EU AI Act: Deadlines, Obligations, and What to Do Next

As of August 31, 2026. The amendments to Regulation (EU) 2026/1744, in effect since July 27, 2026, have been incorporated.

The AI Regulation, better known as the EU AI Act, has been in effect since August 1, 2024, but it does not take effect all at once. Its requirements will be phased in over several years, and the timeline was most recently pushed back to July 2026. Anyone who wants to know today what applies to their company must therefore distinguish between two questions: What does the regulation say, and when must one be able to comply?.

This article addresses both of these questions. It explains the framework, outlines the current deadlines, and describes the obligations that apply to companies that do not develop AI themselves but instead purchase it. After all, this is the most common scenario—and also the one that is most often underestimated.

What is the EU AI Act?

The EU AI Act, officially the Regulation (EU) 2024/1689, is the world's first comprehensive AI law. As a regulation, it is directly applicable in all member states without the need for national implementing legislation. For companies with operations in multiple EU countries, this means a single legal framework instead of 27 different ones.

At its core is a risk-based approach. It is not the technology that is regulated, but rather its intended use. Depending on how it is used, the same language model may be subject to no requirements, moderate requirements, or strict requirements.

Prohibited Practices are at the top of the list. These include social scoring by public and private entities, the targeted exploitation of the vulnerabilities of vulnerable groups, emotion recognition in the workplace and in educational institutions, and certain forms of remote biometric identification. These bans have been in effect since February 2025.

High-Risk Systems form the core of the regulation. The regulation distinguishes between two pathways into this category. Annex III lists standalone applications in sensitive areas: biometrics, critical infrastructure, education, employment, access to essential services such as lending or social benefits, law enforcement, migration, and the justice system. Annex I covers AI that is embedded as a safety-critical component in products already subject to regulation, such as machinery, elevators, toys, or medical devices.

Systems Subject to Transparency Requirements constitute the third stage. Anyone speaking with a chatbot must be able to recognize that a human is not responding. Synthetically generated or manipulated images, videos, audio files, and text must be labeled as such in a machine-readable format. These rules under Article 50 have been in effect since August 2026. However, for systems that were already on the market prior to that date, the labeling requirement under paragraph 2 does not take effect until December 2, 2026.

Everything Else remains largely unregulated. A spam filter, a recommendation feature in an online store, or an invoice recognition system are generally not subject to any specific obligations.

In addition, the regulation governs general-purpose AI models, referred to as GPAI in official terminology. Starting in August 2025, providers of such models must make technical documentation available, comply with copyright laws regarding training data, and publish a summary of the training content used.

EU AI Act Deadlines: What Applies and When

The original timeline called for the high-risk obligations to take effect in August 2026. In November 2025, the Commission proposed relief through the Digital Omnibus; a political agreement was reached in May 2026, and the amendment took effect on July 27, 2026. It does more than just postpone deadlines: the definition of a “high-risk system” has been narrowed, duplicate regulation with sector-specific product law has been eliminated, and the requirement for AI expertise has been weakened. The regulatory framework of the regulation remains in place.

Effective date: August 31, 2026, pursuant to Regulation (EU) 2026/1744. The next deadline is therefore December 2, 2026, and not 2027.

The postponement gives companies a breather, but it is not a free pass. Anyone who operates a personnel selection system or an automated creditworthiness check has until December 2027 to comply with the requirements. The effort required remains the same, and it does not all have to be done in the final weeks before the deadline.

What the EU AI Act Means for Europe's Economy

Discussions about the AI Act are rarely neutral, and the Digital Omnibus has intensified the debate. The Commission justifies the relaxations by citing reduced bureaucracy and greater scope for innovation. More than 120 civil society organizations, including noyb led by Max Schrems, warned even before the official proposal was presented in an open letter dated November 13, 2025, that this would be „the biggest setback for digital fundamental rights in the history of the EU“. Her criticism is directed at the overall package and, above all, at the planned changes to the GDPR—not just the AI portion.

For companies, the question is more practical: Does the framework help or hurt? More and more businesses are asking themselves this question. According to a a representative Bitkom survey Of 604 companies with 20 or more employees, 36 percent were using AI in September 2025, up from 20 percent a year earlier. Another 47 percent were planning or discussing its use. Adoption has thus nearly doubled within a year, even as the regulations governing it are only gradually taking effect.

Both sides of the debate have a grain of truth, and both arguments can be supported by specific points.

One market instead of 27. Before the regulation was enacted, there was a risk of a patchwork of national AI laws. For a company that offers its software in multiple member states, a single set of requirements is less costly than seven different ones, even if that set is demanding. That is precisely the economic core of the single market argument.

Trust as a Gateway to the Market. In fields such as medicine, human resources, or lending, the bottleneck is not the performance of the models, but rather the willingness of regulators, works councils, and customers to let them make decisions. A verifiable legal framework lowers this barrier. Providers who can demonstrate compliance gain access to customers who would not even issue a request for proposals without such proof.

The Brussels Effect. As was the case with the GDPR, global providers often align themselves with the strictest market, because separate product lines are more expensive than a uniform standard. As a result, European regulation has an impact beyond Europe. This can be an advantage for European providers, because they must meet the requirements anyway, and this effort is not additional business for them but rather business as usual.

The costs are real. Conformity assessment, technical documentation, risk management, and reporting requirements tie up staff resources that smaller providers often lack. The Digital Omnibus is the direct response to this finding. It provides more time, narrows the high-risk classification, and reduces the documentation burden for smaller providers. This is an admission that the original timeline was too tight—and at the same time, it’s the point where the criticism begins: Those who have already invested are worse off than those who waited.

For the German economy, the real opportunity lies less in the regulatory framework itself than in combining it with existing strengths. Companies that automate processes in insurance, manufacturing, or administration are already operating in highly regulated environments and are accustomed to compliance requirements. This experience gives them a head start over providers for whom documentation and auditability are new concepts.

What the AI Regulation Means for Individual Companies

The most important practical question is not whether a company uses AI, but in what capacity. The regulation distinguishes primarily between two.

Provider They develop an AI system or have one developed and bring it to market under their own name. They bear the main burden: risk management, data quality, technical documentation, logging, conformity assessment, and CE marking.

Operator use a third-party system under their own responsibility. Their obligations are fewer, but by no means insignificant. They must use the system as intended, ensure human oversight, verify that input data is appropriate, retain logs, and, in the case of high-risk applications, inform the individuals affected.

There is a pitfall to this distinction. Anyone who substantially modifies a purchased system, distributes it under their own name, or uses it for a purpose other than the intended one becomes a provider themselves and assumes all of the provider’s obligations. In practice, this primarily affects companies that train a standard model on their own data and incorporate the result into their own product.

In addition, there is a requirement that applies to everyone regardless of risk class and has been in effect since February 2025: AI literacy as defined in Article 4. Providers and operators must take measures to promote their employees’ understanding of how the systems they use work and what their limitations are. The Digital Omnibus has softened this requirement: As of July 2026, it has been clarified that there is no obligation to guarantee a specific level of knowledge for individual employees. The obligation remains, but the burden of proof is reduced. The article in AI Competence as a Requirement.

In the event of violations, Article 99 three levels. The use of prohibited practices can result in a fine of up to 35 million euros or 7 percent of global annual revenue, whichever is higher. Violations of other obligations, such as those in high-risk sectors, are punishable by fines of up to 15 million euros or 3 percent. Providing false or incomplete information to authorities is punishable by fines of up to 7.5 million euros or 1 percent.

For small and medium-sized enterprises, the lower of the two values applies; the Digital Omnibus Act has extended this relief to small companies with medium capitalization—that is, businesses with 250 to 750 employees and annual revenue not exceeding 150 million euros or total assets not exceeding 129 million euros.

What Companies Should Do Now

The postponed deadlines make it tempting to put off addressing the issue. This is risky because the most time-consuming steps come at the beginning, not at the end.

Get an overview of where AI is being used within your organization, and clarify its role for each system. That may sound trivial, but in most companies it’s the most difficult step. AI is now embedded in applicant tracking systems, CRM functions, translation tools, and the assistant features of Office products—often without being explicitly labeled as such. For every system you find, the question of its role immediately arises: Are you a provider or an operator, and are you modifying the system in a way that would make you a provider? Only by considering both aspects together can you get a clear picture, because the same software can entail completely different obligations depending on the contract and how it’s used.

Assign each system to a risk class. Most enterprise applications fall into the lowest category. The key is to identify the few cases that do not. A language model that reads invoices is non-critical. The same model, when used to presort job applications or decide on insurance benefits, is a candidate for Annex III and requires a documented review.

Put your AI expertise into practice. This requirement is already in effect and, since the Omnibus Directive, no longer requires a large-scale administrative apparatus. In many cases, documented training tailored to the specific area of responsibility is sufficient to meet this requirement.

Develop documentation and establish responsibilities simultaneously. If you don’t start until shortly before an audit, you won’t be able to reconstruct which data was used to train a model or who approved which decision. Logging, version history, and approval workflows can only be recorded in real time. For this to happen, a designated point of responsibility is needed: AI governance lies at the intersection of IT, legal, data protection, and business units; otherwise, it falls through the cracks. The overlap with data protection is significant, as the article on AI and data protection shows.

Use this time to make selection decisions. If you're planning to purchase a system anyway, ask the vendor now about its classification, documentation, and timeline for compliance. These questions are easy to ask before signing the contract but difficult to address afterward.

Conclusion

The EU AI Act does not regulate AI as a technology, but rather its use in situations where people are affected by decisions. For the vast majority of business applications, it changes little. For the few systems that play a role in decisions regarding job applications, loans, benefits, or security, it requires evidence that cannot be generated retroactively.

The postponement to December 2027 and August 2028 provides some breathing room, but it doesn’t change this logic. Those who start today by creating an inventory and clarifying responsibilities can tackle the time-consuming parts at their own pace. Those who wait will end up doing the same work later under time pressure. A good starting point is your own process landscape: Where documents and applications are processed automatically, it’s usually quick to determine whether an application even falls into the high-risk category or whether, as in the vast majority of cases, it simply replaces manual labor.

The official legal framework, including guidelines and updates, is published by the European Commission. The article on the AI Expertise in the Workplace.