The AI Act: what operations leaders need to know

The AI Act, the European Union’s regulation on artificial intelligence, came into force on 1 August 2024 and applies in phases. For most operations teams, the real question is how it applies to their case. The good news: almost every everyday use of AI in operations falls into the least demanding category. The bad news: you need to be able to explain why.

This article is not legal advice. We wrote it as the practical guide we would like every operations director to read before talking to the legal team.

The logic of the regulation: risk

The AI Act does not regulate the technology itself. It regulates how it is used, by level of risk:

• Prohibited: a short list of practices, such as social scoring of individuals or manipulation that exploits vulnerabilities. In force since 2 February 2025.
• High risk: uses with a serious impact on people’s lives, such as deciding who gets hired, assessing credit for individuals or managing critical infrastructure. These carry demanding obligations on documentation, human oversight and data quality.
• Limited risk: systems that interact with people, such as chatbots, must disclose that they are AI.
• Minimal risk: the vast majority, such as classifying documents, forecasting demand, reconciling invoices or preparing reports.

Three questions to ask from the start

1. Does this system make or influence decisions about people? If the agent decides who is hired, who receives credit or who has access to a service, you have entered high-risk territory. If it helps decide how many pallets to order, you have not.

2. Is a person overseeing what matters? Even where it is not mandatory, human oversight of sensitive actions is the best defence: technical, commercial and regulatory.

3. Can you explain what the system did? That takes a record of every action, the sources used and who approved it. It is a requirement for high-risk systems and good practice for all the others.

The timeline

The obligations come into force in stages between 2025 and 2027, and part of the timeline is under review at European level (see the update at the end of this article). So confirm the dates that apply to your case with your legal team before you plan.

What we do in practice

On every project, the first week includes classifying the use by risk level, defining which actions need human approval and designing the audit record. These are the same decisions that make a system reliable, and the regulation simply requires us to write them down.

July 2026 update

The review of the timeline has been completed. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and came into force on 27 July. The obligations for high-risk systems now apply:

• from 2 December 2027, for the high-risk systems in Annex III (for example, employment, credit and access to essential services);
• from 2 August 2028, for systems built into products that are already regulated (Annex I).

The prohibitions and the obligations for general-purpose AI models, which have applied since 2025, remain unchanged. Sources: European Commission and EUR-Lex, below.