EU AI Act: what applies to businesses

EU AI Act: what already applies, what has been postponed to 2027 or 2028, and how to take stock of the AI tools used in your business.

Since August 2, 2026, the EU AI Act (Regulation (EU) 2024/1689) has applied for the most part. It is often described as “postponed”. That is only partly true: the delay adopted in July 2026 covers so-called “high-risk” uses, not the bans or the transparency rules, which require disclosing the use of AI. Here is where things stand on October 21, 2026.

What the EU AI Act requires, date by date

Since February 2, 2025: certain practices are banned, such as social scoring, manipulating people without their knowledge (subliminal techniques) or inferring emotions in the workplace, except for medical or safety reasons. Providers and professional users of AI tools also take measures so that their staff use these tools with proper understanding (“AI literacy”, Article 4).
Since August 2, 2025: rules on “general-purpose” AI models (capable of a wide variety of tasks), which apply to their providers and not to companies that simply use them; penalties apply.
Since August 2, 2026: transparency obligations (Article 50).
December 2, 2026: new ban on tools that generate realistic intimate or sexually explicit content of an identifiable person without their consent, as well as child sexual abuse material.
December 2, 2027, instead of August 2, 2026: obligations for the high-risk uses listed in Annex III (recruitment, staff management, creditworthiness of individuals, education, etc.).
August 2, 2028: obligations for AI tools built into regulated products as safety components (Annex I: toys, elevators, medical devices, for example).

These dates, taken from the European Commission’s official timeline, include a revision the Commission proposed on November 19, 2025 in a simplification package called the “digital omnibus”. This revision became Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24, which entered into force on July 27, 2026. It also relaxed the AI literacy requirement and extended to “small mid-cap enterprises”, slightly larger than SMEs, some of the relief reserved for SMEs that develop high-risk tools: simplified technical documentation and a proportionate quality management system.

Transparency has not been postponed. Only the technical marking of generated content (a mark that software can read) has a grace period until December 2, 2026, for providers of generative tools placed on the market before August 2, 2026.

First step: list your AI tools

The text distinguishes the “provider”, which develops an AI tool or has it developed and places it on the market or puts it into service under its own name, from the “deployer”, which uses it under its own authority in a professional context. An SME that subscribes to a service available on the market is a deployer. If it has a custom assistant developed and puts it into service under its own brand, even for its own use, it may be considered a provider.

For each tool, note:

its actual use and the people affected;
who provides it, how you access it (subscription, existing software, custom development) and your role;
the data sent to it, especially personal or confidential data;
its risk level: prohibited, high-risk, subject to transparency or minimal.

Most everyday uses (drafting, summarizing, translation) generally fall under minimal risk, with no specific rules beyond AI literacy. Recruitment, employee evaluation or the creditworthiness of individuals, on the other hand, call for immediate attention.

Disclosing the use of AI: mandatory since August 2, 2026

Article 50 requires informing people:

a chatbot, or any tool designed to interact with people, must be designed so that people know they are dealing with an AI, unless this is clear from the context;
deepfakes, meaning images, audio or video produced or altered by AI that deceptively imitate real people, places or events, must be labeled as such;
text produced by AI and published to inform the public on matters of public interest must be labeled, unless it has undergone human review or editorial control, under a person’s editorial responsibility;
the use of a tool that recognizes emotions or classifies people based on their biometric data (facial features, for example) must be disclosed.

The information must be clear and given at the latest at the first interaction or first exposure. On July 20, 2026, the Commission published guidelines on these obligations; a code of practice on AI-generated content, which companies may sign up to voluntarily, was finalized in June 2026.

Personal data and contracts with your vendors

The AI Act does not affect the GDPR, which protects personal data and remains fully applicable. As soon as an AI tool processes such data, résumés for example, the usual rules apply: legal basis (a ground provided for by the GDPR), informing the people concerned, retention period, security. A data protection impact assessment (a prior study of the risks) is required if the processing is likely to result in a high risk to people (Article 35). Subject to exceptions, no one should be subject to a fully automated decision that significantly affects them (Article 22).

A vendor that processes data on your behalf is a “processor” (Article 28 of the GDPR): a contract must specify, among other things, the subject matter, duration and purpose of the processing. For an AI tool, also include clauses on:

whether or not your data is reused to train (improve) the provider’s models;
where data is hosted and any transfers outside the European Union;
who takes on which AI Act obligation, for example disclosing that a chatbot is an AI;
the documentation supplied, log retention (the history of operations) and reversibility (getting your data back to switch vendors).

A concrete example

Take, as an illustration, a 25-person trading SME.

Its writing assistant for quotes falls under minimal risk: a short usage rule (no sensitive customer data in a consumer tool, review before sending) and hands-on training help meet the AI literacy obligation.
Its order-tracking chatbot, developed for the company and put into service under its name, states from the first message that it is automated. The contract with the developer covers this notice, where the conversations are hosted, how long they are kept and a ban on reusing them.
Its planned tool for screening job applications is high-risk (Annex III). Its specific obligations will apply on December 2, 2027, but the GDPR already applies: check whether an impact assessment is needed, inform applicants, leave the final decision to a person. The company chooses a provider able to supply the required documentation.

Frequently asked questions

Has the AI Act been postponed?

Partly. The obligations for high-risk uses are pushed back to December 2, 2027 (Annex III) or August 2, 2028 (regulated products), not removed: risk management, technical documentation, human oversight, log retention. A tool placed on the market or put into service before these dates is only subject to them if its design later undergoes significant changes: a point to watch for a tool that is expected to evolve.

What fines could an SME face?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for the transparency obligations or those of deployers of high-risk tools. For an SME, the cap is the lower of the two amounts. Penalties must also take into account the economic viability of SMEs.

Do I have to train all my employees in AI?

The revised text asks companies to “encourage the development” of AI literacy through measures suited to people’s knowledge and the context of use, with no obligation to guarantee a specific level for each person. A written usage rule, hands-on training on the tools in use and a record of these actions form a reasonable basis. The Commission is due to publish practical examples, notably for SMEs.

411bit can inventory your uses of AI and the data that flows through them, review your contracts and processors from a technical standpoint as part of GDPR compliance work and, when it develops an assistant or an automation, build in transparency, logging and documentation from the design stage. Legal interpretation is handled with your legal counsel. You can describe your current uses to us: every request receives a reply within 24 business hours. See also securing your IT without holding back growth.