EU AI Act
The EU AI Act applies step by step. Here you can read what it asks today of organisations in care, education, research and non-profits, what is still to come and what you can already do. Without legal jargon.
Written by Peter Dedene · last reviewed on 3 October 2026
This is not legal advice. If you’re unsure about a specific use, have a lawyer look at it.
At a glance
01
If your organisation uses AI in its work, the law calls you a deployer. Even if your team only uses a chat tool such as ChatGPT or Copilot.
02
Since 2 February 2025, some practices have been prohibited, such as social scoring. Since then, you also have to work on AI literacy among your staff.
03
AI literacy calls for measures, not a certificate. Since the amendment of July 2026, the law no longer sets a fixed level.
04
Transparency rules have applied since 2 August 2026. If you make a deepfake with AI, you disclose it. If you publish AI-generated text to inform the public, you disclose that too, unless someone reviews it and holds editorial responsibility for it.
05
Stricter rules apply to high-risk uses, such as AI for selecting job applicants or assessing pupils, from 2 December 2027.
Timeline
The AI Act entered into force on 1 August 2024. The rules don’t all apply at once. In July 2026, the AI omnibus moved some dates.
Belgium
Each Member State designates market surveillance authorities. The European Commission’s list (updated on 7 September 2026) does not yet show a contact point for Belgium. We’ll update this page as soon as that changes.
1 Aug 2024
Regulation (EU) 2024/1689 is official. Its rules then start to apply in phases.
2 Feb 2025
Some practices are prohibited, such as social scoring and AI that infers people’s emotions at work or at school (except for medical or safety reasons). Organisations must work on AI literacy.
2 Aug 2025
Obligations for the makers of large AI models, such as the ones behind chat tools. These rules apply to the providers of those models, not to the people who use the tool.
27 Jul 2026
Regulation (EU) 2026/1744 enters into force. AI literacy remains an obligation, but without a fixed level. The high-risk rules are pushed back.
2 Aug 2026
Most rules now apply, including the transparency obligations. National authorities can now supervise and enforce.
We are here · October 2026
2 Dec 2026
From then on, AI that creates sexually explicit or intimate images of real people without their consent is prohibited. So is AI for child sexual abuse material.
2 Dec 2027
Stricter rules for AI in areas such as education, recruitment and HR, and access to essential services and benefits.
2 Aug 2028
Rules for AI in products covered by their own EU product legislation, such as medical devices.
What this means for your organisation
What the law asks depends on what you use AI for, not on the tool itself. Below you can read what applies in each situation, for management, IT and the DPO.
All sectors
For texts, emails or translations. That falls under the AI Act too. Your people need to know the risks, such as answers that look convincing but are wrong. How you tackle that is up to you, tailored to who uses which tool.
What applies: AI literacy (Article 4), since 2 February 2025.
All sectors
People must know they are talking to AI, unless that is already obvious. That obligation lies with the provider of the chatbot. If you have one built and put it online under your own name, that may be your organisation. So just say it in the first message.
What applies: Transparency (Article 50), since 2 August 2026.
Recruitment and HR
Using AI to filter CVs or assess candidates is high-risk. You then use the system according to its instructions for use, assign human oversight to someone with the necessary competence, monitor how it works, keep the logs and tell candidates that AI plays a part in the decision.
What applies: High-risk (Annex III, point 4), from 2 December 2027.
Education
A chat tool for learning is not on the high-risk list as such. Using AI to assess tests or learning outcomes, decide on admission or detect cheating during tests is. Inferring pupils’ emotions with AI is prohibited.
What applies: High-risk (Annex III, point 3), from 2 December 2027. Prohibition since 2 February 2025.
Care
If the AI software is itself a medical device or is built into one, it can fall under the rules for products. Whether a tool is a medical device depends on its intended purpose. Have that checked before you roll it out widely.
What applies: possibly high-risk (Annex I), from 2 August 2028.
Public services and non-profits
Public bodies and organisations that provide a public service carry out a fundamental rights impact assessment before they first use a high-risk system. Often together with your data protection impact assessment (DPIA).
What applies: High-risk (Annex III, point 5), from 2 December 2027.
What you can already do
01
Including the tools staff picked themselves. For each tool, note what you use it for and what data goes into it.
02
Prohibited, high-risk, a transparency obligation or none of the three. If in doubt, find out before you use it more widely.
03
Match training to who uses which tool and for what. Keep an overview of training and agreements.
04
Which tools are allowed, with which data, and who checks. A short AI policy helps. The law does not require a separate AI officer or an AI committee.
05
With a chatbot or a deepfake, state clearly that AI is involved. The same goes for AI-generated texts for the public, unless someone reviews them and holds editorial responsibility for them.
Rather do it together?
With a Roadmap, you and your team set the agreements: an AI policy, a register and an AI literacy plan. On the same day you choose what you’ll do with AI, and we work out the first application.
No. According to the European Commission, a certificate is not needed. You can keep an internal record of training and other initiatives on AI literacy.
Yes. For AI literacy, the AI Act makes no exception based on size. The European Commission and the Member States do have to support SMEs in particular, including with practical examples.
No. For AI literacy, the law does not require a separate role or governance structure. In practice, it does help if one person keeps the overview.
National market surveillance authorities supervise the rules, including AI literacy. The European Commission’s list (updated on 7 September 2026) does not yet show a contact point for Belgium.
Regulation (EU) 2026/1744 entered into force on 27 July 2026. AI literacy remains an obligation, but without a fixed level. The high-risk rules move to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). And from 2 December 2026, a new prohibition applies to AI that creates sexually explicit images of real people without their consent.
According to the European Commission, research, development and prototyping before an AI system is placed on the market are not covered. Once you place the system on the market or put it into service, the rules do apply. And if your researchers use AI tools in their work, AI literacy applies too.
In a first conversation, we look at which AI you use and what the law asks of you for it. A Roadmap turns that into agreements, and into a plan for what you’ll do with AI.
No obligation · 30 minutes · online, with someone who puts AI to work every day
Sources
The facts on this page come from the official texts and the European Commission’s guidance. Correct as of 3 October 2026.
