EU AI Act Explained: What Every Business Must Know in 2026

The EU AI Act is now a live compliance framework, but its obligations do not all begin on the same date. For most businesses, the useful starting point is not a generic “AI compliant” badge. It is an accurate inventory of AI systems, the role the organisation plays for each system, and the system’s intended purpose.

Table of Contents

EU AI Act timeline as of August 2026

2 February 2025: prohibited AI practices, relevant definitions and AI-literacy duties began to apply.
2 August 2025: governance rules and obligations for providers of general-purpose AI models began to apply.
2 August 2026: most remaining provisions became applicable, including the transparency obligations in Article 50. Commission enforcement powers for general-purpose AI also began.
2 December 2027: high-risk rules for systems listed in Annex III are scheduled to apply under the revised timeline.
2 August 2028: high-risk rules for AI embedded in regulated products are scheduled to apply.

The dates above reflect the Commission’s current implementation guidance following the AI Omnibus changes. Because guidance and standards continue to develop, organisations should verify the current position before relying on a deadline.

Which businesses need to act?

The Act distinguishes between providers, deployers, importers and distributors. A company using a third-party chatbot internally is usually in a different position from a company that develops a model, substantially modifies a system or deploys AI to make consequential decisions about people.

Risk classification depends mainly on the system’s intended purpose and context. Recruitment screening, access to essential services, education, certain biometric uses, critical infrastructure and some safety components can fall into the high-risk framework. Ordinary productivity tools are not automatically high-risk, although privacy, confidentiality, employment and sector-specific rules can still apply.

Transparency duties that apply now

Article 50 applies from 2 August 2026. Depending on the system and use case, it can require people to be informed when they interact directly with AI, machine-readable marking of certain AI-generated or manipulated outputs, and disclosure for deepfakes or certain public-interest text. The detailed conditions and exceptions matter; not every AI-assisted document needs the same label.

A practical compliance sequence

Build an AI inventory. Record the owner, vendor, model, intended purpose, users, affected people and data categories for every system.
Identify your legal role. Document whether the organisation is a provider, deployer, importer or distributor. Reassess the role after fine-tuning, rebranding or substantial modification.
Classify the use case. Check prohibited practices, high-risk categories, Article 50 transparency duties and the separate rules for general-purpose AI.
Verify the vendor evidence. Request documentation, security terms, data-processing terms, retention settings, incident processes and any relevant conformity material. A vendor claim does not replace the organisation’s own assessment.
Implement human control. Define who can approve, override or stop consequential outputs, and retain evidence that the control works in practice.

For a system-level workflow, continue with the AI Act risk-classification guide and the enterprise compliance checklist.

Penalties and proportionality

The highest ceilings can reach €35 million or 7% of worldwide annual turnover for certain prohibited-practice violations, with lower tiers for other infringements. The applicable amount depends on the violation and organisation, and the Act contains proportionality provisions, including for smaller businesses. A headline maximum should not be presented as the automatic fine for every error.

Official sources

This article provides general information and is not legal advice.

Editorial disclosure: AI tools may have assisted research, drafting or editing. ITnovati remains responsible for the published text. Time-sensitive technical, legal and product claims should be checked against the linked primary sources.