What is changing this year regarding the AI Regulation
The AI Regulation, also known as the AI Act, does not come into full effect all at once. The rules apply in phases, spread over several years, and each year a new part of the Regulation becomes applicable. This year is another such moment: obligations concerning so-called high-risk AI systems are coming closer, and in the Member States it is becoming clearer which supervisory authority will enforce the Regulation.
For you as an entrepreneur, this means above all that the question of whether your company uses an AI system that falls under a heavier category becomes more current this year than before. Not every company working with AI will be affected by this phase; that depends on the type of system and the purpose for which it is used.
Why the Regulation is being phased in
The European legislator chose a phased implementation so that providers, supervisory authorities and users have time to prepare for the heaviest obligations. The first phase, which is now behind us, concerned a ban on a limited group of AI applications with an unacceptable risk, and the obligation to ensure that staff working with AI have sufficient knowledge about what the system does.
A subsequent phase introduced rules for providers of AI models for general purposes, the models on which many applications are built, and the designation of national supervisory authorities per Member State. Those two phases are behind us; the phase coming this year concerns systems that the Regulation designates as high-risk. If you want to see that phase by phase in a structured overview, you can find that in the knowledge base where each topic has been looked into separately.
What is concretely happening this year
High-risk AI systems are systems deployed in situations with potentially major consequences for people, for example in recruitment and selection, in assessing creditworthiness, or in access to education. This category is subject to stricter requirements: demonstrable risk management, human oversight, and documentation explaining how the system works.
The exact timeline for which type of system applies, and which exceptions apply, is set out in the Regulation itself. For systems that already fall under existing product safety legislation, such as certain machinery or medical devices, a longer lead-in period generally applies than for systems that do not. If you are in doubt as to whether a system used by your company falls into this category, that is initially a question for the system's provider, and for legal interpretation a question for a lawyer. If you do not yet have a clear picture of where your company stands, then a few questions will immediately give you a first indication.
For whom this is relevant
An HR manager using software that pre-screens or ranks applicants has a concrete reason this year to ask the provider how that software has been classified. An office manager who only uses a writing assistant or a planning tool will in most cases fall outside this heaviest category, but the Regulation also includes lighter obligations, such as making it clear that someone is interacting with an AI system rather than with a person.
A director of an installation company using AI for quotes or route planning would be wise to review each application to determine which category it falls into, rather than assessing it all at once for the entire organization. Questions that often come up on this, from applicability to documentation, can be found under the answers to questions that other entrepreneurs are also asking.
What you can do this year
It is not necessary for a small or medium-sized enterprise to fully understand the entire regulation on your own. It does help to have an overview of which AI systems are used within your organization, by whom, and for what purpose, so that you can more easily put that question to a supplier or advisor.
Would you like to know where the information on this platform comes from and how it is maintained, that is explained on the page about the origin of our information. For translating this to your own situation, the competent supervisory authority, or a lawyer, remains the appropriate point of contact.
Finally
The AI Regulation does not change everything this year all at once, but rather in steps that carry more weight for some companies than for others. Feel free to do the free quick-scan or browse through the knowledge bank to see whether, and if so where, this year is relevant for your company.