1 of 23

★

EU

EU AI Act:

Into the Basics

A Practical Guide for Businesses

Sergejs Ponomarjovs | Chief AI Officer, SPR.lv

SPR.lv

2 of 23

SPR.lv

Disclaimer

This presentation was prepared with the assistance of AI tools and is provided for general informational purposes only.

It does not constitute legal, financial, or professional advice, and should not be relied upon as such.

It is provided "as is," with no guarantee of accuracy, completeness, or currency of the information.

The speaker and SPR.lv accept no responsibility or liability for any action taken, or not taken, on the basis of this content.

Legal position stated as at 20 August 2026, reflecting Regulation (EU) 2026/1744. This area is changing quickly.

Always confirm your specific obligations with a qualified advisor before making compliance decisions.

3 of 23

SPR.lv

Who I am

1

8 years building AI

Leading AI developers across compliance tooling and AI SaaS products.

2

EU AI Act practice at SPR

spr.lv/eu-ai-act and the AI safety training platform aisafety.spr.lv.

3

40+ GEOs served

SPR Marketing & AI, Riga, Latvia.

I sit on both sides of this: I build AI systems, and I advise businesses on the obligations that come with them.

4 of 23

SPR.lv

What is the EU AI Act?

Regulation (EU) 2024/1689

The world's first comprehensive AI law - amended in 2026 by the Digital Omnibus.

In force since 1 Aug 2024

Directly applicable - no national transposition. Member States still name authorities and set penalties.

Risk-based by design

Obligations scale with risk to health, safety and fundamental rights.

Extraterritorial reach

Applies to non-EU companies if the output is used by people in the EU.

Goal: trustworthy, human-centric AI - without blocking innovation.

5 of 23

SPR.lv

The four risk tiers

⊘ Unacceptable

Banned - since 2 Feb 2025

Social scoring · manipulative techniques · emotion recognition at work or school · untargeted face scraping · real-time biometric ID in public by law enforcement (narrow exceptions)

NEW from 2 Dec 2026: AI-generated non-consensual intimate imagery and CSAM

▲ High risk

Annex III: 2 Dec 2027

Annex I: 2 Aug 2028

Annex III: CV screening and HR selection · credit scoring · critical infrastructure · employee monitoring · biometric categorisation

Annex I (embedded in regulated products): medical devices · machinery · vehicles

● Limited risk

Transparency - since 2 Aug 2026 (Art. 50)

Chatbots must disclose they are AI · deepfakes and AI-generated content must be labelled

Systems on the market before 2 Aug 2026 have until 2 Dec 2026 for machine-readable marking

✓ Minimal risk

No mandatory obligations

Spam filters · AI in video games · entertainment recommenders · voluntary codes of conduct encouraged

6 of 23

SPR.lv

Who the Act applies to

The whole chain

Anyone who develops, deploys, sells, imports, distributes or uses AI systems touching the EU market.

Location is irrelevant

Based entirely outside the EU? Still in scope if your system's output reaches people in the EU.

Quietly in scope

Many companies are caught simply because they sell to or serve clients in other EU countries.

Art. 4 AI literacy still applies to every organisation, any tier - but since 27 July 2026 it is a duty to take measures to support literacy, not to guarantee it.

7 of 23

SPR.lv

Provider vs. deployer

PROVIDER

Art. 3(3) · obligations under Art. 16

Develops an AI system, or has one developed, and places it on the market under its own name or brand.

Risk management · data governance · technical documentation · logging · human-oversight design · accuracy and robustness · cybersecurity · conformity assessment and CE marking · EU database registration · post-market monitoring · incident reporting

DEPLOYER

Art. 3(4) · obligations under Art. 26

Uses an AI system under its own authority in a professional context. Personal, non-professional use is excluded.

Use per instructions · assign human oversight · monitor operation · keep logs for at least 6 months · inform affected people · inform employees before deploying monitoring · fundamental-rights impact assessment under Art. 27 where required

The Article 25 trap: rebrand or substantially modify someone else's AI system and you become the provider.

Most companies are both at once - provider for what they build, deployer for the tools they use. Decide the role per system, not per company.

This is the distinction people get wrong most often. A provider develops a system and puts it on the market under its own name - the heavy Article 16 set: risk management, technical documentation, logging, human-oversight design, cybersecurity, conformity assessment, CE marking, registration, post-market monitoring. A deployer uses a system under its own authority professionally; private use at home is out of scope. Article 26 is lighter: follow instructions, assign oversight, monitor, keep logs six months, inform affected people. Where a fundamental-rights impact assessment is required, that's Article 27, a separate provision. Now the trap: Article 25. Put your brand on someone else's system, or substantially modify it, and you become the provider. Decide it per system, never per company.

8 of 23

SPR.lv

General-purpose AI (GPAI)

10²⁵

FLOPs

The Art. 51 systemic-risk threshold, unchanged by the Omnibus. Above it, Art. 55 adds adversarial testing, incident reporting to the AI Office and cybersecurity duties.

You are the deployer, not the provider

Using ChatGPT, Claude, Gemini or Copilot at work makes you a deployer of a GPAI-based AI system - not a provider of the model.

Model providers carry Art. 53

Since 2 Aug 2025: technical documentation, a training-data summary and a copyright-compliance policy.

The AI Office now supervises directly

Since 2 Aug 2026 it has exclusive competence over GPAI-based systems from the same provider, with inspection powers and periodic penalties up to 5% of daily turnover.

Your risk tier follows your use case - not the tool's name.

9 of 23

SPR.lv

Key enforcement dates

ALREADY IN FORCE

1 Aug 2024

Act enters into force

2 Feb 2025

Prohibited practices banned · AI-literacy duty

2 Aug 2025

GPAI model duties (Art. 53/55) · penalty rules

2 Aug 2026

Art. 50 transparency · AI Office enforcement powers

STILL AHEAD

2 Dec 2026

New Art. 5 bans (NCII, CSAM) · marking of pre-Aug-2026 generative systems

2 Aug 2027

Legacy GPAI models · national sandboxes operational

2 Dec 2027

Annex III high-risk regime - the main deadline

2 Aug 2028

Annex I high-risk embedded in regulated products

2 Aug 2030

Legacy public-sector high-risk systems

Fines (Art. 99)

€35M / 7%

prohibited practices

€15M / 3%

high-risk or transparency

€7.5M / 1%

misleading an authority

SMEs, start-ups and now small mid-caps (< 750 staff, turnover ≤ €150M) pay whichever amount is lower.

The dates, and this is the slide that changed. On the left, what already binds you. February 2025: prohibited practices and AI literacy. August 2025: GPAI model duties and penalty rules. This month: Article 50 transparency and the AI Office's enforcement powers. On the right, what's coming. December brings the two new prohibitions and the marking deadline for generative systems already on the market. August 2027 covers legacy GPAI models and sandboxes. Then the big one: 2 December 2027 for the Annex III high-risk regime - that used to be August 2026. August 2028 for embedded products, 2030 for legacy public-sector systems. Penalties: thirty-five million or seven percent for prohibited practices, fifteen million or three percent for high-risk and transparency. SMEs, start-ups and now small mid-caps pay whichever is lower.

10 of 23

SPR.lv

Three practical first steps

1

Inventory

& classify

List every AI system in use - including shadow AI like unofficial ChatGPT accounts. For each one, fix your role (provider or deployer) and its risk tier.

2

Support

AI literacy

Offer Art. 4 training and keep a record. Since 27 July 2026 this is a duty to take reasonable measures, not to guarantee competence - but you still have to show you took them.

3

Stand up

governance

Assign a named human overseer, keep a simple incident and decision log, and confirm no current use case touches the Art. 5 prohibited list - including the new Dec 2026 bans.

11 of 23

SPR.lv

“

The Omnibus bought you sixteen months on high-risk - it did not pause anything else.

Prohibitions, Art. 50 transparency and the AI Office's powers are live today. Your next real deadline is 2 December 2026.

And the principle underneath it all is unchanged: obligations follow use, not hype.

12 of 23

SPR.lv

★

Let's talk EU AI Act compliance

Sergejs Ponomarjovs

Chief AI Officer, SPR.lv

More information: euaiact.lv

Connect on LinkedIn

linkedin.com/in/sergejsponomarjovs

13 of 23

SPR.lv

AUDIENCE Q&A 1 / 10

What can - and can't - you put into public LLMs like Copilot?

1

Don't feed in unpublished research, confidential interviews, trade secrets, or third-party material.

2

This applies even to information that isn't "personal data" under GDPR.

3

Transcribing a confidential interview may be possible - but only with a governed, licensed setup, not by default.

14 of 23

SPR.lv

AUDIENCE Q&A 2 / 10

Could AI development become a regulated industry, like defense manufacturing?

1

Partly already true: systemic-risk GPAI models face mandatory safety testing and incident reporting under Art. 55.

2

Since 2 Aug 2026 the AI Office has direct inspection powers and can levy periodic penalties up to 5% of daily turnover.

3

No full defense-style licensing regime exists yet, but the direction of travel is toward tighter control.

15 of 23

SPR.lv

AUDIENCE Q&A 3 / 10

What obligations do content creators have when using AI?

1

Private, non-commercial AI use generally falls outside the Act's scope.

2

Realistic AI-generated images, audio, or video - including deepfakes - must be labelled. Art. 50 has applied since 2 Aug 2026.

3

Systems already on the market before 2 Aug 2026 have until 2 Dec 2026 to add machine-readable marking.

This doesn't apply automatically to every social media user - purely private, non-commercial use is generally outside scope. But an influencer creating content professionally or commercially can face broader requirements. If you publish an image, audio, or video that's fully or substantially AI-generated and looks authentic, imitating a real person, event, or object, it must be clearly labelled. Article 50 has been live since the second of August this year. One nuance worth knowing: providers of generative systems that were already on the market before that date got a four-month transitional period, so their machine-readable marking obligation bites on the second of December. If AI is only used for translation, spelling, or editing and a person reviews and takes responsibility, labelling usually isn't required - though platform rules can be stricter.

16 of 23

SPR.lv

AUDIENCE Q&A 4 / 10

Can employees use personal AI accounts, or must they use a company-approved tool?

1

Low-risk tasks: a personal account may be acceptable if policy allows it and no confidential or personal data goes in.

2

High-risk use (HR screening, credit scoring): a personal account is not acceptable.

3

Safer default either way: a company-approved tool and account.

17 of 23

SPR.lv

AUDIENCE Q&A 5 / 10

How do companies manage AI account governance and oversight in practice?

1

Not every employee needs an Enterprise-tier license.

2

Common controls: an approved-tool list, company accounts, access rights, data-protection settings, periodic usage review.

3

Detailed, request-by-request logging is mainly needed for high-risk use cases.

18 of 23

SPR.lv

AUDIENCE Q&A 6 / 10

Is an internal policy plus staff training enough control - or is more needed?

1

Low-risk use: policy and training can be the main control, alongside basic access and data safeguards.

2

High-risk use: policy and training alone are not enough.

3

High-risk needs centralized governance, human oversight, testing, and logs - responsibility can't just sit with the employee.

19 of 23

SPR.lv

AUDIENCE Q&A 7 / 10

What does "defining allowed and forbidden AI uses" actually mean in practice?

1

A clear, written line on which tasks staff may - or may not - hand to AI.

2

Reference points: AI Act compliance, data protection, IP and copyright risk, impact on people and reputation, keeping human review.

3

Example: allow idea generation and public-info summaries; forbid entering client data or using AI as the sole basis for a legal, financial, or HR decision.

20 of 23

SPR.lv

AUDIENCE Q&A 8 / 10

Is effective AI-usage control - like plagiarism detection - even possible today?

1

Effective control is possible, but rarely with a single technical tool.

2

Automated AI-content and plagiarism detectors are not fully reliable - both false positives and false negatives happen.

3

Combine technical checks with policy, training, and human review.

21 of 23

SPR.lv

AUDIENCE Q&A 9 / 10

If HR uses AI to assess emotional resilience or confidence in interviews, is that prohibited?

1

Depends on what the system technically does, not on the HR use case alone.

2

Analyzing facial expression, voice tone, or body language for emotion risks the Art. 5 workplace emotion-recognition ban - in force since 2 Feb 2025.

3

Assessing answer content or competency, with no biometric analysis, is more likely Annex III high-risk - those duties apply from 2 Dec 2027.

This can fall into prohibited-practice territory, but the answer depends on what the system technically does. Article 5 bans emotion-recognition systems in the workplace, and that has been in force since February 2025 - it was not deferred. If an AI system analyzes biometric signals in an interview, facial expressions, voice tone, body language, to infer a candidate's emotional state, there's a real risk that qualifies as prohibited. If the system instead evaluates the content of answers, relevant experience, or competency indicators, with no biometric analysis, it's more likely Annex III high-risk HR selection - and those obligations now apply from 2 December 2027 rather than August 2026. Before deploying a tool like this, get a detailed technical explanation from the vendor and run a risk-classification assessment with legal and technical input.

22 of 23

SPR.lv

AUDIENCE Q&A 10 / 10

What's the real difference between an AI model and an AI system?

1

Model = the technological "engine" that generates predictions, text, or recommendations from training data.

2

System = the model plus software, data, user interface, access rights, and the business process around it.

3

It matters legally: provider and deployer duties attach to the system; Art. 53/55 duties attach to the model.

Simply put, an AI model is the technological engine - based on its training data, it generates predictions, recommendations, or content. An AI system is the broader solution: the model combined with software, data, a user interface, access rights, and a concrete business process built around it. A language model on its own is a model; a recruitment platform that uses it to evaluate candidates is an AI system. This isn't just semantics - the Act attaches provider and deployer duties to systems, while the Article 53 and 55 documentation and systemic-risk duties attach to models. What matters most for a business leader is the purpose, the process, and the impact: what data it uses, what results it produces, whether those results affect people, who's responsible, and whether you're only a user or have adapted and offered it under your own name.

23 of 23

SPR.lv

Sources & further reading

Regulation (EU) 2024/1689

The EU AI Act - eur-lex.europa.eu/eli/reg/2024/1689/oj

Regulation (EU) 2026/1744

Digital Omnibus on AI - OJ 24 Jul 2026, in force 27 Jul 2026 - eur-lex.europa.eu/eli/reg/2026/1744

Commission Recommendation (EU) 2025/1099

Definition of small mid-cap enterprises - eur-lex.europa.eu/eli/reco/2025/1099/oj

European Commission - AI Office

digital-strategy.ec.europa.eu/en/policies/ai-office

SPR.lv EU AI Act microsite

spr.lv/eu-ai-act · euaiact.lv