in. Regulation (EU) 2024/1689, in force since August 2024.
• Everything hangs off four risk tiers: banned, high-risk, limited (transparency only), and minimal. Almost all of the real obligations land on high-risk.
• AI used for recruitment, performance, promotion, pay, and termination is named as high-risk in the text. If you use AI anywhere in people decisions, you are in the tier the Act cares about most.
• The Digital Omnibus, in force from mid-2026, pushed the heavy high-risk deadlines back. Stand-alone high-risk systems now apply from 2 December 2027, embedded-product systems from 2 August 2028. The bans, the AI literacy duty, and the general-purpose AI rules already apply today.
• Fines reach 35 million euros or 7 percent of global turnover. The slow, unglamorous work, human oversight and a documented, auditable record of how each AI-assisted decision was made, is the part that takes longest and the part you can start now.

1. What the AI Act actually is

Most technology rules chase a harm after it has happened. The AI Act tries to get ahead of one. It is the first comprehensive attempt by a major regulator to govern artificial intelligence across every sector at once, built on the same logic the EU uses for product safety: decide how dangerous a given use is, then attach obligations to match.

Regulation (EU) 2024/1689, adopted in 2024 and known as the EU AI Act, is a regulation, not a directive. That distinction matters. A directive sets a floor that each of the 27 member states writes into its own national law, which is why the Pay Transparency rules arrive country by country on different clocks. A regulation applies directly. The same text is law in Dublin, Lisbon, and Tallinn on the same day, with no national version to wait for.

The core idea is that the obligation attaches to the use, not the technology. The same model can be minimal risk in one setting and high-risk in another. A language model that drafts marketing copy is barely regulated. The same model scoring job applicants is high-risk. So the first question is never "is this AI dangerous," it is "what are we using it for."

2. Why it reaches you, even outside the EU

The trigger is the EU market and people in the EU, not where your company is based. A business headquartered in London, Bengaluru, or San Francisco is in scope if it places an AI system on the EU market, or if the system's output is used in the EU. Selling an AI hiring tool to a German company puts you in scope. So does using one on your own staff in France.

Two roles decide almost everything that follows. A provider develops an AI system, or has one developed, and puts it on the market under its own name. A deployer uses an AI system under its own authority in the course of its work. The vendor who builds a CV screener is the provider. The company that runs it on applicants is the deployer. Your obligations, and your fines, depend on which hat you wear, and a company that builds its own internal tool wears both.

There is a wider reason to care. AI governance is not an EU-only story. Comparable rules and enforcement are moving in the United Kingdom, parts of the United States, and elsewhere, and they converge on the same handful of demands: know where you use AI, keep a human able to oversee it, and document how decisions were made. Build that once properly and you are ahead of the next framework, not scrambling after it.

3. The risk pyramid everything rests on

Four tiers carry the whole law. Almost every obligation sits in one of them, and knowing which tier a use falls into tells you most of what you owe.

Unacceptable risk, banned outright. A short list of practices is prohibited, live since 2 February 2025. Social scoring by public authorities, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools, systems that manipulate behaviour or exploit vulnerabilities, certain predictive policing, and some biometric categorisation. The Omnibus adds tools that generate non-consensual intimate imagery and child sexual abuse material. If a use is here, there is no compliance path. You stop.

High-risk, allowed but heavily regulated. Two buckets. AI that acts as a safety component of a product already regulated under EU law, such as medical devices, machinery, and vehicles (Annex I). And stand-alone systems used in a set of listed areas (Annex III), which includes biometrics, critical infrastructure, education, essential services and credit scoring, law enforcement, migration, justice, and, the one that matters for people teams, employment and worker management. This is where the compliance weight lives.

Limited risk, transparency only. Some uses are low-stakes but need honesty. Chatbots must tell people they are talking to a machine. Generative output must be marked as AI-generated in a machine-readable way. Deepfakes and certain AI-generated public-interest text must be labelled. That is Article 50, and for most companies it is the whole of their obligation.

Minimal risk, left alone. Everything else. Spam filters, AI in video games, inventory forecasting. No specific obligations under the Act. This is the large majority of AI in use.

4. The concepts that decide your obligations

Before the obligations make sense, four definitions do most of the work. Each one is drawn deliberately wide.

AI system. A machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, recommendations, or decisions that can influence physical or virtual environments. The definition is broad on purpose, meant to catch tools that do not yet exist. A scoring model inside your ATS counts. A rules-only spreadsheet does not.

Provider and deployer. The two roles from the last section, and the hinge of the whole Act. A provider builds or brands the system. A deployer uses it under its own authority. Buy a tool and you are usually the deployer; the vendor is the provider. Build your own and you are both. Read every obligation below as which hat am I wearing here.

High-risk. Not a judgement call about how clever the model is. A use is high-risk if the system is a safety component under Annex I, or if it falls into an Annex III area, unless it clears one of a few narrow exemptions, in which case you have to register and document why. When in doubt on an employment use, assume high-risk until you can show otherwise.

General-purpose AI. The large foundation models underneath much of the current wave, the GPAI layer. The model providers carry their own separate rules, and a systemic-risk subset, models trained above roughly 10 to the 25 FLOPs of compute, carry more. Most companies never touch these obligations, because they are downstream deployers of such models, not the ones who build them.

5. What high-risk actually requires

If a use lands in the high-risk tier, the obligations split by role. The provider carries the heavier load, but the deployer is far from off the hook.

If you are the provider. A risk management system that runs across the whole lifecycle. Data governance, meaning training data that is relevant, representative, and checked for bias. Detailed technical documentation. Automatic logging of the system's activity. Transparency and clear instructions for the deployers who will use it. Human oversight built into the design. Accuracy, robustness, and cybersecurity appropriate to the use. A quality management system behind all of it. Then a conformity assessment, a CE marking, and registration in the EU database before the system goes to market.

If you are the deployer. Use the system in line with the provider's instructions. Ensure the human oversight the provider built in actually happens. Monitor the system and keep the logs. Make sure the input data you feed it is relevant for the purpose. Inform affected workers and their representatives where required. For certain uses, run a fundamental rights impact assessment. And cooperate with the authorities if they ask.

6. Employment AI is high-risk by name

This is the part people leaders cannot skip. Annex III does not leave employment to interpretation. It names AI used for recruitment and selection, such as placing targeted job ads, filtering applications, and evaluating candidates. And it names AI used to make decisions on terms, promotion, and termination, to allocate tasks based on behaviour or traits, and to monitor and evaluate the performance and behaviour of workers.

In plain terms, if AI touches who gets hired, paid, promoted, monitored, or let go, the use is high-risk. CV screeners, interview scorers, performance-rating models, promotion and attrition prediction, and workforce monitoring all sit inside the category by design, not by accident.

7. The dates that matter

The Act phases in over several years, and the 2026 Omnibus moved the heaviest deadlines later without removing them. Here is the current shape.

8. Transparency and general-purpose AI

Two sets of rules sit outside the high-risk machinery and catch far more companies.

Transparency (Article 50). Tell people when they are interacting with AI, such as a chatbot. Mark AI-generated or manipulated content in a machine-readable way. Label deepfakes. Disclose emotion recognition and biometric categorisation to the people subject to it. These apply from August 2026, with a short grace period to December 2026 for marking systems that were already on the market.

General-purpose AI. The model providers owe technical documentation, a copyright policy, and a public summary of the data their model was trained on. Systemic-risk models, the largest and most capable, owe more: model evaluation, adversarial testing, systemic-risk mitigation, incident reporting, and cybersecurity. A Code of Practice is the practical route to showing compliance. For almost every people team this is someone else's obligation. You deploy these models through the tools you buy; you do not build them.

9. Penalties and enforcement

The fines are tiered by how serious the breach is, and the ceilings are high enough to matter at board level.

General-purpose AI model providers face their own ceiling of 15 million euros or 3 percent of worldwide turnover. For SMEs and start-ups, the fine is the lower of the fixed sum and the percentage, not the higher, a deliberate softening for smaller companies. Enforcement runs through national market-surveillance authorities, with the AI Office handling the GPAI layer. Authorities can demand documentation, test systems, and order a non-compliant system off the market, and people affected can complain to their national authority.

10. The hard part: oversight you can prove

Most of the Act is a documentation and process exercise. Tedious, but tractable. The hard part for people teams is human oversight that actually holds up when someone asks to see it.

It is not enough to put a person near the system. The law wants oversight that is real. The overseer can understand what the system does, can see the basis for a particular output, and can overrule it, and there is a record that they did. For a promotion or a performance rating, that means you can show, after the fact, that a manager reviewed the AI's input, applied documented criteria, and made the call. Not that a model produced a score and a human signed under it.

This is where AI governance stops being a compliance project and becomes an organisation-design problem. The criteria your AI scores against are the same criteria your managers use in reviews, promotions, and hiring. If those criteria are vague, the AI makes the vagueness scale, and the Act exposes it. If they are clean, documented, and applied the same way for everyone, most of the oversight burden is met before an auditor ever asks.

11. A readiness plan you can start now

You do not need to wait for December 2027 to begin. The longest-lead work does not depend on the final guidance, and the inventory alone usually surfaces surprises. Six moves, roughly in order.

1. Inventory your AI

List every system that touches a people decision, built or bought. Most teams undercount. The scoring inside your ATS or performance tool counts, even when nobody calls it AI.

2. Classify each use

Banned, high-risk, transparency-only, or minimal. Employment uses will mostly land in high-risk. Write down the reasoning for each, because you may have to defend it.

3. Name provider or deployer

For bought tools you are usually the deployer and the vendor is the provider. That split decides who owes what, and what to demand from the vendor in writing before you rely on their tool.

4. Stand up human oversight

For each high-risk use, define who reviews, what they see, how they can override, and how the review is recorded. This is the longest-lead piece, so start here.

5. Fix the criteria underneath

Make the levels, competencies, and performance criteria your AI scores against explicit, gender-neutral, and documented, so an overseer and an auditor can both follow them.

6. Get transparency and records in order

Tell workers where AI is used, keep the logs, and hold an auditable trail of how AI-assisted people decisions were made. Line up a data-protection and fundamental-rights impact assessment where needed.

12. Where Sageo fits, and where it does not

We build Sageo, so take this in the spirit our guides are written in: we will tell you plainly what we do not cover. AI governance is bigger than any one tool, and it needs a few different partners. Sageo sits on one layer of it, the human-oversight and evidence layer, which happens to be the slowest to build.

Sageo turns your values and levels into a gender-neutral competency framework, keeps performance and promotion decisions tied to documented criteria, and holds a calibrated, auditable record of how each call was made. That record is exactly the oversight evidence a high-risk employment use has to be able to produce.

What Sageo helps with

• A documented, gender-neutral competency and levelling framework that your people decisions are scored against, AI-assisted or not
• Human-in-the-loop performance and promotion decisions, with the manager's judgement recorded against documented criteria
• A calibrated, auditable record of how each call was made, which is exactly the oversight evidence a high-risk use has to produce
• The clean criteria that make AI scoring defensible instead of a black box

What you need elsewhere

• Classifying your systems and the formal conformity assessment
• Legal risk analysis, the DPIA and fundamental-rights impact assessment, and privilege over it
• Vendor due diligence and contracts with the AI providers you deploy
• Data-protection and model-level controls for the AI systems themselves

In short: counsel owns the legal classification and risk, your vendors own the model-level conformity, and Sageo makes sure the human judgement and the criteria underneath your people decisions are documented, consistent, and defensible. Get that layer right and most of the oversight the Act demands is already in place.

How this guide was researched

Built from the Act's own text, the European Commission and Parliament's official framing, a practitioner guide for small businesses, and the 2026 Omnibus amendments with legal analysis checked in October 2026. The implementation dates are the fastest-moving part and were verified against current reporting.

Regulation (EU) 2024/1689 (the AI Act)

The legislative text via EUR-Lex. The source of truth for definitions, risk tiers, and obligations.

European Commission, Regulatory framework on AI

Official framing of the four risk tiers, the high-risk obligations, and governance.

European Parliament, EU AI Act overview

Plain-English overview of the categories, prohibited practices, and goals.

artificialintelligenceact.eu

Article-by-article text, the implementation timeline, and the small-business guide.

Regulation (EU) 2026/1744 (the Digital Omnibus) and legal analyses

Orrick, Gibson Dunn, and others, October 2026, for the revised high-risk deadlines.

Written by

Deepti Gupta

Co-founder, Sageo

18+ years building people functions from the ground up at Myntra, Freshworks and Dream11, scaling teams from 100 to 2,500 people and designing company-wide performance and compensation systems. Sageo automates the frameworks she has built by hand throughout her career.

More from DeeptiLinkedIn

Reviewed by

Vinayak Ravi

Co-founder, Sageo

19+ years of B2B SaaS go-to-market leadership. He built the organic growth engine at Freshworks through its rise to a public company and has led demand generation at some of the sector's fastest-scaling software startups.

More from VinayakLinkedIn