The AI Act, the European regulation on artificial intelligence, is Regulation (EU) 2024/1689. It is the first general legal framework for AI adopted by a major economic region. It applies directly in all Member States, including Belgium, without a transposition law, and sets obligations proportionate to the risk of each use of AI.
The timeline
The regulation was published in the Official Journal of the European Union on 12 July 2024 and entered into force on 1 August 2024. Its obligations apply in stages, according to the published text:
| Date | What applies |
|---|---|
| 2 February 2025 | Ban on AI practices deemed unacceptable; AI literacy obligation (Article 4) |
| 2 August 2025 | Obligations for providers of general-purpose AI models; governance and penalties |
| 2 August 2026 | General application, including the transparency obligations of Article 50 and most rules on high-risk systems |
| 2 August 2027 | Rules on high-risk systems built into products that are already regulated |
The European Commission has proposed adjustments to the timeline of some high-risk obligations. Check the consolidated version of the text on EUR-Lex before relying on a specific date.
A risk-based approach
The regulation sorts uses of AI into four levels:
- Unacceptable risk: banned practices, such as social scoring of people by public authorities or certain manipulation that exploits people's vulnerability
- High risk: systems used in sensitive areas, such as recruitment, access to education, credit or certain public services. They are subject to strict requirements: risk management, data quality, documentation, human oversight
- Limited risk: systems that interact with people or generate content. They are mainly subject to transparency obligations
- Minimal risk: the vast majority of uses, such as spam filters, with no specific obligation
An AI assistant that answers a website's visitors on practical questions generally falls under limited risk. It would be different if it were used, for example, to screen job applications or decide whether to grant credit.
What the AI Act asks of an SME using an assistant
The regulation distinguishes the provider, which develops and places an AI system on the market, from the deployer, which uses it in the course of its business. An SME that installs an assistant on its website is a deployer. For a limited-risk conversational assistant, the main obligations are:
- Inform people that they are interacting with an AI system, at the latest at the first interaction, unless this is obvious from the context (Article 50)
- Ensure a sufficient level of AI literacy among the people who use or oversee the system for the organization (Article 4): knowing what the tool does, its limits and its risks
- Comply with the other rules that continue to apply, notably the GDPR for personal data and consumer law for information given to customers
In practice, informing the visitor means an unambiguous name for the assistant and a clear notice in the chat window. AI literacy means a short training session for the team that reads and takes over conversations.
General-purpose AI models
Companies that develop large language models, such as Google, Anthropic or OpenAI, have had their own obligations since 2 August 2025: technical documentation, information for businesses that integrate their models, a copyright compliance policy, a summary of training data. Models with systemic risk have additional obligations. These rules fall on model providers, not on the SME that uses them through a platform.
Penalties
The regulation sets graduated administrative fines. For banned practices, they can reach 35 million euros or 7% of worldwide annual turnover. For most other breaches, 15 million euros or 3%. For SMEs, the text provides that the lower of the two amounts applies. Each Member State designates its supervisory authorities.
The AI Act and the GDPR: two complementary texts
The GDPR protects personal data, whatever tool processes it. The AI Act governs AI systems themselves, whether or not they process personal data. A website assistant must comply with both: tell the visitor they are talking to an AI (AI Act), and tell them what happens to their data, with a legal basis and a retention period (GDPR).
The AI Act and KernChat
KernChat assistants introduce themselves as assistants from the start of the conversation, under the name chosen by the organization. The set-up includes a presentation to the team of what the assistant does, its limits and how conversations are taken over. KernChat is not used for high-risk purposes, such as recruitment or scoring people.