What does the EU AI Act mean for me as a user?

What is the AI Act?

The AI Act is a European Union law on artificial intelligence. It is an EU regulation, so it applies directly in all member states. It entered into force on 1 August 2024, but its rules apply step by step.

The basic idea: the greater the risk an AI application poses to people, the stricter the rules. The European Commission describes four levels. Some uses are banned outright. Others count as high-risk and must meet strict requirements. A third group carries transparency duties, meaning they must disclose certain things. Most applications, such as spam filters or AI in video games, count as minimal risk, and the law adds no specific rules for them.

What matters for you: the obligations fall on the companies and bodies that develop or use AI. As a private person using a chatbot, there is nothing you need to apply for or comply with.

What is banned

Since 2 February 2025, certain AI practices have been banned in the EU. According to the European Commission, these include harmful manipulation and deception by AI, harmful exploitation of people's vulnerabilities, social scoring, predicting whether an individual will commit a crime, and untargeted scraping of facial images from the internet or CCTV to build facial recognition databases.

Emotion recognition at work and in schools is also banned, as is biometric categorisation used to infer protected characteristics. The list also includes real-time remote biometric identification for law enforcement in publicly accessible spaces.

A 2026 amendment added a ban on AI systems that generate non-consensual sexual images of real people or child sexual abuse material, such as so-called nudify apps. This ban applies from 2 December 2026.

Where you notice the AI Act in daily life

Since 2 August 2026, the transparency rules apply. For users, they are the most visible part of the law.

Chatbots must be designed so that you are told you are talking to an AI, unless that is already obvious. This covers things like customer service chats on websites.

Providers of AI that generates images, video, audio or text must mark that content in a machine-readable way, as far as technically feasible. Systems already on the market before August 2026 have until 2 December 2026 to comply.

Anyone publishing deepfakes, meaning realistic AI-generated images, video or audio, must disclose that they are AI-generated. Lighter rules apply to clearly artistic or satirical works. AI-generated text meant to inform the public on matters of public interest must also be labelled, unless a person has reviewed it editorially and takes responsibility for it.

Our assessment: a missing label does not automatically mean content is real. A critical eye is still needed.

The timeline: what applies since when

1 August 2024: the law enters into force.

2 February 2025: the bans apply. Organisations using AI are also expected to build AI literacy among their staff. This duty was softened in 2026: they must now take measures to support it rather than guarantee it.

2 August 2025: rules for providers of general-purpose AI models apply, meaning the models behind well-known chatbots. They cover transparency, copyright and, for the most powerful models, risk assessment.

2 August 2026: most of the rules apply, including the transparency duties. From now on, authorities also enforce them.

2 December 2026: the new ban on nudify and abuse-material AI, and the end of the labelling grace period for older systems.

2 December 2027: rules for high-risk AI in sensitive areas, such as hiring, exams, creditworthiness or access to essential services. Originally planned for August 2026.

2 August 2028: rules for high-risk AI built into products such as medical devices.

The delays come from the so-called Digital Omnibus on AI, an amending regulation that entered into force on 27 July 2026.

Where to complain

Each EU country has to name authorities that enforce the AI Act. In Germany, a national implementing law took effect on 29 July 2026, making the Federal Network Agency (Bundesnetzagentur) the central contact point and complaints office. It accepts complaints about possible breaches and forwards them to the responsible authority where needed. In some sectors other regulators remain in charge, such as the financial supervisor BaFin or the regional media authorities.

At EU level, the European Commission offers its own AI Act complaints tool.

The AI Act does not replace data protection law. Where your personal data is concerned, the GDPR still applies, and data protection authorities remain responsible.