The regulation bans no technology; it regulates use. It recognises four levels: prohibited practices, high-risk systems, systems that carry transparency obligations, and everything else. Which duties land on you depends on which level you sit in, and on whether you meet the system as a provider or as a deployer.
The timetable changed in the summer of 2026. Regulation (EU) 2026/1744 amended the original text in 43 places: it postponed the rules for high-risk systems to 2 December 2027, but not the transparency obligations — those have applied since 2 August 2026. And from 2 December 2026 two new prohibited practices come into force.
The most common misconception is that a small business is exempt. It is not: there is no company-size threshold. What there is: simplified documentation, and a penalty ceiling that for an SME is the lower of the two figures, not the higher. Which body enforces this differs from member state to member state, and in most of them it is not the data protection authority — look yours up in the Commission's consolidated list of designated national authorities.
What all this means today for a small company is set out date by date in the EU AI Act as it stands, a separate article. The directly related terms: GPAI, deepfake and AI literacy.