The EU AI Act: what matters for business in 2026
Since 2 August 2026 the AI Act's transparency obligations apply, while high-risk requirements have been pushed to 2027–2028. What that actually means for a company using an AI assistant or automation.
The EU Artificial Intelligence Act (Regulation 2024/1689) entered into force on 1 August 2024 and applies in stages. 2 August 2026 was the key date: from then the transparency obligations apply and the supervision and penalty mechanism is live.
At the same time, the “Digital Omnibus on AI” (Regulation 2026/1744), in force since 27 July 2026, postponed high-risk system requirements: Annex III cases to 2 December 2027, and AI embedded in regulated products to 2 August 2028.
The key dates
Four are worth remembering:
- 2 February 2025 — prohibited practices and AI literacy provisions.
- 2 August 2025 — obligations for general-purpose AI model providers, national authorities.
- 2 August 2026 — Article 50 transparency obligations and the start of enforcement.
- 2 December 2027 and 2 August 2028 — requirements for high-risk systems.
What it means for an ordinary company
Most business automations — customer replies, proposal drafting, CRM updates — do not fall into the high-risk category. For them the transparency rules matter, not certification procedures.
- A person must know they are interacting with artificial intelligence rather than an employee.
- Artificially generated or edited content must be labelled accordingly.
- Employees working with AI need at least basic training — that is the AI literacy requirement.
- It must be clear who in the company is responsible for the system and how a human can stop it or correct a mistake.
When to be more careful
The high-risk list covers, for example, AI used in recruitment, credit scoring or decisions about access to essential services. If you plan such a use case, the requirements are serious — documentation, risk management, human oversight, data quality — and worth planning ahead, even though the deadline moved to December 2027.
The AI Act and GDPR are not the same thing
The AI Act regulates the system and its risk; GDPR regulates the personal data it processes. If your automation touches customer data, you need a lawful basis, clear information in the privacy policy and a data processing agreement with the provider.
What to do this month
Make a list of where AI is already used in the company (there is often more than you think), mark which customer touchpoints run through AI, and add the corresponding notice to your website and to the start of conversations. That is the cheapest and fastest compliance step.
This article is general information, not legal advice. For a specific case, consult a lawyer.
Sources
Want to automate your business processes?
Book a free 30-minute AI strategy session and we will show you what can be automated in your business this month.
Get a free consultation