The EU AI Act: What Companies Need to Know

AI has arrived in everyday business, as a chatbot in customer service, in candidate screening or in analysis tools. With the EU AI Act, the European Union has created the first comprehensive legal framework for the use of AI systems. The postponement of the high-risk timeline easily creates the impression that there is nothing to do for now. In fact, several obligations already apply.

What is the EU AI Act?

The EU AI Act is the world’s first comprehensive law regulating AI. It takes a risk-based approach: the greater the potential impact of an AI system on people, safety or fundamental rights, the more extensive the requirements.

The GDPR revolves around personal data. The AI Act asks which risks an AI system poses and which safeguards are needed. It applies directly in all member states and creates uniform rules for the European market.

Who does the AI Act apply to?

The regulation affects more companies than many assume. It applies to:

• companies based in the EU that develop or use AI systems
• providers outside the EU whose systems are used on the European market
• companies that use AI output within the EU
• manufacturers of products with integrated AI components

Beyond location, what matters is the system’s effect within the EU. A German company using a US AI service can be affected just as much as an American provider with European customers.

The key deadlines at a glance

The obligations take effect in stages. The Digital Omnibus, the first amendment to the regulation, has been in force since 27 July 2026 and moved some dates. The timeline is now fixed:

Sources: Regulation (EU) 2026/1744 (Digital Omnibus), EUR-Lex; Council of the EU, press release of 29 June 2026

For many companies, 2 August 2026 is the most important date in practice. Since then, users must be able to recognise that they are interacting with an AI, for example with chatbots, virtual assistants or generative applications. These obligations were expressly excluded from the postponement.

The high-risk deadlines after the Digital Omnibus

The European Parliament adopted the Digital Omnibus on 16 June 2026 and the Council on 29 June 2026. It was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744. The new dates for high-risk systems are:

• 2 December 2027 for stand-alone high-risk systems under Annex III, such as AI in recruitment, lending, education or critical infrastructure. Originally, August 2026 was planned.
• 2 August 2028 for high-risk AI embedded in regulated products, such as medical devices or machinery.

What moved is the date from which the obligations apply. The requirements themselves remain: conformity assessment, technical documentation, risk management, data governance and human oversight. Treating the extra time as a break means building these foundations later under pressure. Conformity assessment and documentation work best when they are part of development from the start.

The four risk classes of the AI Act

1.Prohibited AI practices

Certain applications are considered incompatible with European fundamental rights and are banned, for example:

• manipulating people through subliminal techniques
• exploiting the vulnerability of certain groups
• social scoring
• untargeted scraping of facial images from the internet or CCTV for facial recognition databases

For most companies this category is rarely relevant, but it marks the limit of what is permitted in the EU.

2.High-risk AI

This is the focus of the regulation. High-risk systems are AI applications whose decisions can significantly affect people or societal processes, for example:

• applicant management and recruitment
• employee evaluation
• creditworthiness assessment
• applications in healthcare and education
• AI for critical infrastructure

They require risk management, technical documentation, data governance, quality management, human oversight, logging and conformity assessment. Companies must be able to prove that their system is operated in a controlled, traceable and safe way.

3.AI systems with limited risk

This covers many applications companies already use: chatbots, virtual assistants and AI-based communication tools. Transparency obligations are the focus. Users must be able to tell they are communicating with an AI. The effort is much lower than for high-risk systems, but the deadline has already passed.

4.Systems with minimal risk

Most AI applications fall here, such as spam filters, spell checkers or low-risk recommendation systems. The regulation imposes no additional obligations. Responsible governance still pays off, especially if use cases change later.

Provider or deployer? The role decides

Not every company carries the same obligations, and this is often overlooked. What matters is the role in the AI project.

• Providers develop an AI system or place it on the market under their own name. They carry the most extensive obligations: risk assessment, technical documentation, conformity procedures, ongoing monitoring and proof of compliance.
• Deployers use an existing system within their own company, for example a recruitment tool, a customer service chatbot or generative AI for internal processes. They mainly have to ensure the system is used as intended, staff are trained, internal processes fit and transparency obligations are met.

For many companies, the deployer role is the more relevant one. The boundary matters: anyone who substantially modifies a purchased high-risk system or uses it under their own name takes on provider obligations.

A 90-second self-check: which obligations apply to you?

1.Do you build the AI system, or do you use one?

Anyone who develops a system or places it on the market under their own name is a provider. Anyone who uses an existing tool largely unchanged is a deployer. Substantially modifying a purchased high-risk system crosses the threshold to provider obligations.

2.What does your system decide?

If it decides about people or societal processes, such as recruitment, creditworthiness, health, education or critical infrastructure, it is probably high-risk. If it only interacts, as a chatbot does, it is usually limited risk with transparency duties. If it merely filters or recommends, it is usually minimal risk.

3.When does it become urgent?

For chatbots and generative AI, the transparency obligations under Article 50 have applied since 2 August 2026. For high-risk systems, 2 December 2027 or 2 August 2028 apply, but the substantive work starts now.

A worked example: the support chatbot

A mid-sized manufacturer has added a purchased AI chatbot to its customer support, unmodified from the vendor. What does the AI Act mean for this company?

• Role: the company uses the tool as delivered. It is a deployer. Conformity assessment, technical documentation and ongoing system monitoring sit with the vendor.
• Risk class: the chatbot talks to people but does not decide about creditworthiness, hiring or access to essential services. That means limited risk, and so a handful of transparency duties in place of a full compliance programme.
• Deadline: as a transparency obligation under Article 50, it has applied since 2 August 2026.

Three concrete tasks follow:

• Make the AI recognisable: a clear notice at the start of the chat that an AI is answering is usually enough.
• Document AI literacy: the staff who manage the chatbot need demonstrable basic knowledge of its risks and limits. A short internal guideline and a documented training session are suitable measures under Article 4.
• Check the vendor’s documentation: record that the vendor meets its obligations and that you use the system as intended.

That is all for this company. What carries over is the order: role first, then risk class, then deadline, then the short list of duties that follows.

What companies should do now

Record every AI system you use or plan to introduce, including purchased SaaS solutions. Assign each system to a risk class and clarify your role. That gives you the obligations and the relevant deadline, as in the example above.

Settle two things early: clear responsibilities across compliance, IT security, data protection and business units, and a simple governance process for documentation, approvals and monitoring. Neither needs to be elaborate, but both should be named and documented.

The AI literacy of your staff deserves particular attention, because it has applied since February 2025 and is often overlooked. The Digital Omnibus rewrote Article 4: providers and deployers must take measures to support the AI literacy of their staff and of the people operating systems on their behalf. They do not have to guarantee a specific level of competence for each individual. The duty stays with companies. The aim is for staff to use AI safely and in compliance with the rules. Because requirements vary by industry and use case, practical training is an important building block.

Conclusion: a clear framework for using AI

The EU AI Act steers the use of AI into reliable channels and gives companies a clear framework. The key decisions are made when AI systems are selected, introduced and used. Building knowledge early and clarifying responsibilities lowers regulatory risk and lays the foundation for a successful AI strategy.

At theBlue.ai, data sovereignty, traceability and human oversight have always been part of development. Our AI systems deliver traceable results, run entirely in the company’s own data centre where needed and keep people in control. In our AI workshops, we train staff to use AI safely and in compliance with the rules.

This article gives a general overview of the EU AI Act as of September 2026 and does not constitute legal advice. The binding reference is the text of the regulation as amended by Regulation (EU) 2026/1744.

Frequently asked questions