General information, not legal advice. This guide summarizes public sources as they stood on 13 October 2026. The AI Act has already been amended once and further guidance is still being issued. Whether an obligation applies to your organization, and whether you meet it, is a question for qualified counsel.
What the AI Act is
The AI Act is Regulation (EU) 2024/1689, the European Union's horizontal law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. As a regulation, it applies directly in every EU member state without national transposition, although member states designate the authorities that supervise and enforce it.
The Act regulates AI by risk. It bans a short list of practices outright, places detailed obligations on high-risk systems, adds transparency duties for certain systems that interact with people or generate content, and sets separate rules for general-purpose AI models. Most everyday AI use falls outside the specific obligations, but not outside the Act's scope altogether.
Who it applies to, including outside the EU
The Act's reach is set out in Article 2. It is not limited to companies based in Europe. In summary, it applies to:
- Providers that place AI systems or general-purpose AI models on the EU market, or put AI systems into service in the EU, wherever the provider is established.
- Deployers of AI systems that are established or located in the EU.
- Providers and deployers established outside the EU, where the output produced by the AI system is used in the EU.
It also covers importers, distributors and product manufacturers in defined circumstances. Two roles matter most for most organizations. A provider develops an AI system, or has one developed, and puts it on the market under its own name. A deployer uses an AI system under its authority in a professional context. The same company can be a provider for one system and a deployer for another.
For a US or international business, the practical questions are: do we sell or supply an AI system or model into the EU, do we have EU entities or staff using AI, and is the output of any AI system we run used in the EU? A yes to any of them is a reason to take advice on scope.
The risk tiers
The European Commission describes four levels of risk for AI systems, with general-purpose AI models handled separately.
| Tier | What it means | Examples given by the Commission |
|---|---|---|
| Unacceptable risk | Prohibited practices (Article 5). | Social scoring; untargeted scraping of facial images to build recognition databases. The AI Omnibus adds a ban on AI that generates non-consensual intimate content and child sexual abuse material. |
| High risk | Permitted, with obligations including risk management, data quality, logging, documentation, human oversight, robustness and cybersecurity (Article 6 and Annexes I and III). | AI used in employment, education, critical infrastructure, access to essential services, migration and the administration of justice; AI that is a safety component of regulated products. |
| Transparency risk | Disclosure duties (Article 50). | Telling people they are dealing with a chatbot; labelling deepfakes and certain AI-generated content. |
| Minimal or no risk | No specific obligations under the Act. | Spam filters; AI in video games. |
General-purpose AI models, the large models many products are built on, carry their own obligations for the companies that provide them. If you build on such a model rather than provide one, those obligations mostly sit with your vendor, but your own use can still be high-risk or carry transparency duties.
The application timeline
The dates below reflect the Act as amended by the AI Omnibus, as published by the European Commission.
| Date | What applies |
|---|---|
| 1 August 2024 | The Act enters into force. |
| 2 February 2025 | Prohibited practices and the AI literacy obligation (Article 4) apply. |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models apply. |
| 2 August 2026 | The Act applies generally, with the exceptions below. Transparency rules apply and enforcement by the AI Office and member state authorities begins. |
| December 2026 | The new prohibition on AI that generates non-consensual intimate content and child sexual abuse material applies. |
| 2 December 2027 | Obligations for stand-alone high-risk systems listed in Annex III, such as AI used in employment, education and access to essential services. Previously 2 August 2026. |
| 2 August 2028 | Obligations for high-risk AI embedded in products regulated under Annex I, such as machinery, toys and lifts. Previously 2 August 2027. |
Some of the changes made by the AI Omnibus carry their own transition periods, for example for marking AI-generated content in systems already on the market. Check the amended text for any date your plan depends on.
The AI Omnibus: what was proposed, what was adopted
On 19 November 2025 the European Commission proposed a "Digital Omnibus on AI" to simplify the Act and to delay the high-risk obligations, which were due from 2 August 2026, until supporting standards and tools were ready. For several months that delay was only a proposal, and much of the commentary you will find online still describes it that way.
It is now law. The European Parliament and the Council reached political agreement on 7 May 2026, the Council gave its final approval on 29 June 2026, and the amending regulation was published in the Official Journal and entered into force on 27 July 2026. According to the Commission, the adopted changes include:
- The later high-risk dates shown above: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
- A simplified, company-level AI literacy requirement, with a stronger role for the Commission and member states in promoting AI literacy (see the next section).
- Simplifications previously reserved for SMEs extended to small mid-cap companies, and wider access to regulatory sandboxes, including a new EU-level sandbox.
- A simplified obligation to register exempted AI systems in the EU database.
- The new prohibition on nudification and non-consensual intimate content.
- Extended AI Office oversight, including of certain systems built on general-purpose models from the same provider.
What did not change: the prohibitions that have applied since February 2025, the general-purpose AI model obligations that have applied since August 2025, and the general application of the Act from 2 August 2026. The delay buys time for high-risk systems. It does not pause the rest.
Article 4: AI literacy
Article 4 is the obligation most organizations already have, because it applies to providers and deployers of AI systems of any risk level, not only high-risk ones. It has applied since 2 February 2025 and was not postponed.
As originally adopted, Article 4 required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons operating or using AI systems on their behalf, taking into account their knowledge, experience, education and training and the context in which the systems are used.
The AI Omnibus amended it. According to the Commission's AI literacy questions and answers, updated on 27 July 2026:
- AI literacy remains an obligation for providers and deployers. The Commission's original proposal would have shifted it toward the Commission and member states; the adopted text did not.
- The amended text no longer mandates a specific or "sufficient" level of literacy.
- The Commission and member states support organizations, including by publishing practical examples, and the AI Board is to adopt recommendations on promoting AI literacy.
- Deployers of high-risk systems must still make sure the people assigned to human oversight have the necessary competence, training and authority.
The same Commission guidance says there is no need for a certificate, that no specific governance structure such as an AI officer is required, and that organizations may keep an internal record of training and other initiatives. Supervision and enforcement of Article 4 sit with national market surveillance authorities.
In practice, a defensible approach starts from who uses which AI system for what, then gives each role what it needs to use those systems appropriately, and keeps a record of what was done. A single generic course for everyone, with an attendance list, answers a different question. We set out the difference in Data literacy and AI literacy are not the same skill and Measuring literacy by use, not attendance.
AI in hiring and people decisions
Employment is one of the areas listed in Annex III. AI used in recruitment and selection, and in decisions about promotion, termination, task allocation and monitoring of workers, can be high-risk. For those Annex III systems, the obligations now apply from 2 December 2027.
Among the deployer obligations in Article 26: use the system in line with the provider's instructions for use, assign human oversight to people with the necessary competence, training and authority, and, where the deployer is an employer, inform workers' representatives and the affected workers before a high-risk system is put into use at the workplace. If you also operate in Illinois, the state's rules on AI in employment are already in force; see our guide to Illinois AI law.
Penalties
Article 99 sets maximum administrative fines, applied by member state authorities:
- Prohibited practices: up to EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher.
- Most other obligations: up to EUR 15 million or 3%, whichever is higher.
- Supplying incorrect, incomplete or misleading information to authorities: up to EUR 7.5 million or 1%, whichever is higher.
For SMEs, including start-ups, each cap is the lower of the two amounts rather than the higher. Fines for providers of general-purpose AI models are set separately.
What boards and CIOs should do now
None of this requires waiting for December 2027. The first steps are the same whatever your exposure turns out to be.
- Inventory the AI you use and supply. Include AI embedded in vendor products, not only what your teams built. For each system, record what it does, who uses it, where its output is used and who owns it.
- Establish your role for each system. Provider, deployer or both, and whether the EU nexus in Article 2 is met. This is where counsel should be involved.
- Screen for prohibited practices. These have applied since February 2025, and the list has grown.
- Classify by risk. Flag anything that may fall under Annex III, especially in hiring, people management, credit, insurance and education, and anything that needs transparency notices from August 2026.
- Put AI literacy on a footing you can show. Role-appropriate measures for the people who use or oversee each system, and a record of what was done.
- Name owners and a review path. Someone accountable for each system, a tiered review proportionate to the risk, and a decision record. Our article NIST AI RMF in practice describes how that works day to day.
- Read your vendor contracts. For systems you deploy, you will depend on the provider's instructions for use, documentation and cooperation.
- Plan for the high-risk dates, and keep watching. Standards, Commission guidelines and national enforcement practice are still developing.
Where we fit, and where we do not
We do not give legal advice, and no consultancy can make an organization compliant. What we do is help organizations understand what a rule like this covers, build an inventory of the AI they actually use, and govern it: named owners, risk tiers, a review path and a decision record, plus role-based AI literacy programs with evidence of what was done. Whether that meets a particular obligation is for you and your counsel to decide.
If you want a working review path proven on one real use case, the AI Governance Quickstart is the bounded way to start. For the wider picture, see Strategy & Governance and AI & Data Literacy.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
- Digital Omnibus on AI, Official Journal reference OJ L 2026/1744, EUR-Lex
- AI Act, European Commission
- AI Omnibus enters into force, European Commission
- AI Literacy: Questions and Answers, European Commission
- Council of the EU press release, 29 June 2026
Last checked 13 October 2026. Article numbers refer to Regulation (EU) 2024/1689 as amended. This guide is general information and is not legal advice.
