EU AI Act: what must a business do, and when?

The AI Act (Regulation (EU) 2024/1689) applies directly across the EU, including to businesses that only use AI. Some practices have been banned since 2 February 2025, such as recognising employees' emotions at work. A business must support the AI literacy of staff who work with AI. From 2 August 2026, people must be told when they are talking to a chatbot, and deepfakes must be labelled. The rules for high-risk AI, such as AI used in hiring or credit scoring, were postponed in 2026 to 2 December 2027. Fines reach up to €35 million or 7% of worldwide turnover.

Does the AI Act apply to a business that only uses AI?

Yes. The AI Act distinguishes providers, who develop an AI system or place it on the market under their own name, from deployers, the businesses that use AI in their work. A company that uses ChatGPT, Copilot, a website chatbot or an AI hiring tool is usually a deployer, and the Regulation gives deployers duties too.

A business that substantially modifies an AI system or offers it under its own name can become a provider, with much wider obligations. Which role applies depends on the specific use.

What applies today

Since 2 February 2025 the practices listed in Article 5 have been banned. They include manipulative techniques that cause people harm, social scoring, emotion recognition in the workplace and in schools (except for medical or safety reasons), and untargeted scraping of faces from the internet into databases.

Article 4 on AI literacy has applied since February 2025. Its new wording has applied since 27 July 2026: a business must take measures to support the AI literacy of the people who work with AI, but does not have to guarantee any specific level of knowledge for each person.

From 2 August 2026 the transparency duties of Article 50 apply. People must know when they are interacting with AI, and deepfakes and AI-generated text on matters of public interest must be labelled. The article on labelling AI-generated content covers this in detail.

What the Digital Omnibus changed and what comes next

Regulation (EU) 2026/1744 (the Digital Omnibus on AI) has applied since 27 July 2026 and moved several dates. The duties for stand-alone high-risk systems listed in Annex III (hiring and evaluating employees, creditworthiness, education, access to essential services) apply from 2 December 2027. For AI built into regulated products under Annex I, they apply from 2 August 2028.

From 2 December 2026 two new bans apply: AI systems designed to produce child sexual abuse material, and AI systems designed to create intimate images of a person without their consent. By the same date, providers of generative AI placed on the market before 2 August 2026 must add machine-readable marking to its output.

Smaller companies (up to 750 employees and €150 million turnover) are entitled to simplified procedures under the Omnibus. Their obligations do not disappear.

Who supervises, and what are the penalties

Each Member State designates its own authorities. In the Czech Republic the Czech Telecommunication Office is to be the main market surveillance authority, with the Czech National Bank for the financial sector and the data protection authority (ÚOOÚ) for personal data. As of 28 October 2026, the Czech act implementing the AI Act had not been adopted, but the Regulation applies directly.

Prohibited practices can be fined up to €35 million or 7% of worldwide annual turnover. Breaches of other obligations, including transparency, can be fined up to €15 million or 3%. For small and medium-sized companies, the lower of the two amounts applies.

A lawyer can assess your company's role under the AI Act, which duties apply and how to reflect them in contracts and internal rules. Lawyers' services are paid; only submitting a standard request through LawBridge is free.

Frequently asked questions