The AI Act, Regulation (EU) 2024/1689 on artificial intelligence, sets rules for AI systems according to the risk they pose: some uses are banned, others are classed as high-risk and carry strict obligations, and many have only transparency obligations or none specific at all. For most businesses that use chatbots or AI assistants, the main obligations are training their people, informing users clearly and avoiding prohibited uses.
The regulation applies directly in every member state, including Romania, without the need for a national law to transpose it. However, it applies in stages, and some deadlines are under discussion. Below we explain the overall framework in terms a manager can follow, without unnecessary legal jargon, and the practical steps a small or medium-sized business can take.
In short
The AI Act classifies AI systems into four risk levels. Your obligations depend on the level and on your role: provider (whoever develops the system or places it on the market) or deployer (the business that uses it). Any business that uses AI in its work must make sure its staff have a sufficient level of AI knowledge. Deadlines apply in stages and may change, so always check the official sources.
Please note
This article is for information only and does not constitute legal advice. It reflects the situation at the time of writing (October 2026). For your business's specific situation, consult the official text on EUR-Lex, the European Commission's AI Act pages and, where appropriate, a specialist lawyer.
What is the AI Act and who does it affect?
The AI Act is the European Union's first comprehensive legal framework dedicated to artificial intelligence. Its stated aim is for AI systems used in the EU to be safe and transparent and to respect fundamental rights, without stifling innovation.
The regulation does not apply only to technology companies. It also applies to businesses that use AI in their professional activity, whatever their sector: an online store with a chatbot, a recruitment firm that screens CVs with the help of AI, or a call centre that uses an AI voice agent. It also applies to providers outside the EU if their systems are used on the European market.
There are exceptions, for example for strictly personal, non-professional use, for scientific research or for military purposes. For an ordinary business, the relevant question is not “does it apply to me?” but “what risk level do the systems I use have, and what is my role?”.
The four risk levels in the EU regulation on artificial intelligence
The risk-based approach is the central idea of the regulation. The more seriously a system can affect people's safety or rights, the stricter the rules.
1. Prohibited practices
Certain uses are banned because they are considered unacceptable. Among them: manipulative techniques that distort people's behaviour and can cause them harm, exploiting vulnerabilities related to age or social situation, social scoring of individuals, untargeted scraping of facial images from the internet for facial recognition databases and, with some exceptions, emotion recognition in the workplace and in education.
2. High-risk systems
This covers systems used in sensitive areas listed in the regulation: for example recruitment and employee evaluation, creditworthiness assessment, access to education or essential services, critical infrastructure and certain already-regulated products, such as medical devices. These systems carry strict obligations: risk management, data quality, technical documentation, logging, human oversight, accuracy and security.
3. Transparency obligations
For some systems, the main requirement is that people know they are dealing with AI. A chatbot or an AI voice agent must inform the user that they are talking to an AI system, unless this is obvious. Artificially generated or manipulated content, such as images, audio or deepfake material, must be labelled or flagged appropriately.
4. Minimal risk
Most everyday applications, such as spam filters, simple product recommendations or assistants that help draft internal texts, have no specific obligations beyond the general ones. Voluntary codes of conduct are encouraged.
Provider or deployer: what is your role?
The regulation distinguishes between several roles, and the obligations differ considerably from one to another. The two roles that matter for most businesses are:
- The provider: whoever develops an AI system or places it on the market under their own name. They carry the most obligations, especially for high-risk systems.
- The deployer: the business that uses an AI system in its professional activity. Its obligations are narrower but real: use in line with the instructions, human oversight, informing the people affected and, for high-risk systems, monitoring and keeping logs.
Watch the boundary between roles. If a business puts its name on a high-risk system, substantially modifies it or changes its purpose so that it becomes high-risk, it may be treated as a provider. For example, a general-purpose chatbot reconfigured to decide on its own which candidates are rejected in a recruitment process changes the picture radically.
The AI literacy obligation: what it means for employees
One of the obligations that already applies to all providers and deployers, regardless of risk level, is AI literacy. The business must take measures to ensure that staff who use AI systems have a sufficient level of knowledge, taking into account their experience and the context in which the systems are used.
The regulation does not require a particular course or certification. In practice, it means people understand what the tool can and cannot do, that its outputs can be wrong, what data they must not enter and whom they report a problem to. A short, documented training session, repeated periodically, is a reasonable starting point.
When does the AI Act apply? Deadlines and current status
The regulation entered into force on 1 August 2024, but its obligations apply in stages:
- 2 February 2025: the bans on unacceptable practices and the AI literacy obligation.
- 2 August 2025: the rules for general-purpose AI models (the ones tools such as ChatGPT are built on) and the governance structures.
- 2 August 2026: most of the remaining obligations, including transparency obligations and those for many high-risk systems.
- Later: certain obligations, for example for high-risk systems embedded in already-regulated products, have later deadlines.
Important limitation
The European Commission has proposed amendments to the regulation, including postponing some deadlines, particularly for the obligations on high-risk systems. As of the time of writing (October 2026), check on EUR-Lex and on the European Commission's website whether these proposals have been adopted and which deadlines are in force for your situation. Do not rely solely on the timeline above.
What should an SME that uses chatbots or AI agents do?
For a small or medium-sized business that uses a chatbot on its website, an internal assistant or an agent that automates tasks, the steps below cover the practical side. They do not replace a legal analysis, but they help you know where you stand.
- Take an inventory: which AI tools the business uses, who uses them, for what purpose and on what data.
- Establish your role: for each tool, are you only a user (deployer), or did you develop or customise it under your own name?
- Classify the risk: check whether any use falls into the high-risk areas (for example recruitment, employee evaluation, credit decisions) or, worse, into a prohibited practice.
- Ensure transparency: the chatbot and the AI voice agent state clearly, from the start, that they are AI systems; AI-generated content published externally is flagged where appropriate.
- Organise AI literacy: short training for those who use the tools, with clear rules of use.
- Keep human oversight: decisions that affect people (customers, candidates, employees) are checked by a person.
- Document: a simple record for each system, with its purpose, provider, estimated risk, internal owner and date of last review.
- Check your suppliers: ask for documentation and instructions for use, especially for systems that may fall into the high-risk category.
Practical tip
The AI Act does not replace the GDPR. If a chatbot or an agent processes personal data, data protection rules apply in parallel: legal basis, informing individuals, a contract with the supplier, security. The two analyses are done together, not separately.
Common mistakes, and when there is no need to overcomplicate things
Two extremes come up often. The first is ignoring it entirely: “we're a small business, it doesn't apply to us”. The AI literacy obligation and the bans apply to any business that uses AI professionally, and transparency towards users is a clear requirement for chatbots.
The second extreme is disproportionate bureaucracy. An assistant that helps the team draft internal emails does not require the same documentation as a system that decides who gets a loan. Compliance effort should be proportionate to the real risk. If you are not sure which category a use falls into, that is the question to put to a lawyer, before launch, not after.
How WEB-AZ helps
When we build chatbots, AI agents or AI voice agents, we include the technical elements related to transparency and control from the start: the message telling users they are talking to an AI system, handover to a person, logging and limiting the data processed. We do not provide legal advice, but we can work together with your lawyer so that their decisions are implemented correctly in the system.
Next steps