What does the EU AI Act require of companies, and from when?

Which deadlines apply from when?

The Regulation applies in stages. The Digital Omnibus of 8 July 2026 postponed some dates and added two new ones. The table gives each date, the group it affects, and in the last column what it means for an office that only uses third-party AI tools, i.e. is a deployer and does not use a high-risk system.

The basis is Art. 111 and 113 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026; the amended dates are in Art. 1 points 39 and 40 of that Regulation. Checked on 23 September 2026, with the dates checked again on 24 September 2026, against the Official Journal text and the European Commission's timeline.

Are you a provider or a deployer?

The obligations depend on the role, not on the size of the business. A provider is anyone who develops an AI system or has one developed and places it on the market or puts it into service under its own name (Art. 3(3)). A deployer is anyone who uses an AI system under its own authority in a professional capacity (Art. 3(4)). If your office uses someone else's AI assistant, its maker is the provider and your company is the deployer.

According to the Commission's guidelines on Art. 50, employees working under the company's instructions are not deployers in their own right. On the other hand, anyone who builds a chatbot themselves and uses it under their own name also becomes a provider. And under Art. 25(1)(c), a deployer becomes the provider of a high-risk system if it changes the intended purpose in such a way that the system becomes high-risk — for example, if a writing assistant is to be used to assess employees' performance in future.

Art. 4: what does AI literacy mean since the Omnibus?

Since 27 July 2026, providers and deployers “take measures to support the development of AI literacy of their staff” and of other persons working on their behalf. Prior knowledge, experience, education, the context of use and the persons affected must be taken into account. Nobody owes a particular level of literacy for each individual person; this is now expressly stated in the law. Until 26 July 2026, Art. 4 required ensuring “to their best extent” that a “sufficient level of AI literacy” existed.

In practice, the building blocks stay the same: a short briefing per role, clear rules on which data may go into which tool, a named contact person and a note of who was trained when. Under Art. 4(2), the Commission publishes practical examples on its central information platform. Neither Art. 99(3) to (5) of the Regulation nor § 15 KI-MIG contains a specific offence carrying a fine for Art. 4; Art. 4 nevertheless remains an obligation. How to set up training and evidence is explained in the article on AI literacy training under Art. 4.

Labelling obligation: what has Art. 50 required since 2 August 2026?

Art. 50 has applied since 2 August 2026 and divides labelling between two roles. Providers build the notice and the machine-readable marking into their systems. Deployers, that is, the companies that use AI, disclose when they publish deepfakes or certain AI texts. If you use AI for letters, quotes and internal analyses, you therefore generally do not have to label these texts; it is different for realistic AI images, videos and audio recordings and for texts on matters of public interest. Examples for chatbots, deepfakes and publications are in the article on the AI labelling obligation under Art. 50.

What this means in everyday office work is explained in the Commission's guidelines of 20 July 2026. Business correspondence with individual recipients and internal texts do not count as “published”. Advertising copy and product descriptions do not fall under the text obligation as long as they contain no statements on, for example, health, consumer safety or sustainability. The human review must cover the content; a spell check is not enough, and if you make substantive changes with AI after approval, you lose the exemption. Content generated before 2 August 2026 does not have to be labelled retrospectively; an older AI text that is only published afterwards, however, does.

For a chatbot on a website, the guidelines consider the notice necessary because customers may take the answers for human ones. An internal assistant for trained employees, by contrast, they regard as obvious. The obligation under para. 1 falls on the provider; if you build a chatbot yourself and use it under your own name, that is you. Every notice must be clearly recognisable at the latest at the first contact (Art. 50(5)).

For implementation, there has been a Code of Practice on Transparency of AI-generated Content since 10 June 2026, with EU icons for labelling. It is voluntary; the Commission and the AI Board have confirmed that it is suitable for demonstrating compliance with the obligations. Breaches of Art. 50 can be fined up to €15 million or 3% of worldwide annual turnover, with the lower of the two amounts for small and medium-sized enterprises.

When is an AI system high-risk?

High-risk systems are mainly those in the areas of use listed in Annex III. For employers, point 4 matters, employment and workers management: systems for recruitment and selection, for decisions on working conditions, promotion and termination, for allocating tasks based on individual behaviour or personal traits, and for monitoring and evaluating performance and behaviour. A tool that drafts texts, summarises or analyses tables is not covered merely because employees use it.

Art. 6(3) exempts a system listed in Annex III if it does not pose a significant risk, for example because it only performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns without replacing the human assessment, or only performs a preparatory task for an assessment. The provider must document this assessment before placing the system on the market, and must register the system (Art. 6(4), Art. 49(2)); the Omnibus only simplified the registration. Systems that perform profiling of natural persons always remain high-risk.

From 2 December 2027, deployers of such systems have their own obligations (Art. 26): use in accordance with the instructions for use, human oversight by trained persons, keeping the automatically generated logs for at least six months to the extent they are under your control, and informing workers' representatives and the affected employees before use in the workplace.

Status of interpretive guidance: the Commission's guidelines on high-risk classification have been available as a draft since 19 May 2026; the consultation ran until 23 July 2026. A final version had not been published on the Commission's website as of 23 September 2026. If you document a classification today, you should check it again against the final version and record the date of the check.

Which AI practices are prohibited?

Since 2 February 2025, Art. 5 has prohibited, among other things, manipulative techniques, exploiting vulnerabilities, social scoring, and inferring emotions in the workplace and in educational institutions, except for medical or safety reasons (Art. 5(1)(f)). Under Art. 3(39), emotion recognition requires biometric data, such as voice or face. Sentiment analysis of plain text may therefore not fall under this prohibition; it nevertheless remains an issue for data protection and the works council. From 2 December 2026, the two prohibitions from the Omnibus listed in the timeline are added.

Who supervises in Germany, and how high are the fines?

€35 million · 7%

prohibited practices (Art. 99(3))

€15 million · 3%

including deployer obligations under Art. 26 and transparency under Art. 50 (Art. 99(4))

€7.5 million · 1%

incorrect or incomplete information supplied to authorities (Art. 99(5))

The percentages refer to worldwide annual turnover in the previous year; the higher of the two values applies. For small and medium-sized enterprises, the lower one applies (Art. 99(6)), and since the Omnibus also for small mid-cap enterprises, but for them only for fines under paras. 4 and 5 (Art. 99(6a)). In Germany, the Federal Network Agency has been the competent market surveillance authority since 29 July 2026, unless another authority has been designated; for supervised financial companies, it is BaFin (§ 2 KI-MIG). The Commission's AI Office is responsible for the obligations of providers of general-purpose models.

What SMEs should do now

What the data protection threshold assessment looks like is explained in the guide on data protection impact assessments for AI; when the works council has a say is covered in the article Works councils and AI.

Frequently asked questions