The VIFLY guide France · European Union
The AI Act depends on your role and use.
Using a writing assistant, integrating a chatbot and selling a recruitment system do not create the same responsibilities. Start by classifying your use.
Sources checked on 23 October 2026
The short answer
AI Act: duties and prohibitions
The AI Act is a European regulation based on risk. Some practices are prohibited; other uses involve transparency or high-risk requirements. The timeline has changed: this page uses the consolidated text presented by the Commission as of 27 July 2026, rather than an old 2024 infographic.
These guideposts distinguish the status of a rule; 'Pause and check' calls for review before acting.
Three questions to classify your use
Your role
Provide, integrate or use?
The effect
Who is affected by the decision?
The rule
Which duty, on which date?
From rule to practice
What does that look like in practice?
An assistant for your drafts
You use an existing tool in your creator business.
Check your role, transmitted data, rights and appropriate human checks.
Inferring workers' mood from their faces
The system infers emotions in the workplace.
This use falls under a prohibition in principle, subject to the text's medical or safety exception. Have the system assessed before deployment.
A tool ranking job applications
The ranking may affect access to employment.
Request a specialised assessment of role, high risk, GDPR and recruitment rules; do not rely on an AI label alone.
Provider and deployer: who does what?
A provider develops or commissions a system and markets or puts it into service under its name. A deployer uses it in their activity. You may therefore have duties even if you did not train the model. A substantial modification or change of intended purpose can also change responsibilities.
For a creative business, initial checks often concern data, rights, advertising and transparency. A tool affecting employment, education, credit or health needs more specialised classification: the sector and exact function matter.
Practices to rule out
Article 5 covers, among other things, manipulation or exploitation of vulnerabilities causing or likely to cause significant harm, certain adverse social scoring, crime prediction based solely on profiling, and untargeted image scraping for facial recognition databases.
It also prohibits emotion inference at work or in education, except for medical or safety reasons, certain sensitive biometric categorisation, and real-time remote biometric identification for policing in public spaces, subject to strict exceptions. The full text's conditions and exceptions are decisive.
From 2 December 2026, new European prohibitions apply to certain systems generating or manipulating non-consensual sexual content and child sexual abuse material, under Article 5's conditions. That date creates no prior permission: distribution of non-consensual sexual deepfakes is already punishable in France.
Read dates with their scope
Since 2 February 2025: initial prohibitions and AI literacy provisions. Since 2 August 2026: Article 50 transparency duties. A limited period until 2 December 2026 concerns provider marking and detection for certain systems already marketed before 2 August; it does not postpone all creator disclosures.
The consolidated text sets 2 December 2027 for the relevant Chapter III requirements for Annex III high-risk systems, and 2 August 2028 for those linked to Annex I. This does not suspend existing GDPR, non-discrimination, safety or employment rules.
Developing appropriate AI literacy
Article 4 requires providers and deployers to take measures supporting AI literacy among people using systems on their behalf. Measures reflect their knowledge, the use and affected people. The text states that this does not require guaranteeing a particular individual level.
In practice, explain model limitations, permitted data, pre-publication checks and incident procedures. Keep a record of guidance and awareness activities. The AI Act does not mandate a universal certificate or a single number of training hours for every profession.
Before taking action
Your essential checks.
A preparation aid, with no automatic compliance verdict.
Getting to the point
Questions people often ask.
Are all AI tools high-risk?
No. Classification depends on intended purpose and context, among other things. A writing assistant does not automatically have the same regime as a recruitment system or medical device.
Must I buy a mandatory AI certification?
Article 4 does not create a mandatory universal certificate. It requires appropriate measures supporting AI literacy. Sector-specific or contractual rules may require other evidence.
Sources and method
The sources behind the answers.
Editorial team: VIFLY. Documentary checks on 23 October 2026. This guide is an educational summary without individual legal validation. The links let you consult the text and its conditions.
- European CommissionQuestions and answers on Article 50 and dates Official explanation
- European CommissionAI Act — Article 5: prohibited practices Legal text
- European CommissionAI Act — Article 4: AI literacy Legal text
- European CommissionAI Act — Article 113: consolidated timeline Legal text
- European CommissionEuropean artificial intelligence framework Official explanation
- CNILEuropean AI regulation: questions and timeline Official explanation
- LégifranceFrench Criminal Code — Article 226-8-1 Legal text
Understand, then practise
Clear rules. Useful applications.
Explore AI courses and VIFLY resources to build a more considered practice.