The EU AI Act is the world's first broad law for artificial intelligence, and if you build, sell, or simply use AI in the European market, it applies to you. The good news: for most businesses the obligations are lighter than the headlines suggest. The catch: the ones that do apply are specific, and in July 2026 the EU pushed back the dates for the strictest of them. This is a plain-language guide to what matters in 2026 and how to get ahead of it.
What the AI Act actually regulates
The Act is a product-safety-style regulation, not a data-privacy law. Where GDPR governs personal data, the AI Act governs the AI system itself: how it's designed, documented, and overseen. It also has a wide reach: it applies to providers who develop AI systems and to deployers who put them to use inside the EU, even when the underlying model was built elsewhere. In other words, "we just use a tool a vendor built" does not automatically put you outside its scope.
The four risk tiers
Everything in the Act hangs off a simple idea: the higher the risk to people, the heavier the rules. There are four levels.
| Tier | What it covers | Your duty |
|---|---|---|
| Unacceptable | Practices like social scoring or manipulative systems | Banned outright |
| High-risk | AI in areas like hiring, credit, medical devices, critical infrastructure | Heaviest obligations |
| Limited-risk | Chatbots, AI-generated content, emotion or deepfake tools | Transparency duties |
| Minimal-risk | Spam filters, most productivity and analytics tools | No specific obligations |
The practical takeaway: most everyday business AI sits in the limited or minimal tiers. You climb into high-risk mainly when your system helps decide something consequential about a person: who gets hired, who gets a loan, who gets a diagnosis.
Transparency: the rule most businesses will feel first
Even outside high-risk, the Act expects honesty about AI, and its transparency duties have applied since 2 August 2026. The Digital Omnibus kept that date. If customers interact with a chatbot, they have to be told they're talking to a machine, unless it's obvious. AI-generated images, audio, video and text have to be machine-marked as artificial, and deepfakes clearly labelled. None of this is onerous (it's mostly clear disclosure and a little UX work), but it's the obligation the widest range of companies will touch. In practice this is often a single line of disclosure and a labelled output, but it should be deliberate and consistent rather than buried in terms nobody reads.
The one concession is on marking. Generative AI systems that were already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking to their output. That's the provider's job, so if you use a vendor's image or text generator, ask when theirs goes live. Telling people when AI helps make a decision about them is a separate duty: it belongs to the high-risk rules, so for uses like hiring it starts in December 2027. Being open about it sooner costs little, and if the decision is fully automated the GDPR may already require it.
The timeline after the Digital Omnibus
The Act entered into force in August 2024 and has phased in since: bans on prohibited practices and the AI literacy duty from February 2025, obligations for general-purpose AI models from August 2025, and most of the rest, transparency included, from 2 August 2026. The high-risk rules were due on that same date (a year later for AI built into regulated products), but the machinery to apply them wasn't ready. The technical standards and guidance providers need were late, and so was the set-up of the national authorities meant to supervise them. So the EU amended the Act. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 (Regulation (EU) 2026/1744, summarised by Lewis Silkin). These are the dates that now apply:
| What applies | From |
|---|---|
| Bans on prohibited practices, AI literacy duty | 2 February 2025 |
| Obligations for general-purpose AI models | 2 August 2025 |
| Transparency, such as chatbot disclosure | 2 August 2026 |
| Machine-readable marking, for generative AI on the market before 2 August 2026 | 2 December 2026 |
| New bans: non-consensual intimate images, child sexual abuse material | 2 December 2026 |
| High-risk, stand-alone (Annex III), such as hiring, education, credit scoring and critical infrastructure | 2 December 2027 (was 2 August 2026) |
| High-risk, built into regulated products (Annex I), such as medical devices | 2 August 2028 (was 2 August 2027) |
Two other changes are worth knowing. The AI literacy duty was softened: it used to require you to ensure, as far as you could, a sufficient level of AI literacy among your staff. Now providers and deployers must take measures to support their staff's AI literacy, and the amended text says plainly that no specific level has to be guaranteed. And there's a new ban: from 2 December 2026, AI systems that generate intimate or sexually explicit images, video or audio of real, identifiable people without their consent (so-called nudifier apps), or child sexual abuse material, are banned.
Not legal advice. We updated this guide on 26 September 2026 to reflect the Digital Omnibus on AI as adopted, so the dates above are law, not proposals. Whether and when a rule applies to your system still depends on details this article can't see, so confirm your position with qualified counsel before you rely on it. And don't read the delay as a reason to wait: the high-risk obligations haven't gone away, you just have longer to meet them, and preparation is cheaper than a scramble.
General-purpose AI and your vendors
If your product is built on a large foundation model (the kind behind most chat and copilot features), obligations for those general-purpose AI (GPAI) models fall largely on the model provider, not on you. That's mostly good news. But it makes vendor diligence part of your compliance: ask providers whether they publish the technical documentation, training-data summaries, and usage policies the Act expects, because their compliance posture becomes part of yours. When you design secure AI systems, treat "is this vendor AI-Act-ready?" as a standard procurement question.
It's also worth separating obligation from good practice. Even where the Act doesn't strictly require it, keeping a simple record of which AI tools you use, what each one does, and who owns it makes every future compliance question (this regulation and the next) far easier to answer. Governance you build once tends to pay off repeatedly.
A practical readiness checklist
- Inventory your AI. List every AI system you build or deploy and note what each one decides or influences.
- Classify each by risk tier. Most will be minimal or limited; flag anything touching hiring, credit, safety, or health for a closer look, and note which of the high-risk dates applies to it.
- Turn on transparency. Label chatbots and AI-generated content now, since that duty already applies, and disclose AI involvement in decisions about people.
- Build AI literacy. Make sure staff who use these tools understand their limits. The Omnibus softened this duty (you must take measures, not guarantee a level), but it already applies.
- Vet your vendors. Confirm foundation-model and tool providers meet their own obligations.
- Keep records. Documentation and human-oversight habits are far cheaper to maintain than to reconstruct.
For regulated sectors the bar is higher: if you build clinical tools, see our companion piece on the EU AI Act for medical device software, where high-risk rules and MDR obligations overlap.
Deploying AI and unsure where you land? Neurova AI builds AI systems with transparency, oversight, and documentation designed in from the start. Book a call and we'll map your tools to the risk tiers.
Frequently asked questions
Does the EU AI Act apply to my business if I only use AI tools? Often yes. The Act regulates both providers who build AI systems and deployers who use them. If you deploy an AI system in the EU (even a third-party one) you can carry obligations such as human oversight, transparency to users, and using the system in line with its instructions. Duties scale with the system's risk level.
What are the EU AI Act risk tiers? There are four: unacceptable-risk practices that are banned, high-risk systems with the heaviest obligations, limited-risk systems subject mainly to transparency duties (for example labelling chatbots and AI-generated content), and minimal-risk systems with no specific obligations. Most everyday business tools fall into the limited or minimal tiers.
When do the EU AI Act deadlines take effect? Bans on prohibited practices and the AI literacy duty have applied since February 2025, general-purpose AI model obligations since August 2025, and transparency duties such as chatbot disclosure since 2 August 2026. The Digital Omnibus on AI, in force since 27 July 2026, postponed the high-risk rules: they now apply from 2 December 2027 to stand-alone high-risk uses such as hiring or education, and from 2 August 2028 to AI built into regulated products such as medical devices. New bans on AI that generates non-consensual intimate images or child sexual abuse material apply from 2 December 2026. Confirm how the dates apply to your own system before relying on them.