The AI Act deadlines are coming. Which ones are yours?

How the AI Act works

The EU AI Act regulates AI by risk. The higher the risk to people's safety and rights, the stricter the rules.

According to the European Commission, “the vast majority of AI systems currently used in the EU” fall into the minimal-risk category. For most companies, the duties are about transparency and staff literacy. (European Commission)

Duties depend on your role. A provider builds an AI system or has it built, and puts it on the market under its own name. A deployer uses an AI system in its business. A company with its own website chatbot is often both. Freelancers or contractors working for you do not become separate deployers: your company remains responsible. (Commission Q&A on Art. 50)

The dates, as amended by the Digital Omnibus on AI in 2026: (AI Act, Art. 113) (AI Act, Art. 111)

List every AI use

You can't check obligations for AI you don't know you have.

Make a simple list. For each AI use, note:

• what it does, and which vendor or model is behind it
• your role: provider, deployer or both
• who meets it: customers, staff, applicants, the public
• what it produces: text, images, audio, video, decisions
• when it went live, or will
• whether it helps decide anything about people

Include the tools staff use on their own initiative, AI features inside software you already buy, and anything a freelancer or agency built for you. The list is the basis for every step that follows, and the first thing an auditor or customer will ask for.

Rule out banned uses

Some uses are banned outright. Most have been since 2 February 2025.

Article 5 prohibits AI that: (AI Act, Art. 5)

• uses manipulative or deceptive techniques that distort people's behaviour and cause significant harm
• exploits vulnerabilities due to age, disability or social or economic situation
• scores people on their social behaviour or personal characteristics, leading to unjustified treatment
• predicts whether someone will commit a crime based only on profiling or personality traits
• builds facial recognition databases by untargeted scraping of images from the internet or CCTV
• infers emotions of people at work or in education, except for medical or safety reasons
• sorts people by biometric data to infer race, political opinions, union membership, religion or sexual orientation
• identifies people in real time in public spaces for law enforcement, apart from narrow exceptions

AI literacy for your staff

Since 2 February 2025, companies that build or use AI must support their staff's AI literacy.

Article 4, as amended by the Digital Omnibus, requires providers and deployers to “take measures to support the development of AI literacy of their staff” and of others who operate or use AI systems on their behalf. It does not require them to guarantee any specific level of literacy for any individual. (AI Act, Art. 4)

In practice: short guidance on which tools are allowed, what data may go into them, how to check their output, and where their limits are; training proportionate to each role; and a record of who received it.

Say it's an AI

From 2 August 2026, people must be told when they are interacting directly with an AI system, unless that is obvious.

The duty lies with the provider of the system, and applies to chatbots, voice assistants, avatars and AI agents. The test for “obvious” is the view of a reasonably well-informed, observant and circumspect person. The information must be given clearly, at the latest at the first interaction, and meet accessibility requirements. (AI Act, Art. 50) (Commission Q&A on Art. 50)

The Commission's guidelines add two practical points. A disclosure only in the terms and conditions, a link or the documentation is not enough on its own; it must appear in context. And AI agents that act for someone, for example making bookings or concluding purchases, must disclose “both their artificial nature and the person on whose behalf they are acting.” (Commission guidelines on Art. 50)

Mark what AI creates

Providers of AI that generates images, video, audio or text must mark the output in a machine-readable way, so it can be detected as AI-made.

The duty applies from 2 August 2026. Systems already on the market before that date have until 2 December 2026. It does not apply where the AI only assists with standard editing, such as spelling, or does not substantially change the input. (AI Act, Art. 50) (AI Act, Art. 111)

The Commission's Code of Practice on transparency of AI-generated content describes how to do it: at least two layers of machine-readable marking, namely digitally signed metadata and an imperceptible watermark. Signing the code is voluntary, but the Commission has confirmed it as an adequate way to demonstrate compliance. About 190 organisations had signed by the end of July 2026. (Code of Practice)

If you use a vendor's AI to generate content, ask whether its output is already marked, and how.

Label deepfakes and AI-written news, and inform people

Deployers, the companies using the AI, have their own transparency duties from 2 August 2026.

Like all Article 50 information, the disclosure must be clear and given at the latest at the first exposure. The Code of Practice includes EU icons that deployers may use to label AI-generated content. (AI Act, Art. 50) (Code of Practice)

Check for high-risk uses

AI that helps make important decisions about people is high-risk, with strict requirements.

The areas listed in Annex III include biometrics, critical infrastructure, education, employment and management of workers, access to essential services such as credit and insurance, law enforcement, migration and the administration of justice. The Commission's examples include CV-sorting software for recruitment and credit scoring that can deny someone a loan. (AI Act, Annex III) (European Commission)

From 2 December 2027, such systems need, according to the Commission: risk assessment and mitigation, high-quality datasets to minimise discriminatory outcomes, logging of activity for traceability, detailed documentation, clear information for the deployer, appropriate human oversight, and a high level of robustness, cybersecurity and accuracy. AI in products already covered by EU safety rules, such as machinery or medical devices, follows from 2 August 2028. (European Commission) (AI Act, Art. 113)

These requirements take time to build. Testing, logging and documented quality checks are easier to add during development than after.

General-purpose AI models

Providers of general-purpose AI models, the large models behind chatbots and many tools, have their own duties since 2 August 2025.

They must keep technical documentation, give information to companies that build on their models, have a policy to comply with EU copyright law, and publish a summary of the content used for training. The most capable models, with systemic risk, have further duties. (AI Act, Art. 53)

Most businesses use these models rather than provide them, so these duties usually sit with the model provider. Fine-tuning or building on a model can change that; check with a lawyer if you modify models significantly.

Fines, and where to find help

The fines are significant, but lower caps apply to smaller companies.

For SMEs and start-ups, each fine is capped at whichever amount is lower. Since the Digital Omnibus, the same lower cap applies to small mid-cap companies for the second and third rows. (AI Act, Art. 99)

The Commission publishes help for companies: guidelines on the transparency obligations, a questions-and-answers page, the Code of Practice, and the AI Act Service Desk with the full text and a compliance checker. (Commission guidelines on Art. 50) (Commission Q&A on Art. 50) (Code of Practice)

AI Act checklist

For the owner, with legal and technical support.

• Every AI use is listed, with vendor, role, users and go-live date.
• No use falls under the banned practices, including the two new bans from 2 December 2026.
• Staff have guidance on AI use, and it is recorded who received it.
• People are told clearly, in context, when they talk to an AI; agents say on whose behalf they act.
• AI-generated content is marked, or your vendor confirms it is; the 2 December 2026 deadline is met for older systems.
• Deepfakes and unreviewed AI-written public texts are labelled.
• High-risk uses are identified, and work on their requirements has started.
• A lawyer has confirmed roles, risk levels and exemptions.

What this would look like for you