EU AI Act Compliance: What Businesses Must Do in 2026

EU AI Act compliance stopped being a future project some time ago: the prohibitions and the AI literacy duty have applied since February 2025, and the transparency rules since 2 August 2026. At the same time, the July 2026 "AI Omnibus" pushed the high-risk rules back, so many headlines written before the summer are now wrong. This guide sorts out, as of 31 October 2026, what a business that uses AI tools must do now, what comes later and what is still only a proposal.

This article is general information, not legal advice. It is based on the text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, checked on 31 October 2026. For decisions with legal consequences, talk to a qualified lawyer in your jurisdiction.

Start with your role: provider or deployer?

Almost every obligation in the AI Act is attached to a role, so the first question is not "is our AI risky?" but "what are we, for this system?". Article 3 defines the two roles that matter:

• A provider develops an AI system or a general-purpose AI model (or has one developed) and places it on the market or puts it into service under its own name or trademark (Article 3(3)).
• A deployer is anyone "using an AI system under its authority", except for personal, non-professional use (Article 3(4)).

A company that buys seats on an AI assistant, uses an AI feature in its CRM or runs a vendor's screening tool in HR is a deployer, and that is the reader this guide is written for. But the line moves more easily than people expect. If you build a customer-facing assistant on a model API and put it into service under your own brand, you may well be the provider of that system. And under Article 25, a deployer becomes the provider of a high-risk system if it puts its name on one, substantially modifies one, or changes the intended purpose of a non-high-risk system (a general chatbot repurposed to rank job applicants, say) so that it becomes high-risk.

So record the role per system, not per company. Mapping roles, risk tiers and the GDPR duties that run alongside them, system by system, is the core of AI Data Privacy and EU AI Act Compliance for Professionals; this guide gives you the map.

Where the timeline stands on 31 October 2026

The AI Act entered into force on 1 August 2024 and phases in under Article 113. Regulation (EU) 2026/1744, the "Digital Omnibus on AI", published in the Official Journal on 24 July 2026 and in force since 27 July 2026, changed several of the dates:

Three points are easy to get wrong:

1. Article 50 was not postponed. The Omnibus moved the high-risk dates, not the transparency rules. The only relief is for providers of generative systems placed on the market before 2 August 2026, who have until 2 December 2026 to apply machine-readable marking under Article 50(2).
2. The new high-risk dates are law, not a proposal. The Commission proposed the AI Omnibus on 19 November 2025, a political agreement followed on 7 May 2026, and the amended Article 113 now applies Chapter III, Sections 1 to 3 from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
3. The wider "Digital Omnibus" is still a proposal. The separate package that would amend the GDPR and other data rules (procedure 2025/0360(COD)) was still awaiting a committee decision in the European Parliament at the time of writing. Do not plan around GDPR changes that have not been adopted.

The Commission's AI Act policy page keeps the timeline and implementation documents up to date and is the place to check for later changes.

The risk tiers, translated for business

For a deployer, the familiar risk pyramid works best as four questions asked about every AI use:

• Is it prohibited? Article 5 bans a short list of practices outright: there is no compliance path, only "stop".
• Is it high-risk? Annex III uses and safety components of Annex I products carry the heaviest duties, from December 2027 and August 2028.
• Does it trigger transparency? Deepfakes, some AI-generated text, emotion recognition and chatbots require telling people, whatever the tier.
• Everything else is minimal risk: most drafting, summarizing and coding assistance, still covered by the literacy duty and, for personal data, by the GDPR.

General-purpose AI models sit on a separate track that binds the model providers.

What already applies to every business using AI

Prohibited practices (Article 5)

The prohibitions have applied since 2 February 2025 and carry the highest fines. Several are directly relevant to ordinary companies. Article 5(1) bans, among others:

• subliminal, manipulative or deceptive techniques that materially distort behavior and cause, or are reasonably likely to cause, significant harm (point (a));
• exploiting vulnerabilities due to age, disability or a specific social or economic situation, with the same effect (point (b));
• social scoring leading to unjustified or unrelated detrimental treatment (point (c));
• building facial recognition databases by untargeted scraping of facial images from the internet or CCTV (point (e));
• inferring the emotions of people in the workplace or in education institutions, except for medical or safety reasons (point (f));
• biometric categorization to infer race, political opinions, trade union membership, religion or beliefs, sex life or sexual orientation (point (g)).

Point (f) is the one HR and operations teams most often trip over: an "engagement" or "sentiment" feature that reads employees' faces or voices can fall squarely into it. Check vendor feature lists, not just product names.

From 2 December 2026, the Omnibus adds two prohibitions: AI that generates or manipulates realistic intimate or sexually explicit material of an identifiable person without their explicit consent, and AI that generates child sexual abuse material. For deployers, the use is prohibited where the system is used for the purpose of generating such material (new Article 5(1a)(b)).

AI literacy (Article 4), as amended

The literacy duty has applied since 2 February 2025, but its wording changed on 27 July 2026. The original text required a "sufficient level of AI literacy". Amended Article 4(1) now says providers and deployers "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", and adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual."

That is a softer duty, not a repealed one. It still covers "other persons" acting on your behalf (the Commission gives a contractor, a service provider or a client as examples) and still has to fit people's knowledge, the context of use and the people affected. The Commission's AI literacy Q&A, updated on 20 October 2026 to reflect the amendment, adds that no certificate is needed, no specific governance structure (such as an "AI officer") is mandated, and organizations can keep an internal record of the training and guidance they provide.

In practice, "measures to support" means role-based training: the people who approve AI-assisted hiring or credit decisions need more than the people using a writing assistant. If you need to make the internal case for the budget, the argument in The ROI of AI Upskilling applies here too: the training that satisfies Article 4 is the same training that makes the tools useful.

Transparency (Article 50)

Article 50 has applied since 2 August 2026 and splits the duties:

• Providers must make sure people are informed when they interact with an AI system, unless that is obvious from the context (Article 50(1)), and must mark synthetic outputs (audio, images, moving images and text) in a machine-readable, detectable way (Article 50(2)).
• Deployers of an emotion recognition or biometric categorization system must inform the people exposed to it (Article 50(3)).
• Deployers of a system that generates or manipulates a deepfake (image, audio or moving-image content that would falsely appear authentic) must disclose that it is artificially generated or manipulated. For evidently artistic, satirical or fictional work, the duty shrinks to disclosing the existence of such content without spoiling the work (Article 50(4)).
• Deployers that publish AI-generated text to inform the public on matters of public interest must disclose it, unless it has undergone human review or editorial control and someone holds editorial responsibility (Article 50(4), second subparagraph).

The information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure" (Article 50(5)). For a typical company: does our assistant say it is an AI (if we built it, that is probably our job), do we use synthetic people or voices that resemble real ones, and does AI-written public-interest content have an accountable editor? In July 2026 the Commission published guidelines on these obligations and its assessment of a voluntary Code of Practice on marking and labelling AI-generated content, which includes icons deployers can use for disclosure.

General-purpose AI models (Chapter V)

Since 2 August 2025, GPAI model providers have had to keep technical documentation and inform downstream providers; models placed on the market before that date have until 2 August 2027 (Article 111(3)). These are not deployer duties. Your interest is indirect: if you build on a model, Article 53(1)(b) requires its provider to give you documentation on its capabilities and limitations. Ask for it and file it with your system record.

What applies later: high-risk AI

Is any of your AI high-risk?

Annex III lists the areas where an AI system is presumed high-risk. Those that reach ordinary businesses:

• Employment (point 4): recruitment and selection, including targeted job ads, filtering applications and evaluating candidates; decisions on promotion, termination or task allocation; monitoring and evaluating performance.
• Credit and insurance (point 5(b) and (c)): credit scoring of natural persons (fraud detection excepted), and risk assessment and pricing in life and health insurance.
• Education and training (point 3): admission, evaluating learning outcomes, assigning levels and proctoring tests.
• Biometrics (point 1) and critical infrastructure (point 2).

Article 6(3) lets an Annex III system escape the label if it poses no significant risk of harm, for example because it only performs a narrow procedural or preparatory task. A system that performs profiling of natural persons is always high-risk. HR is where most companies meet this tier first; running recruitment and onboarding tools inside these limits is the subject of AI for HR: Recruiting, Onboarding and L&D, Done Compliantly.

Deployer duties from 2 December 2027 (Article 26)

From the Annex III date, deployers of high-risk systems must, among other things:

1. use the system according to the provider's instructions for use (Article 26(1));
2. assign human oversight to people with the necessary competence, training, authority and support (Article 26(2));
3. ensure input data under their control is relevant and sufficiently representative (Article 26(4));
4. monitor operation, suspend use and inform the provider and the authority if the system presents a risk, and report serious incidents (Article 26(5));
5. keep the logs under their control for at least six months, unless other law provides otherwise (Article 26(6));
6. inform workers' representatives and affected workers before using a high-risk system at the workplace (Article 26(7));
7. use the provider's information for the GDPR data protection impact assessment (DPIA) where one is required (Article 26(9));
8. inform people that they are subject to a high-risk system that makes, or assists in making, decisions about them (Article 26(11)).

Article 27 adds a fundamental rights impact assessment before first use for public bodies, private entities providing public services, and deployers of credit-scoring and life or health insurance pricing systems. Since the Omnibus, it can cross-reference an existing DPIA instead of repeating it (amended Article 27(4)).

Annex I systems (AI in products such as medical devices, toys or lifts) follow from 2 August 2028. The amended Article 111(2) also has a transitional rule for high-risk systems already on the market before these dates; whether it covers a given tool depends on facts only the provider knows, so ask in writing. And do not wait: HR and credit contracts signed today will still run in December 2027.

Penalties and who enforces them

Article 99 sets maximum fines in three bands: up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices; up to €15 million or 3% for other listed obligations, including the deployer duties in Article 26 and the transparency duties in Article 50; and up to €7.5 million or 1% for supplying incorrect or misleading information to authorities. For SMEs and start-ups, each fine is capped at whichever amount is lower, and the Omnibus extends that rule to small mid-cap enterprises for the second and third bands.

Enforcement is mostly national: each Member State designates market surveillance authorities and sets penalty rules within these limits. The Commission's AI Office supervises GPAI model providers and, since the Omnibus, certain AI systems built on a GPAI model by the same provider.

A practical EU AI Act checklist for deployers

Now (already applicable)

1. Build an AI inventory. Every AI system and AI feature in use, including those inside SaaS tools, with vendor, business owner, purpose, data touched and your role.
2. Screen for prohibited practices. Especially emotion inference on staff or students and manipulative designs in customer journeys. Disable anything that matches.
3. Run an AI literacy program. Role-based, proportionate to risk, covering staff and the contractors or service providers who operate AI on your behalf, with an internal record of what was delivered.
4. Fix transparency touchpoints. Assistants that identify themselves as AI, labeled deepfakes, and an accountable editor (or a disclosure) for AI-written public-interest content.
5. Write an AI use policy. Approved tools, what data may go into them, who reviews outputs before they reach customers.
6. Keep the GDPR in the same workflow. Lawful basis, DPIAs and the rules on solely automated decisions apply today, whatever the AI Act dates.

Before 2 December 2026

7. Check content tools against the new prohibitions and say so in your acceptable-use rules.
8. Ask generative AI vendors about marking, and make sure your workflows do not strip it.

Before 2 December 2027

9. Classify Annex III candidates, HR, credit, insurance and education first, and document why each is or is not high-risk.
10. Fix your contracts: instructions for use, documentation, log access, incident cooperation and a clear statement of who the provider is.
11. Design human oversight: named people with the authority to override or stop the system, and the training to do it.
12. Prepare worker information and impact assessments, including a fundamental rights impact assessment if Article 27 applies to you.

For the governance side (who owns this list and how it reaches the board), see AI for Business Leaders: A Practical Playbook.

Frequently Asked Questions (FAQ)

Does the EU AI Act apply to a company that only uses ChatGPT, Copilot or similar tools? Yes, as a deployer. For ordinary productivity use, the duties today are AI literacy, avoiding prohibited practices and the Article 50 transparency rules where they are triggered, for example when publishing deepfakes. The high-risk duties arise only if a tool is used for an Annex III purpose, such as screening job applicants.

Were the high-risk obligations postponed? Yes. Regulation (EU) 2026/1744, in force since 27 July 2026, moved them to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. That is adopted law. The Article 50 transparency rules were not postponed and have applied since 2 August 2026.

Do our employees need an AI Act certificate? No. The Commission's AI literacy Q&A states that no certificate is needed. The amended Article 4 requires measures to support AI literacy, adapted to roles and context, not a guaranteed level for each person. An internal record of training is a sensible way to show what you did.

Does the AI Act apply to companies outside the EU? It can. Article 2 covers providers placing AI systems on the EU market wherever they are established, deployers established in the EU, and providers and deployers outside the EU where the output of the AI system is used in the Union. A UK or US company whose AI-driven service reaches people in the EU should map its exposure.

Conclusion

For a business that uses AI rather than builds models, EU AI Act compliance in late 2026 comes down to three duties that already apply (no prohibited practices, real AI literacy measures, Article 50 transparency), one near-term date (2 December 2026) and a high-risk regime now set for December 2027 and August 2028. The companies that meet those dates calmly will be the ones that build the inventory, fix vendor contracts and train their people now.

This article is general information, not legal advice. Dates and article numbers were checked against the Official Journal text on 31 October 2026; check the Commission's pages for later changes.

Sources

• Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the European Union, 12 July 2024
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, 24 July 2026
• AI Act: regulatory framework and implementation timeline, European Commission
• AI literacy: questions and answers, European Commission, updated 20 October 2026