EU AI Act: obligations for businesses and application timeline

Read this first. This article is for information only and is not legal advice. It reflects Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, up to date as of October 2026. How your AI systems and your role are classified depends on each situation: have your conclusions validated by a lawyer or legal counsel, and refer to the official texts listed in the sources.

The EU AI Act, the European Union’s regulation on artificial intelligence, affects far more businesses than is commonly assumed: any organisation that uses an AI system in a professional context may have obligations, even without developing anything. Its timeline was also amended in 2026, which explains the conflicting dates found online. Below are the obligations, the timeline checked against the texts published in the Official Journal of the European Union, and an action plan. This topic is part of our approach to generative AI for business.

The EU AI Act in brief

What the regulation covers: a risk-based approach

The European Commission presents the regulation around four levels of risk:

• Unacceptable risk: prohibited practices (Article 5), for example social scoring, exploiting vulnerabilities linked to age or social situation, emotion recognition in the workplace and in education (except for medical or safety reasons), and untargeted scraping of facial images to build facial recognition databases.
• High risk: systems that can harm health, safety or fundamental rights. They are either safety components of regulated products (Annex I) or used in the areas listed in Annex III: biometrics, critical infrastructure, education, employment and workers’ management (recruitment, CV screening, promotion, dismissal), access to essential services (creditworthiness assessment, pricing in life and health insurance), law enforcement, migration, justice.
• Transparency risk: chatbots, generated or manipulated content, deepfakes (Article 50).
• Minimal risk: the Commission cites spam filters and video games. The regulation adds no specific rules.

The regulation also governs general-purpose AI models (large language models, for example), whose obligations fall on their providers.

Provider or deployer: what is your role?

Article 3 distinguishes in particular between:

• the provider: the party that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark;
• the deployer: the party that uses an AI system under its own authority, except in the course of a personal, non-professional activity.

A business that uses an off-the-shelf assistant is generally a deployer. The situation is less clear-cut when you build your own application on a model’s API and put it into service under your name: you may then be considered the provider of that system, while the model’s developer remains the provider of the model. Article 25 also provides that a deployer becomes the provider of a high-risk system if it puts its name on it, substantially modifies it, or changes the intended purpose of a system so that it becomes high-risk. This classification is the first point to have validated.

Application timeline (checked in October 2026)

Regulation (EU) 2024/1689 entered into force on 1 August 2024. Its Article 113 provided for staggered application. In November 2025, the European Commission proposed a “digital omnibus on AI” to postpone and simplify certain rules. That text is no longer a proposal: it was adopted as Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026.

Milestone	What applies	Original timeline (2024/1689)	Timeline in force (after 2026/1744)
Entry into force	The regulation legally exists	1 August 2024	Unchanged
General provisions and prohibitions	Chapters I and II: definitions, AI literacy (Article 4), prohibited practices (Article 5)	2 February 2025	Unchanged
New prohibitions	Systems generating non-consensual intimate content or child sexual abuse material	Not provided for	2 December 2026
General-purpose AI models	Chapter V, governance, penalties regime	2 August 2025	Unchanged
General application	Including transparency (Article 50)	2 August 2026	2 August 2026 (until 2 December 2026 for content marking by systems already on the market)
High risk, Annex III	Employment, credit, education, biometrics…	2 August 2026	2 December 2027
High risk, Annex I	AI embedded in regulated products	2 August 2027	2 August 2028

Last checked against the texts published in the Official Journal: 15 October 2026.

Already in force: prohibited practices and AI literacy

Since 2 February 2025, the practices in Article 5 have been prohibited and Article 4 has applied. For an ordinary business, the most concrete risk is not social scoring but, for example, a tool that analyses the emotions of employees or candidates: inferring a person’s emotions in the workplace is prohibited, except for medical or safety reasons.

General-purpose AI models

Since 2 August 2025, providers of general-purpose AI models have had their own obligations. If you use these models through an API, these obligations do not fall on you, but they determine the information the provider must make available to those who integrate its models.

Transparency and high risk: what the AI omnibus changed

The transparency obligations in Article 50 have applied since 2 August 2026. The omnibus did not postpone this date; it only provided that providers of systems generating synthetic content placed on the market before 2 August 2026 must comply with the marking obligation (Article 50(2)) by 2 December 2026.

For high risk, recital 40 of Regulation 2026/1744 justifies the postponement by delays in the availability of standards and guidance, and in the setting up of national authorities. A postponement is not a removal: the obligations remain the same, and preparing for them takes time.

Concrete obligations for a deploying business

Training your teams (Article 4)

As worded by Regulation 2026/1744, Article 4 requires providers and deployers to take measures to support the development of AI literacy among their staff and other persons using the systems on their behalf. These measures take into account their knowledge, their experience and the context of use. The text states that the obligation does not require ensuring a specific level of literacy for each individual.

In its questions and answers, the European Commission states that no certificate is required, that an internal record of the actions taken is sufficient, and that relying solely on a system’s instructions for use is generally not enough. Enforcement falls to national market surveillance authorities, from August 2026.

Informing users (chatbots, generated content)

Article 50 allocates the obligations:

• Providers: design systems that interact with people so that they know they are dealing with an AI (unless this is obvious); mark generated audio, image, video or text content in a machine-readable format.
• Deployers: disclose that a deepfake has been generated or manipulated by AI; disclose that a text published to inform the public on matters of public interest has been generated by AI, unless it has undergone human review under editorial responsibility; inform people exposed to an emotion recognition or biometric categorisation system.

The information must be clear and given at the latest at the time of the first interaction or exposure. If you put your own customer-facing chatbot into service, assume that the obligation to inform applies to you.

High-risk systems: HR, credit, insurance

If you use a system covered by Annex III, for example to screen job applications, assess employees or assess customers’ creditworthiness, Article 26 requires the deployer, from 2 December 2027, in particular to:

• use the system in accordance with its instructions for use;
• assign human oversight to people who are competent, trained and have the necessary authority;
• ensure that the input data it controls is relevant;
• monitor operation and alert the provider and the authority in the event of a risk or serious incident;
• keep the automatically generated logs under its control for at least six months;
• inform workers’ representatives and the employees concerned before using such a system in the workplace;
• inform the people subject to decisions made or assisted by the system;
• use the provider’s information to carry out, where applicable, the data protection impact assessment (DPIA).

Article 27 adds a fundamental rights impact assessment for certain deployers: public bodies, private entities providing public services, and deployers of creditworthiness assessment or life and health insurance pricing systems. Since the omnibus, it can refer to the relevant parts of the DPIA, and the AI Office is to provide a template questionnaire.

The EU AI Act and the GDPR: obligations that add up

The CNIL, the French data protection authority, makes this point in its questions and answers updated on 17 August 2026: the AI regulation does not replace the GDPR, and the two apply in parallel. The GDPR covers any processing of personal data, including the use of an AI system. The AI regulation can make some steps easier, for example by feeding the documentation required by the EU AI Act into the DPIA.

For generative AI, the CNIL’s recommendations are very practical: start from a concrete need, define permitted and prohibited uses in an internal policy, do not enter personal data into consumer services, check whether the provider can reuse the data, favour a controlled deployment for sensitive data, and involve the data protection officer (DPO) and the chief information security officer (CISO) from the outset. If you connect a model to your own document base containing personal data, you are the controller for that processing.

Penalties

Article 99 sets ceilings for administrative fines, with the higher of the two amounts applying:

Infringement	Ceiling
Prohibited practices (Article 5)	35 million euros or 7% of worldwide annual turnover
Operator obligations, including deployers (Article 26) and transparency (Article 50)	15 million euros or 3%
Incorrect, incomplete or misleading information supplied to authorities	7.5 million euros or 1%

For SMEs, including start-ups, the lower amount applies. The omnibus extended this rule to small mid-cap companies for the last two tiers, and asks Member States to take into account the economic viability of SMEs. These penalties come on top of those under the GDPR, which the CNIL points out can reach 20 million euros or 4% of worldwide turnover.

A 5-step action plan

1. Inventory your uses of AI: off-the-shelf tools, AI features built into business software, in-house developments, undeclared uses. For each: purpose, users, data processed, provider.
2. Classify the risks and determine your role: prohibited practice, high risk (Annex III), transparency, minimal risk; provider or deployer. Have borderline cases validated by a lawyer.
3. Write an AI policy: authorised tools, prohibited uses, data that must never be entered, review rules, point of contact.
4. Train your teams according to their role and keep a record of the actions taken (Article 4).
5. Ensure technical traceability: logs, model and prompt versions, evaluation, incident procedure. These practices belong to LLMOps, which we describe on our page on putting AI into production.

For SMEs: relief measures and priorities

The regulation, reinforced by the omnibus, provides several measures for SMEs and small mid-cap companies:

• reduced fine ceilings (the lower amount applies);
• support from the Commission and Member States for AI literacy, with practical examples published by the Commission;
• simplified technical documentation for SMEs and small mid-caps that provide high-risk systems, using a form drawn up by the Commission;
• guidance and advice from national authorities, particularly for SMEs.

The priorities for an SME that uses AI without developing it are simple: check that no use falls under the prohibited practices, set rules for generative AI tools through an internal policy, train your teams, and identify early any HR or customer-facing use likely to be high-risk before December 2027.

Conclusion: prepare now rather than waiting for the final deadlines

The postponement of the high-risk rules should not obscure the essentials: the prohibitions, AI literacy and transparency already apply. An inventory, an AI policy and a training plan cover most of the needs of an SME or mid-sized company, and prepare it calmly for the 2027 and 2028 deadlines. Feekr supports these efforts from the Lille metropolitan area (northern France), from scoping to technical traceability, working alongside your legal advisers: see our AI governance and EU AI Act compliance service. To place compliance within a broader project, read our method for adopting AI in your business or visit our page on generative AI for business.

[ YOUR QUESTIONS ]

Frequently asked questions

What is the EU AI Act?

It is Regulation (EU) 2024/1689, which lays down harmonised rules on artificial intelligence in the European Union. It governs AI systems and models according to their level of risk, from prohibited practices to minimal-risk uses. It entered into force on 1 August 2024 and applies in stages.

When does the EU AI Act come into force?

It entered into force on 1 August 2024. Its provisions apply progressively: 2 February 2025 for the prohibitions and AI literacy, 2 August 2025 for general-purpose AI models, 2 August 2026 for general application. Since the AI omnibus, the high-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Is AI training mandatory under the EU AI Act?

Article 4 requires providers and deployers to take measures to support AI literacy among their staff and other persons using the systems on their behalf. Since the AI omnibus, the text specifies that there is no specific level to be ensured for each individual, and the European Commission states that no certificate is required. Role-appropriate, documented actions are still needed.

What does Article 50 of the EU AI Act say?

It sets out transparency obligations. Providers must inform people that they are interacting with an AI and mark generated content in a machine-readable format. Deployers must disclose deepfakes, certain texts published to inform the public, and inform people exposed to an emotion recognition or biometric categorisation system.

What are the penalties under the EU AI Act?

Up to 35 million euros or 7% of worldwide annual turnover for prohibited practices, up to 15 million or 3% for most other obligations, including those of deployers and transparency, and up to 7.5 million or 1% for supplying incorrect information to authorities. For SMEs, the lower of the two amounts applies.

Sources

• EUR-Lex: Regulation (EU) 2024/1689 on artificial intelligence (Official Journal text)
• EUR-Lex: Regulation (EU) 2026/1744 of 8 July 2026, digital omnibus on AI (Official Journal of 24 July 2026)
• European Commission: AI Act, regulatory framework and timeline
• European Commission: agreement on simplifying AI rules
• European Commission: AI Literacy, Questions & Answers
• CNIL: Entry into force of the European AI regulation, the CNIL’s first questions and answers (updated 17 August 2026, in French)
• CNIL: Questions and answers on using a generative AI system (in French)