Geo Ivanov · AI expert for leaders and companies, creator of Geo Executive Coach · 18 October 2026
The EU AI Act is long and technical, but for most companies that simply use AI tools, the management questions are few and clear. This is not legal advice; it is the list I go through with leadership teams before any AI project.
What already applies
- Since February 2025, certain AI practices considered unacceptable are banned, for example manipulating behaviour or recognising employees’ emotions in the workplace, with narrow exceptions.
- Also since February 2025, companies that use AI systems must take measures to ensure a sufficient level of AI literacy among the people who work with them. That means training suited to the role, not a specific certificate.
- Transparency obligations, such as telling people they are dealing with an AI system or labelling generated content, apply in stages. The timeline for high-risk systems has been debated at EU level, so always check the current version.
Where the risk is for an ordinary company
Most everyday uses, such as drafting text, summaries or document analysis, do not fall into the high-risk category. Attention should move to the sensitive areas: recruitment and employee evaluation, credit or insurance decisions, any system that decides something important about a person. The rules there are much stricter.
What management should actually do
- Make a simple inventory: which AI tools are used, by whom and for what.
- Flag sensitive uses, especially in HR and in decisions about people.
- Write a short AI policy: what data may go into a tool, what may not, who checks the output.
- Train people for their role. This covers the AI literacy requirement and cuts real mistakes.
- Name someone to follow timeline changes and official guidance.
A practical observation
I often see companies that either ban AI out of fear or leave it to chance. Both are riskier than a simple one-page rule and one hour of well-designed training.