AI Act
The EU AI Act at a glance
Roles, risk tiers and deadlines under Regulation (EU) 2024/1689 — and what Reguly covers.
What does the AI Act govern?
The AI Act does not regulate AI as a technology but its use. What matters is the role your company holds for a given system and the risk tier that system falls into. Together these decide which duties apply — everything else follows from them.
Most companies are deployers: they use bought-in AI in their operations without developing it themselves. Anyone placing a system on the market under their own name, or modifying it substantially, becomes a provider — with considerably wider duties.
The four areas in Reguly
- AI inventory: Every system in use, with vendor, area of use, data types and owner. The basis for everything else.
- Risk assistant: Nine questions lead to the risk tier and tag the system automatically.
- GPAI requests: Diligence towards the vendors of the underlying models — requested, answered, documented.
- Training record: Who was trained, when and for how long. Art. 4 requires this of everyone using AI professionally.
Risk tiers
| Field | Description |
|---|---|
| Prohibited | Practices under Art. 5 — such as social scoring or emotion recognition in the workplace. No use permitted. |
| High risk | Annex III, or a safety component of a regulated product. Full deployer duties, possibly a fundamental-rights impact assessment. |
| Limited risk | Transparency duties under Art. 50 — people must be told they are talking to a machine. |
| Minimal risk | No specific duties under the regulation. Still in the inventory, so the classification is on record. |
* Required field
The tier applies per system, not per company
A company can be the deployer of a high-risk system and the provider of a minimal one at the same time. Reguly therefore classifies each system separately — a blanket company-level tier would be wrong in both directions.
Common questions
When does the AI Act apply?
The regulation entered into force on 1 August 2024. The prohibitions under Art. 5 and the training duty under Art. 4 have applied since 2 February 2025; the duties for high-risk systems phase in until 2027.
Does ChatGPT in the office already count as an AI system?
Yes. As soon as a tool is used professionally you are its deployer — regardless of whether you bought it or merely signed up. It belongs in the inventory.
Does Reguly replace legal advice?
No. Reguly structures the classification and keeps it on record. The legal assessment in an individual case stays with your specialists.
Related pages