The regulation has changed several times over the past year, most recently in July 2026. Most articles online still quote the old wording.
Here is what applies today, what is coming and what you don’t need to worry about.
Since 2 August 2026 the regulation has been fully applicable. Until then only parts of it applied. National authorities now have the power to supervise and act, and the transparency obligations have kicked in.
In July 2026 a package of amendments called the Digital Omnibus was adopted. It softened some obligations and postponed others.
That doesn’t mean nothing applies until national supervision laws are passed. The AI Act is a regulation, not a directive, so it applies directly and in the same way in every EU country. National law only decides who will supervise and by what procedure.
Does anyone at your company write emails, texts or summaries in ChatGPT or a similar tool?
Do you have Microsoft 365 with Copilot or Google Workspace with Gemini?
Does your marketing team create graphics or copy with AI?
Does anyone at your company screen CVs with AI?
One yes is enough to make your company a deployer under the regulation. There is no size threshold, no limit on headcount or turnover. The only thing that changes is what is proportionate in your situation.
Out of more than a hundred articles, these three are the ones that affect an ordinary company. Most of the rest targets those who develop and sell AI, such as OpenAI, Google or Microsoft.
People who work with AI at your company should understand it to a proportionate level. That includes contractors and subcontractors working with it on your behalf.
The Digital Omnibus turned it from an obligation of result into an obligation of effort. You don’t have to guarantee that everyone has reached a certain level. You have to be able to show that you did what was proportionate.
It was neither scrapped nor postponed. And according to the Commission, sending people a tool’s user manual is not enough.
The newest obligation and the only one your customers see.
A chatbot has to make clear right at the start of the conversation that it is a machine. Not in the terms and conditions, not in the page footer.
Generated images, audio or video that look like a real recording must be labelled when published. Even if they show a person who doesn’t exist. Ordinary commercial copy, product descriptions, offers and newsletters are not labelled.
Fines are capped at €15 million or 3% of turnover. For SMEs, the lower of the two applies.
A short list of things that are banned outright. For an ordinary company, the one that matters is emotion recognition in the workplace.
A camera that assesses whether people look focused. Software that reads a candidate’s facial expressions in an interview. The workplace includes remote work and hiring.
Bad intent is rarely behind it. More often someone buys a productivity monitoring tool without knowing exactly what it does.
The highest penalty in the regulation: €35 million or 7% of turnover.
And one thing that is coming. When AI is used in hiring, employee evaluation or decisions about people, it falls into the high-risk category. That comes with a full set of obligations: risk management, data quality, documentation, human oversight and informing the people affected. The deadline has been moved to 2 December 2027, and to August 2028 for AI built into regulated products. It isn’t urgent, but it is worth getting your house in order now.
Send us a few sentences about how you use AI in your company. We’ll tell you straight what applies to you and where to start.
Nobody knows who uses what. AI is running in the company, but nobody officially approved or banned it. Management doesn’t know who uses which tool for what. It comes to light when something goes wrong.
Data in public tools. A client contract, a price list, contacts or personal data pasted into a public chatbot. That is no longer just the AI Act, it is also data protection, with its own penalties.
Made-up numbers. AI puts together text that sounds plausible, and it sounds most confident exactly when it is making things up. Someone who isn’t prepared for that sends a client an offer or a report with a figure that doesn’t exist.
A chatbot with a human name. A website assistant with a name and a photo that doesn’t say it is a machine. Since August 2026, that is a problem.
Nothing on record. The company did something, maybe sent people a presentation, but can’t prove it. A certificate isn’t required, but according to the Commission you should keep internal records of training and measures. Training without a record is very hard to prove.
Fraud with a cloned voice. A few seconds of a public video are enough to clone a managing director’s voice. An employee who has never heard of this won’t verify a fake payment instruction.
The AI Act has changed several times over the past year. In July 2026 the Digital Omnibus softened Article 4 and pushed high-risk systems back by a year and a half. In the same month the Commission published guidelines on Article 50 running to more than fifty pages.
The tools are changing too. Agents that act inside systems on their own have arrived, and with them new risks. A policy a company writes today and files away is out of date in six months. Training from last year quotes wording that no longer applies.
AI Act compliance isn’t something you tick off once. It has to be maintained.
A €35 million fine for untrained staff. That rate applies exclusively to prohibited practices under Article 5. The regulation sets no separate fine for failing the AI literacy obligation. Penalties are set by national authorities.
A mandatory certificate. The law doesn’t require one, and the Commission has said so directly. A certificate of completion is useful as proof for a client or during an inspection, but it is not a legal requirement.
Labelling every text AI helped you write. Most commercial copy isn’t labelled.
So fines aren’t the main reason to deal with this. What hurts more is data leaving the company, decisions based on made-up numbers, or someone sending money on a fake instruction. And clients are asking more and more often how you have AI covered.
We have been building with AI since it took off, in our own companies. The training comes from what runs in them daily, not from theory. On top of that:
The regulation distinguishes two roles. A provider develops AI and places it on the market, for example OpenAI, Google or Microsoft. A deployer uses it in their activities, and today that is almost every company. This covers any natural or legal person using AI under their own authority. The only exception is purely private use at home.
Yes. The European Commission has clarified that business, trade, the practice of a profession or regular economic benefit all mean professional activity. The regulation has no threshold based on headcount or turnover. The only thing that changes is what is proportionate in the given situation.
Yes. The AI Act is a regulation, not a directive, and applies directly in every EU country. National law only decides who will supervise and by what procedure.
Article 4 used to require ensuring a sufficient level of AI literacy. After the amendment it is enough to take measures to support it. An obligation of result became an obligation of effort: you don’t have to guarantee that every person reached a certain level, but you have to be able to show that you did what was proportionate. The obligation was neither scrapped nor postponed.
A certificate isn’t required. The Commission does say, however, that organisations should keep internal records of training and measures. Training you have no record of is very hard to prove. And the Commission doesn’t consider simply sending people a tool’s user manual to be a proportionate measure.
The regulation sets no separate fine for failing Article 4. Penalties are set by national authorities. The €35 million or 7% of turnover applies exclusively to prohibited practices under Article 5. For breaching the transparency obligations, the cap is €15 million or 3% of turnover, and for SMEs the lower of the two.
Mostly not. Only AI-generated text that is published, informs the public and concerns matters of public interest has to be labelled, and all three conditions must be met at once. Even then there is an exception if the text went through human review and someone takes responsibility for it. Ordinary commercial copy, product descriptions, offers and newsletters are not labelled.
Customers have to know they are talking to a machine, directly in the conversation and right at its start. A mention in the terms and conditions or the page footer isn’t enough, and neither is calling it an assistant. A chatbot with a human name and photo has been a problem since 2 August 2026.
AI used in hiring, employee evaluation or decisions about people falls into the high-risk category. These obligations have been moved to 2 December 2027, and to August 2028 for AI built into regulated products.
General information on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, status as of 1 September 2026. This is not legal advice.
Free AI consultation. In 30 minutes you'll know where AI has the biggest return in your company and whether the investment will pay off at all. You leave with an RSM Blueprint: one page with what's worth doing first in your business.
We use cookies to measure traffic and ad performance. Essential ones always run, the rest only with your consent. More info