Check whether a use is prohibited
Screen the banned practices and their specific exceptions before buying, building or using a tool.
By Sorena AIPublished Updated
A practical introduction
EU AI Act
Find out which AI uses are banned, which need stricter checks, when to tell people about AI, and what your organisation should do next.
The four AI risk categories
The Commission uses four risk labels to explain the Act. Classify the intended use of each before deciding which rules apply.
Unacceptable risk
Certain harmful practices are prohibited. Examples include specified social scoring and workplace emotion recognition, with narrow exceptions. Stop a use if it meets a prohibition.
High risk
Listed uses need stricter checks and records. Examples include AI that ranks job applicants and certain safety-related medical AI. Check the exact use and any exception before assigning duties.
Limited or transparency risk
Certain uses require people to be told about AI, or generated content to be marked. Examples include chatbots and deepfakes. The duty depends on the function and whether you supply or use the system.
Minimal or no risk
Tools such as typical spam filters face fewer AI Act requirements. Check the other categories first. AI literacy duties and other laws, including data protection, can still apply.
These labels are a starting point. Transparency duties can also apply to a . General-purpose AI models have separate rules, explained below.
An AI system and an AI model are different
AI system
A tool that uses AI to produce predictions, content, recommendations or decisions. A chatbot, hiring application or fraud-detection tool can be an . Assess what the tool is intended to do.
General-purpose AI model
A can perform many different tasks and be built into different tools. The Act calls these GPAI models. Each built with a model has its own purpose and risk classification.
Some GPAI models face extra duties because their capabilities or impact create systemic risk. This is a separate model classification. Using a model through a supplier does not, by itself, make your organisation its .
Do you use AI, supply AI, or both?
You use an AI tool: deployer
Your organisation uses an under its authority, for example to screen applications or help staff draft text. A uses AI professionally. Purely personal non-professional use is excluded from deployer obligations.
You supply an AI tool: provider
You develop an , or have one developed, and supply it or put it into service under your name. A can also build a system for its own use. Branding, major changes or a new intended use can change your role.
You import, distribute or represent a supplier
Bringing a non-EU system to the EU market, distributing it or acting as an authorised representative can carry separate duties. Check your activity and the supplier relationship.
The same organisation can be a for one system and a for another. Contracts help allocate work, but the legal role follows the facts.
Internal use can still be covered
The Act can cover AI used inside a business as well as AI sold to customers. Some exclusions apply, including specified research activities and uses exclusively for military, defence or national-security purposes. Check their conditions.
It can also cover providers and deployers based outside the EU when output produced by their is used in the EU. An EU connection and the activity involved determine which scope rule applies.
What should you do first?
- 1
List the AI tools you use or supply
Write down what each tool does, who uses it and who its outputs affect. Give each tool an owner.
- 2
Check your role and the risk
Screen prohibited practices first. Check both high-risk routes and any transparency duties. Assess model- duties separately.
- 3
Assign the duties and dates
Match the rules to your role. Keep the records that show how you reached your decision, and review it when the use or system changes.
Keep AI risk assessment broader than the legal category. A tool outside the high-risk rules can still expose confidential data, produce wrong answers or affect people.
Which dates apply?
The Act applies in stages. Use the date for your specific duty and check transition rules for existing systems and models.
Already applicable
The original prohibited-practice rules and AI literacy provisions began applying on 2 February 2025. Most general-purpose model duties followed on 2 August 2025, with a later transition for older models.
2 August 2026
Most remaining general rules, including AI disclosure rules in , apply. Providers of certain older systems have until 2 December 2026 for synthetic-content marking.
2 December 2027
High-risk rules in , Sections 1 to 3, except (5), apply to listed uses under , such as specified hiring and credit-scoring uses.
2 August 2028
Those high-risk rules apply to the product-related route in (1) and , which covers specified regulated products and safety components.
New prohibitions on specified non-consensual intimate content and child sexual abuse material apply from 2 December 2026. They have a separate start date from the original prohibitions.
Find the rule you need
Choose a guide once you know your tool, its use and your role.
Check high-risk uses
See how hiring, education, credit and product-safety uses can trigger stricter requirements.
Tell people when AI is involved
Find the rules for chatbots, synthetic content, deepfakes and other uses that require notices or marking.
Prepare the required records
Find the documents, checks and approvals needed for a high-risk system.
Use standards carefully
Check which quality-management requirements a cited standard supports and which duties you must still assess.
AI Act dates and milestones
The timeline includes legal deadlines, guidance and standards milestones. Check the event details before treating a date as a compliance deadline.
Loading timeline...
Detailed AI Act guides
Open the guide that matches your question. You can return to the overview at any time.
Does the Act apply to us?
Check your tool, its use and your role.
Which rules apply?
Check prohibited uses, high-risk systems, general-purpose models and disclosure duties.
What must we put in place?
Find checklists, documents and assessment steps.
- EU AI Act: Compliance checklist
- EU AI Act: Plan your compliance work
- EU AI Act: High-risk requirements
- EU AI Act: Standards and quality management
- EU AI Act: Technical file and evidence templates
- EU AI Act: Conformity assessment
- EU AI Act: Choose a high-risk assessment route
- EU AI Act GPAI model evidence checklist
When must we act?
Check dates, monitor systems and handle incidents.
How does this fit other frameworks?
Compare the Act with management standards and risk guidance, or read specific answers.
Sources
cencenelec.eu
Referenced sections
- Official announcement dated 31 July 2026 confirms publication and provider quality-management purpose. Annex ZA in the standard states the coverage and conditions.
eur-lex.europa.eu
Referenced sections
- Articles 1-2 and the Annex publish EN 18286:2026 on 14 October 2026. Presumption of conformity covers only requirements covered by the standard.
digital-strategy.ec.europa.eu
Referenced sections
- Official Commission Q&A explaining scope, roles, exclusions, risk categories, and the staged application structure.
digital-strategy.ec.europa.eu
Referenced sections
- Official Commission explanation of the risk-based approach, including unacceptable, high, limited, and minimal risk categories plus public implementation context.
"The AI Act defines 4 levels of risk for AI systems"
digital-strategy.ec.europa.eu
Referenced sections
- Supports the hub's GPAI implementation framing, including transparency, copyright, and safety and security chapters for providers of general-purpose AI models.
"The code of practice helps industry comply with the AI Act legal obligations on safety, transparency and copyright of general-purpose AI models."
commission.europa.eu
Referenced sections
- Supports the entry-into-force framing, the risk-based structure, the role of the AI Office for GPAI, and the high-level sequencing of main application phases.
"On 1 August 2024, the European Artificial Intelligence Act (AI Act) enters into force"
eur-lex.europa.eu
Referenced sections
- Primary legal text for AI Act scope, operator definitions, prohibited practices, high-risk obligations, GPAI obligations, transparency duties, evidence records, and staged application dates.
"providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union"
eur-lex.europa.eu
Referenced sections
- Binding amendment published on 24 July 2026, entering into force on 27 July 2026, that sets the revised Annex III and Article 6(1) high-risk application dates, adds a new prohibited-practice category, and changes selected transparency, sandbox, governance, and sector-law provisions.
Next steps
Work out what your organisation needs to do
Start with one AI tool. Sorena can help you check the rules, gather the required records and assign the next actions.
- Describe the tool, its use and the people affected.
- Record your classification and the sources behind it.
- Assign each required action to an owner and a date.
- Open Assessment Autopilot
Check the requirements and collect the records your team needs.
- Open Research Copilot
Ask a question and review the cited official sources.
Keep a copy of the AI Act dates and milestones.
- Talk through implementation
Discuss your AI tools and the next steps for your team.