When a customer asks about the EU AI Act, answer with four facts: what AI your product contains, which risk tier you believe applies, whether you are a provider or a deployer, and what controls you can evidence. Avoid saying "compliant" unless you can show which obligations apply and how you meet them.
What does the Act actually do?
The European Commission describes the AI Act (Regulation (EU) 2024/1689) as a risk based framework with four levels: unacceptable risk, high risk, transparency risk, and minimal or no risk. Unacceptable practices are banned. High risk covers uses such as AI safety components in critical infrastructure, employment tools and credit scoring. Transparency risk covers things like chatbots, where people must be told they are interacting with a machine, and labelling of certain generated content. Most AI systems fall into minimal or no risk, where the Act adds no rules.
For general purpose AI models, the Commission says rules on transparency and copyright, and on systemic risk for the most capable models, became effective in August 2025.
Which dates matter?
The Commission's AI Act Service Desk timeline, which takes into account the Digital Omnibus on AI amendments, lists these milestones: entry into force on 1 August 2024, prohibitions and AI literacy from 2 February 2025, general purpose AI rules from 2 August 2025, transparency rules under Article 50 and enforcement from 2 August 2026, a new prohibition on 2 December 2026, Annex III high risk rules from 2 December 2027, and rules for high risk AI embedded in regulated products from 2 August 2028. Dates have been amended before, so check the timeline page on the day you answer.
How should I answer the common questions?
"Does your product use AI?" List features and models, and say whether the AI is yours, a provider's, or one the customer can bring. Be exact.
"What is the risk classification?" State your assessment and the reasoning in a sentence. If you have not assessed it, say that and give a date.
"Are you a provider or a deployer?" If you build or place an AI system on the market under your name, you are likely a provider. If you use a system in your own operations, you are a deployer. Say which applies per feature.
"What are your transparency measures?" Describe how users are told they interact with AI and how generated content is identified.
"Do you train on our data?" Answer plainly, per feature, and link to the policy.
"What oversight and logging exist?" For features that act, describe human approval steps and activity logs.
The Commission lists logging of activity, documentation, human oversight, and accuracy and cybersecurity among obligations for high risk systems. Even if you are not high risk, those are a sound way to describe your controls.
What not to claim
Do not say you are "EU AI Act certified." The Act does not give companies a general certificate. Do not state your product is high risk or not without a documented assessment. If a security attestation such as SOC 2 Type II is underway, say underway. Do not describe architecture targets for government frameworks as achieved.
What to do
- Inventory every AI feature and model, including third party ones.
- Classify each against the four tiers and record the reasoning with a date and owner.
- Decide provider or deployer role per feature.
- Document transparency notices, data use and human oversight.
- Keep an AI bill of materials with models, data sources and versions.
- Write approved answers and evidence links into your questionnaire library.
- Re-check the timeline page before each reply, since dates move.
Quick check
Does the AI Act apply to a company outside the EU?
It can, depending on where the system is placed on the market or used. Ask counsel about your situation.
Is a chatbot high risk?
The Commission lists chatbots under transparency risk, meaning users must be informed. A chatbot used in a high risk context, such as employment decisions, may be treated differently.
Sources
Last reviewed: 18 October 2026.
