The EU AI Act, as things to tick off.

Confirm you are not doing any of these. They are banned outright.

• We do not score or rank people by trustworthiness or social behaviour.
• We do not use AI to infer the emotions of staff or students, outside narrow safety or medical exceptions.
• We do not categorise people by sensitive traits (race, beliefs, and similar) from their biometrics.
• We do not use subliminal or manipulative techniques that distort people's decisions.
• We do not scrape facial images in an untargeted way to build recognition databases.
• We do not generate non-consensual intimate imagery or child sexual abuse material (banned from December 2026).

If you use high-risk AI (hiring, credit, insurance, biometrics, essential services), these are the deployer duties. The deadline moved, so prepare now.

• We use each system in line with the provider's instructions for use.
• We assign human oversight to people who are competent, trained, and authorised.
• We ensure input data is relevant and representative where we control it.
• We monitor operation and report serious incidents to the provider within 15 days.
• We keep the system's automatically generated logs for at least six months.
• We inform workers and their representatives before using the system in the workplace.
• We tell people when a high-risk system makes or supports a decision about them.
• We run a fundamental rights impact assessment where it is required (Article 27).
• We cooperate with the competent authorities on request.

These apply this August if you interact with people through AI or publish AI-generated content.

• We tell users when they are interacting with an AI system, such as a chatbot or assistant.
• We mark AI-generated audio, image, video, and text as artificially generated.
• We disclose deepfakes and manipulated media that look or sound real.
• We inform people who are exposed to emotion recognition or biometric categorisation.

A duty for every organization that uses AI, softened by the Omnibus to a duty to support and promote literacy with proportionate measures.

• Staff who use AI have a level of understanding suited to their role.
• People understand the basics: what the tools can and cannot do, and their limits.
• We have a simple acceptable-use guide for public AI tools.
• We keep a light record of the literacy measures we took.

The exposures that do not wait for a deadline: what people write, and what they paste into public AI tools. This is the layer VerbaPulse works on.

• We define what may and may not be pasted into public AI tools.
• We give guidance in the moment, not only in an annual policy.
• We have department-level visibility into AI tool use, without surveilling individuals.
• We catch confidential and regulated language in messages before they send.