If your company uses AI in its operations, before classifying anything there's an earlier question worth answering — and it's the one almost nobody asks explicitly: does the Regulation even apply to me?
It's in Article 2, which, after Regulation (EU) 2026/1744, has thirteen paragraphs. The first says who it reaches; the remaining twelve exclude, narrow or preserve other rules. And among them there are three exclusions that get cited as a free pass, and aren't.
The short answer, for a company in the EU
Article 2(1) lists seven categories of subject. The one that affects you is this:
"(b) deployers of AI systems that have their place of establishment or are located within the Union".
Nothing more. There's no size threshold, no turnover threshold, no sector, no minimum number of systems. If your organisation is in the EU and uses AI under its authority, you're in scope.
One other subject deserves a mention, because it's surprising: letter (c) reaches providers and deployers located in third countries "where the output produced by the AI system is used in the Union". The Regulation doesn't stop at who is here — it extends to what is used here.
The three exclusions that get cited wrong
"It's open source"
Article 2(12) excludes systems released under free and open-source licences. But read it in full:
"…unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50."
Three exceptions to the exclusion. In other words: an open-source licence doesn't protect you in high risk, doesn't protect you against the prohibited practices, and doesn't protect you against transparency. Exactly the three places where someone would want to rely on it.
And there's a nuance that gets lost: the exclusion looks at how the model is released, not how you use it. If you deploy an open model in a high-risk use case, your obligations as the deploying company are the same as with a closed one.
"It's research"
There are two paragraphs on this, and they shouldn't be mixed up.
2(6) excludes AI systems or AI models, including their output, "specifically developed and put into service for the sole purpose of scientific research and development". The word that decides is "sole".
2(8) excludes research, testing or development activity prior to being placed on the market or put into service, which must be conducted in accordance with applicable Union law. And it ends with a line that's rarely quoted:
"Testing in real world conditions shall not be covered by that exclusion."
So an internal pilot with real data and real users is not excluded by that paragraph: if the system has already been placed on the market or put into service, the exclusion doesn't apply, and if it hasn't yet, testing in real-world conditions is expressly left out of it. The exclusion covers development, not testing against reality.
"Everyone uses it on their own"
2(10) excludes the obligations of deployers "who are natural persons using AI systems in the course of a purely personal non-professional activity".
Two cumulative conditions, and both fail in the case people try to shelter under: someone on your team using an AI tool for their job is not engaged in a personal non-professional activity, and the organisation remains the deployer. The exclusion is for domestic use, not for individual use inside a company.
The exclusions that actually are clean
Two, and a private company doesn't usually get any use out of them.
National security, defence and military purposes — Article 2(3), worded very broadly: "with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity." It also reaches AI systems which are not placed on the market or put into service in the Union, where the output is used in the Union exclusively for those purposes.
Public authorities of third countries and international organisations using AI systems in the framework of international cooperation or agreements for law enforcement and judicial cooperation with the Union or with one or more Member States — Article 2(4), provided that the third country or international organisation provides adequate safeguards with respect to the protection of fundamental rights and freedoms of individuals.
And one narrowing that isn't an exclusion but looks like one: for AI systems classified as high-risk under Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I — among them civil aviation security, motor vehicles, marine equipment and rail interoperability — only Article 6(1), Article 60a and Articles 102 to 112 apply; Articles 57, 58 and 59 apply only in so far as the Regulation's high-risk requirements have been integrated in that legislation (Article 2(2), as amended by Regulation (EU) 2026/1744).
What the article makes clear and people tend to forget
Three paragraphs that exclude nothing, but that put the rest of the map in order.
The GDPR still applies. Article 2(7), as amended by Regulation (EU) 2026/1744, says so expressly: without prejudice to its Articles 4a and 59, the Regulation "shall not affect" Regulation (EU) 2016/679. There's no substitution, no overlap that resolves anything — they're two legal frameworks that coexist.
Consumer protection and product safety rules don't fall away either — Article 2(9).
And more favourable labour protections are preserved — Article 2(11), which expressly preserves the possibility of laws, regulations, administrative provisions or collective agreements more favourable to workers regarding employers' use of AI systems. Relevant in Spain, where the works council already has the right to be informed of the parameters, rules and instructions on which algorithms or AI systems are based when they affect decisions that may bear on working conditions and on access to and retention of employment (Article 64(4)(d) of the Spanish Workers' Statute), without waiting for the AI Act.
What this means in practice
That the question "does it apply to me?" has a boring answer — yes — and that the useful question is a different one: what applies to you.
And there the split is very uneven: Article 4 and Article 5 reach everyone from 2 February 2025 — except points (ba) and (bb) of Article 5(1), which apply from 2 December 2026; the high-risk regime only reaches those using high-risk systems, and not before 2 December 2027. Almost everything a company needs to decide sits between those two things.
So looking for an exclusion is usually wasted effort, and asking the right question costs less: what systems you have and what each one does.
Content in line with Articles 2, 4 and 5 and Annex III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026).
This article is for informational purposes only and does not constitute legal advice.