EU AI Act, phase one: what changes today
The world's first broad AI law starts to bite. Most small businesses are not doing anything banned — but the new AI literacy duty applies to anyone using AI at work.
By the Xuru Technologies team · 5 February 2025
Key takeaways
- From 2 February 2025, Article 5 of the EU AI Act prohibits a short list of AI practices considered an unacceptable risk.
- Article 4 requires providers and deployers of AI systems to take measures to ensure sufficient AI literacy among staff who use them.
- The rules can apply to businesses outside the EU when their AI systems or outputs are used in the EU.
- Rules for general-purpose AI models and high-risk systems follow later.
If your team uses ChatGPT to draft emails or your website has an AI chatbot, the EU AI Act now has something to say about you — though probably less than you fear.
What happened
As Kilpatrick Townsend explains, the prohibitions and AI literacy obligations became applicable on 2 February 2025, with the European Commission publishing guidelines on the banned practices. The prohibited list includes manipulative techniques that cause significant harm, exploiting vulnerabilities, social scoring, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools (with limited exceptions) and certain biometric categorisation.
What it means for businesses
- Chatbots and writing tools are not banned. Everyday uses — drafting, summarising, answering customer questions — are not on the prohibited list.
- AI literacy is a real duty. Staff who use AI should understand its limits: it can be wrong, it can leak data if misused, and its output needs checking.
- Transparency is coming. Later obligations require people to be told when they are talking to an AI. Labelling your website assistant now is good practice.
- Non-EU businesses are in scope when they serve EU customers with AI-driven features.
What to do now
| Action | Effort |
|---|---|
| List every AI tool your team uses and what for | One hour |
| Write a one-page AI use policy: what data is off-limits, who checks output | Half a day |
| Run a short training session and keep a record | One hour per team |
| Label your website chatbot clearly as AI | Minutes |
This is general information, not legal advice. Our AI services and data notice shows how we describe our own AI use.
Frequently asked questions
Does a small business need an AI literacy programme?
The law asks for measures proportionate to your situation. For a small team, a short policy, a training session and a record that it happened is a sensible start.
Is a website chatbot high-risk under the AI Act?
A customer service chatbot is generally not a high-risk system. Transparency duties, such as telling users they are interacting with AI, are the most relevant obligations.
When do the other AI Act rules apply?
Obligations for general-purpose AI models apply from August 2025, and most other provisions, including many high-risk requirements, from August 2026, subject to any later changes.
AI features your customers can trust.
We build AI assistants that are clearly labelled, respect privacy rules and hand over to a person when it matters.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply