AutomateWisely Editorial Team · Last reviewed October 31, 2026 · How we research
Most explanations of the EU AI Act start with the law. It is quicker to start with your company. Three questions decide almost everything the regulation asks of you:
General information, not legal advice. For decisions about your obligations, speak to a qualified lawyer.
The risk pyramid in two minutes
- ProhibitedPractices treated as a clear threat to people’s rights. Banned since February 2, 2025.
- High riskAI in hiring, credit, education, essential services and safety parts of regulated products. Risk management, documentation, human oversight and more.
- TransparencyChatbots, deepfakes, emotion recognition, AI generated content. Disclose and label, from August 2, 2026.
- Minimal riskSpam filters, recommendations, drafting help, most office AI. No new legal duties beyond AI literacy.
What is banned outright
These practices have been prohibited since February 2025, wherever the system was built. Two new bans were added by the Omnibus.
If anything you use comes close to the emotion recognition ban, deal with it first. It is the one ordinary workplace tools sometimes drift into, for example “sentiment” scoring of employees on calls.
Two kinds of high risk AI
Stand alone AI used in listed areas: biometrics, critical infrastructure, education, employment and worker management, access to essential services (including credit scoring and life or health insurance pricing), law enforcement, migration, justice and elections.
AI that is a safety component of, or itself is, a product already covered by EU product safety law and needing third party conformity assessment, such as medical devices, machinery or toys.
An Annex III system can fall outside high risk if it only performs a narrow procedural task or does not materially influence a decision. Systems that profile people never qualify for that exception, and a provider that relies on it must document the assessment.
Transparency duties that already apply
Since August 2, 2026, Article 50 requires:
- People must be told they are dealing with an AI system, unless it is obvious. This is built in by the provider.
- Deepfakes must be labeled by the deployer that publishes them, with lighter rules for clearly artistic or satirical work.
- AI generated text published to inform the public on matters of public interest must be disclosed, unless a human reviewed it and takes editorial responsibility.
- People exposed to emotion recognition or biometric categorization must be informed.
- Generative AI outputs must be marked in a machine readable way. Systems already on the market before August 2, 2026 have until December 2, 2026.
What the AI Omnibus changed
The Omnibus was published in the Official Journal on July 24, 2026 and entered into force on July 27. It delays and softens; it does not repeal.
| Topic | Before | After the Omnibus |
|---|---|---|
| Annex III high risk | August 2, 2026 | December 2, 2027 |
| Annex I high risk | August 2, 2027 | August 2, 2028 |
| Marking of generated content, existing systems | August 2, 2026 | December 2, 2026 |
| AI literacy (Article 4) | Ensure sufficient literacy | Take measures to support literacy; no guaranteed level per person |
| Bias detection data | High risk systems only | Wider use where strictly necessary, under safeguards |
| Supervision | Mostly national authorities | AI Office supervises AI built on a provider’s own general purpose models and AI in very large platforms and search engines |
Unchanged: the bans already in force, the general purpose AI model rules, the penalty ceilings and the risk based structure. Relief for smaller companies (simplified documentation, proportionate quality management, lower fines) was extended to the EU’s new small mid-cap category.
Your AI Act calendar
Tick what applies to you. The tool builds a personal timeline and shows which dates have already passed.
Based on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Edge cases need legal review. Nothing you select is stored or sent.
Provider or deployer: who does what
Providers of high risk AI
The heaviest load- Risk management system across the life cycle
- Data governance and technical documentation
- Logging, accuracy, robustness and cybersecurity
- Human oversight designed into the system
- Quality management, conformity assessment, CE marking
- Registration in the EU database and post market monitoring
Deployers of high risk AI
Most businesses- Use the system as the provider’s instructions say
- Give oversight to people with the competence and authority to act
- Keep the logs under your control for at least six months
- Inform workers and their representatives before workplace use
- Tell people when a high risk system is used in decisions about them
- Run a fundamental rights impact assessment if you are a public body, provide public services, or use AI for credit scoring or life and health insurance pricing
A deployer that puts its own name on a high risk system, or substantially modifies it, can become a provider. General purpose model providers have had their own duties since August 2, 2025: technical documentation, information for downstream developers, a copyright policy and a public summary of training content. Models already on the market before then have until August 2, 2027.
What breaking the rules can cost
Whichever is higher for large companies; whichever is lower for SMEs and startups. Turnover means worldwide annual turnover.
Questions we hear most
Does the AI Act apply to a US company?
Yes, when it places AI on the EU market or when the output of its AI is used in the EU. A US employer screening candidates for roles in Europe is a typical example.
Is using ChatGPT or Copilot at work high risk?
Not for everyday drafting or summarizing. It becomes high risk when the output feeds decisions in a listed area, such as ranking candidates or setting credit terms.
Did the Omnibus cancel the high risk rules?
No. It moved the start dates to December 2, 2027 and August 2, 2028. The requirements are the same.
Do we still need AI literacy training?
Yes. The duty is now to take measures that support literacy rather than guarantee a level for each person, but you still need to show you acted. Short training and a clear acceptable use policy are the usual evidence.
Who enforces the Act?
National market surveillance authorities in each member state, with the EU AI Office supervising general purpose models and, after the Omnibus, certain AI systems built on them and AI in very large platforms.
Ready to act? Our EU AI Act compliance checklist turns this into tasks, and ISO 42001 explained covers the management system many companies use to organize the work. If you are rolling out new AI, plan the governance steps alongside the project in how to implement AI in your business.
Where things stand on October 31, 2026
Sources
- Regulation (EU) 2024/1689, Artificial Intelligence Act, EUR-Lex
- K&L Gates via National Law Review, EU Digital Omnibus on AI enters into force (July 31, 2026)
- ICTRecht, The Digital Omnibus for AI is here: what is actually changing? (July 31, 2026)
- Software Improvement Group, EU AI Act summary and timeline (updated August 14, 2026)
This guide is general information, not legal advice. The AI Act and its guidance continue to evolve; check the official text and consult a qualified lawyer. Spotted an error? Tell us.