Question 1

Does the EU AI Act apply to my startup?

Accepted Answer

Article 2 sets out who the Regulation applies to. It does not turn on company size. AI Act Article 2, as held on 23 August 2026, reads: “This Regulation applies to: (a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country; (b) deployers of AI systems that have their place of establishment or are located within the Union; (c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union; (d) importers and distributors of AI systems; (e) product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark; (f) authorised representatives of providers, which are not established in the Union; (g) affected persons that are located in the Union.”

Question 2

Does the EU AI Act apply to companies outside the EU?

Accepted Answer

Article 2 defines the Regulation's reach by where a system is placed on the market or its output is used, not by where the company is established. AI Act Article 2, as held on 23 August 2026, reads: “providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country; (b) deployers of AI systems that have their place of establishment or are located within the Union; (c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union; (d) importers and distributors of AI systems; (e) product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark; (f) authorised representatives of providers, which are not established in the Union; (g) affected persons that are located in the Union.”

Question 3

We only use OpenAI or Anthropic APIs — does the AI Act apply to us?

Accepted Answer

Article 25 sets out when someone along the AI value chain is treated as a provider of a high-risk system rather than as a deployer. AI Act Article 25, as held on 23 August 2026, reads: “Any distributor, importer, deployer or other third-party shall be considered to be a provider of a high-risk AI system for the purposes of this Regulation and shall be subject to the obligations of the provider under Article 16, in any of the following circumstances: (a) they put their name or trademark on a high-risk AI system already placed on the market or put into service, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated; (b) they make a substantial modification to a high-risk AI system that has already been placed on the market or has already been put into service in such a way that it remains a high-risk AI system pursuant to Article 6; (c) they modify the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service in such a way that the AI system concerned becomes a high-risk AI system in accordance with Article 6.”

Question 4

Are we a 'provider' or a 'deployer' under the AI Act?

Accepted Answer

Article 3 defines both terms. Which one applies decides which obligations the Act attaches. AI Act Article 3, as held on 23 August 2026, reads: “`provider' means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge; (4) `deployer' means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity; (5) `authorised representative' means a natural or legal person located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model to, respectively, perform and carry out on its behalf the obligations and procedures established by this Regulation; (6) `importer' means a natural or legal person located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country; (7) `distributor' means a natural or legal person in the supply chain, other than the provider or the. […] this paragraph continues; read the full provision at the link below.”

Question 5

Is my AI system 'high-risk' under the EU AI Act?

Accepted Answer

Article 6 sets out the classification rules. Annex III lists the areas it refers to. AI Act Article 6, as held on 23 August 2026, reads: “AI systems referred to in Annex III shall be considered to be high-risk. ELI: http://data.europa.eu/eli/reg/2024/1689/oj 53/144 EN OJ L, 12.7.2024”

Question 6

We are still in beta — do we have to comply with the AI Act yet?

Accepted Answer

Article 113 sets the dates from which the Regulation and its separate parts apply. AI Act Article 113, as held on 23 August 2026, reads: “this Regulation shall apply from 2 August 2027. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 13 June 2024. For the European Parliament The President R. METSOLA For the Council The President M. MICHEL ELI: http://data.europa.eu/eli/reg/2024/1689/oj 123/144 EN OJ L, 12.7.2024”

Question 7

When do the different parts of the EU AI Act start to apply?

Accepted Answer

Article 113 gives the entry into force and the staggered application dates. AI Act Article 113, as held on 23 August 2026, reads: “shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 2 August 2026. However: (a) Chapters I and II shall apply from 2 February 2025; (b) Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 shall apply from 2 August 2025, with the exception of Article 101; (c) Article 6(1) and the corresponding obligations in this Regulation shall apply from 2 August 2027. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 13 June 2024. For the European Parliament The President R. METSOLA For the Council The President M. MICHEL ELI: http://data.europa.eu/eli/reg/2024/1689/oj 123/144 EN OJ L, 12.7.2024”

Question 8

What are our obligations if we are only a deployer, not the provider?

Accepted Answer

Article 26 sets out the obligations the Act places on deployers of high-risk AI systems. AI Act Article 26, as held on 23 August 2026, reads: “Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and”

Question 9

Do we need to label AI-generated content or tell people they are talking to a chatbot?

Accepted Answer

Article 50 sets out transparency obligations for certain AI systems, including human interaction and generated content. AI Act Article 50, as held on 23 August 2026, reads: “Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.”

Question 10

Is there a lighter regime for SMEs and startups under the AI Act?

Accepted Answer

Article 62 sets out measures for smaller providers and deployers; Article 63 provides specific derogations for microenterprises. AI Act Article 62, as held on 23 August 2026, reads: “Member States shall undertake the following actions: (a) provide SMEs, including start-ups, having a registered office or a branch in the Union, with priority access to the AI regulatory sandboxes, to the extent that they fulfil the eligibility conditions and selection criteria; the priority access shall not preclude other SMEs, including start-ups, other than those referred to in this paragraph from access to the AI regulatory sandbox, provided that they also fulfil the eligibility conditions and selection criteria; (b) organise specific awareness raising and training activities on the application of this Regulation tailored to the needs of SMEs including start-ups, deployers and, as appropriate, local public authorities; (c) utilise existing dedicated channels and where appropriate, establish new ones for communication with SMEs including start-ups, deployers, other innovators and, as appropriate, local public authorities to provide advice and respond to queries about the implementation of this Regulation, including as regards participation in AI regulatory sandboxes; (d) facilitate the participation of SMEs and other relevant stakeholders in the standardisation development proce. […] this paragraph continues; read the full provision at the link below.”

Question 11

How big are the fines for breaching the EU AI Act?

Accepted Answer

Article 99 sets ceilings, and then qualifies them: paragraph 6 caps fines for SMEs and start-ups at whichever is LOWER, and paragraph 1 requires penalties to be proportionate and to take account of the economic viability of smaller operators. AI Act Article 99, as held on 23 August 2026, reads: “administrative fines of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.  […]  In the case of SMEs, including start-ups, each fine referred to in this Article shall be up to the percentages or amount referred to in paragraphs 3, 4 and 5, whichever thereof is lower.  […]  The penalties provided for shall be effective, proportionate and dissuasive. They shall take into account the interests of SMEs, including start-ups, and their economic viability.”

Question 12

Do we have to register our AI system anywhere?

Accepted Answer

Article 49 sets out the registration requirement and who it falls on. AI Act Article 49, as held on 23 August 2026, reads: “Before placing on the market or putting into service a high-risk AI system listed in Annex III, with the exception of high-risk AI systems referred to in point 2 of Annex III, the provider or, where applicable, the authorised representative shall register themselves and their system in the EU database referred to in Article 71.”

Question 13

Who has to do a conformity assessment, and what is it?

Accepted Answer

Article 43 sets out which conformity assessment procedure applies to which high-risk systems. AI Act Article 43, as held on 23 August 2026, reads: “For high-risk AI systems listed in point 1 of Annex III, where, in demonstrating the compliance of a high-risk AI system with the requirements set out in Section 2, the provider has applied harmonised standards referred to in Article 40, or, where applicable, common specifications referred to in Article 41, the provider shall opt for one of the following conformity assessment procedures based on: (a) the internal control referred to in Annex VI; or (b) the assessment of the quality management system and the assessment of the technical documentation, with the involvement of a notified body, referred to in Annex VII. […] this paragraph continues; read the full provision at the link below.”

Question 14

Can I use AI that nudges people without them realising, in the EU?

Accepted Answer

No — the AI Act lists this among prohibited practices. AI Act Article 5(1)(a), as held on 23 August 2026, reads: “the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm”

Question 15

Can I use AI that targets people because of their age or disability?

Accepted Answer

No — the AI Act lists this among prohibited practices. AI Act Article 5(1)(b), as held on 23 August 2026, reads: “the placing on the market, the putting into service or the use of an AI system that exploits any of the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective, or the effect, of materially distorting the behaviour of that person or a person belonging to that group in a manner that causes or is reasonably likely to cause that person or another person significant harm”

Question 16

Can I build a facial recognition database by scraping images, in the EU?

Accepted Answer

No — the AI Act lists this among prohibited practices. AI Act Article 5(1)(e), as held on 23 August 2026, reads: “the placing on the market, the putting into service for this specific purpose, or the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage”

Question 17

Can I use AI for biometric identification or emotion recognition in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 1 — Biometrics, in so far as their use is permitted under relevant Union or national law, as held on 23 August 2026, reads: “(a) remote biometric identification systems. This shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be; (b) AI systems intended to be used for biometric categorisation, according to sensitive or protected attributes or characteristics based on the inference of those attributes or characteristics; (c) AI systems intended to be used for emotion recognition.”

Question 18

Can I use AI in critical infrastructure in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 2 — Critical infrastructure, as held on 23 August 2026, reads: “AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or in the supply of water, gas, heating or electricity”

Question 19

Can I use AI to assess students or mark exams in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 3 — Education and vocational training, as held on 23 August 2026, reads: “(a) AI systems intended to be used to determine access or admission or to assign natural persons to educational and vocational training institutions at all levels; (b) AI systems intended to be used to evaluate learning outcomes, including when those outcomes are used to steer the learning process of natural persons in educational and vocational training institutions at all levels; (c) AI systems intended to be used for the purpose of assessing the appropriate level of education that an individual will receive or will be able to access, in the context of or within educational and vocational training institutions at all levels; (d) AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels.”

Question 20

Can I use AI to screen or rank job applicants in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 4 — Employment, workers' management and access to self-employment, as held on 23 August 2026, reads: “(a) AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates; (b) AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.”

Question 21

Can I use AI for credit scoring or insurance pricing in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 5 — Access to and enjoyment of essential private services and essential public services and benefits, as held on 23 August 2026, reads: “(a) AI systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services, including healthcare services, as well as to grant, reduce, revoke, or reclaim such benefits and services; (b) AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud; (c) AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance; (d) AI systems intended to evaluate and classify emergency calls by natural persons or to be used to dispatch, or to establish priority in the dispatching of, emergency first response services, including by police, firefighters and medical aid, as well as of emergency healthcare patient triage systems.”

Question 22

Can I use AI in law enforcement in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 6 — Law enforcement, in so far as their use is permitted under relevant Union or national law, as held on 23 August 2026, reads: “(a) AI systems intended to be used by or on behalf of law enforcement authorities, or by Union institutions, bodies, offices or agencies in support of law enforcement authorities or on their behalf to assess the risk of a natural person becoming the victim of criminal offences; (b) AI systems intended to be used by or on behalf of law enforcement authorities or by Union institutions, bodies, offices or agencies in support of law enforcement authorities as polygraphs or similar tools; (c) AI systems intended to be used by or on behalf of law enforcement authorities, or by Union institutions, bodies, offices or agencies, in support of law enforcement authorities to evaluate the reliability of evidence in the course of the investigation or prosecution of criminal offences; (d) AI systems intended to be used by law enforcement authorities or on their behalf or by Union institutions, bodies, offices or agencies in support of law enforcement authorities for assessing the risk of a natural person offending or re-offending not solely on the basis of the profiling of natural persons as referred to in Article 3(4) of Directive (EU) 2016/680, or to assess personality traits and characteristics or past criminal behaviour of natural persons or groups; (e) AI systems intended to be used by or on behalf of law enforcement authorities or by Union institutions, bodies, offices or agencies in support of law enforcement authorities for the profiling of natural persons as referred to in Article 3(4) of Directive (EU) 2016/680 in the course of the detection, investigation or prosecution of criminal offences.”

Question 23

Can I use AI in migration, asylum or border control in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 7 — Migration, asylum and border control management, in so far as their use is permitted under relevant Union or national law, as held on 23 August 2026, reads: “(a) AI systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies as polygraphs or similar tools; (b) AI systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies to assess a risk, including a security risk, a risk of irregular migration, or a health risk, posed by a natural person who intends to enter or who has entered into the territory of a Member State; (c) AI systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies to assist competent public authorities for the examination of applications for asylum, visa or residence permits and for associated complaints with regard to the eligibility of the natural persons applying for a status, including related assessments of the reliability of evidence; (d) AI systems intended to be used by or on behalf of competent public authorities, or by Union institutions, bodies, offices or agencies, in the context of migration, asylum or border control management, for the purpose of detecting, recognising or identifying natural persons, with the exception of the verification of travel documents.”

Question 24

Can I use AI in courts or elections in the EU?

Accepted Answer

The AI Act does not prohibit it. It lists systems in this area in Annex III, and Article 6(2) provides that systems referred to in Annex III are classified as high-risk. AI Act Annex III, area 8 — Administration of justice and democratic processes, as held on 23 August 2026, reads: “(a) AI systems intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution; (b) AI systems intended to be used for influencing the outcome of an election or referendum or the voting behaviour of natural persons in the exercise of their vote in elections or referenda. This does not include AI systems to the output of which natural persons are not directly exposed, such as tools used to organise, optimise or structure political campaigns from an administrative or logistical point of view. ELI: http://data.europa.eu/eli/reg/2024/1689/oj 129/144 EN OJ L, 12.7.2024”

Question 25

What does MiCA require for holding clients' crypto-assets?

Accepted Answer

MiCA sets out safekeeping duties for crypto-asset service providers holding clients' crypto-assets and funds, in Article 70. MiCA Article 70, as held on 23 August 2026, reads: “Article 70 Safekeeping of clients’ crypto-assets and funds 1. Crypto-asset service providers that hold crypto-assets belonging to clients or the means of access to such crypto-assets shall make adequate arrangements to safeguard the ownership rights of clients, especially in the event of the crypto-asset service provider’s insolvency, and to prevent the use of clients’ crypto-assets for their own account. 2. Where their business models or the crypto-asset services require holding clients’ funds other than e-money tokens, crypto-asset service providers shall have adequate arrangements in place to safeguard the ownership rights of clients and prevent the use of clients’ funds for their own account. 3. Crypto-asset service providers shall, by the end of the business day following the day on which clients’ funds other than e-money tokens were received, place those funds with a credit institution or a central bank. Crypto-asset service providers shall take all necessary steps to ensure that clients’ funds other than e-money tokens held with a credit institution or a central bank are held in an account separately identifiable from any accounts used to hold funds belonging to the crypto-asset service providers. 4. Crypto-asset service providers may themselves, or through a third party, provide payment services related to the cryptoasset service they offer provided that the crypto-asset service provider itself, or the third party, is authorised to provide those services under Directive (EU) 2015/2366. Where payment services are provided, crypto-asset service providers shall inform their clients of all of the following: (a) the nature and terms and conditions of those services, including references to the applicable national law and to the rights of clients; (b) whether those services are provided by them directly or by a third party. 5. Paragraphs 2 and 3 of this Article shall not apply to crypto-asset service providers that are electronic money institutions, payment institutions or credit institutions.”

Question 26

Do I need authorisation to provide crypto-asset services in the EU?

Accepted Answer

MiCA Article 59 sets out the authorisation requirement for providing crypto-asset services in the Union. MiCA Article 59, as held on 23 August 2026, reads: “Article 59 Authorisation 1. A person shall not provide crypto-asset services, within the Union, unless that person is: (a) a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with Article 63; or (b) a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset services pursuant to Article 60. 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member State where they carry out at least part of their crypto-asset services. They shall have their place of effective management in the Union and at least one of the directors shall be resident in the Union. 3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-asset services if their legal form ensures a level of protection for third parties’ interests equivalent to that afforded by legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form. 4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for their authorisation. 5. A person who is not a crypto-asset service provider shall not use a name, or a corporate name, or issue marketing communications or undertake any other process suggesting that it is a crypto-asset service provider or that is likely to create confusion in that respect. 6. Competent authorities that grant authorisations in accordance with Article 63 shall ensure that such authorisations specify the crypto-asset services that crypto-asset service providers are authorised to provide. 7. Crypto-asset service providers shall be allowed to provide crypto-asset services throughout the Union, either through the right of establishment, including through a branch, or through the freedom to provide services. Crypto-asset service providers that provide crypto-asset services on a cross-border basis shall not be required to have a physical presence in the territory of a host Member State. 8. Crypto-asset service providers seeking to add crypto-asset services to their authorisation as referred to in Article 63 shall request the competent authorities that granted their initial authorisation for an extension of their authorisation by complementing and updating the information referred to in Article 62. The request for extension shall be processed in accordance with Article 63.”

Direct answers, in the law's own words