The EU AI Act

Which rules apply to your business today?

Three sets of obligations are already enforceable, and the Digital Omnibus touched none of them.

Prohibited practices and AI literacy have applied since 2 February 2025. The prohibitions cover manipulative techniques, exploitation of vulnerabilities and social scoring, and carry the highest penalties in the Act. The literacy obligation is quieter and more widely missed: if your staff operate AI systems, you must take measures to ensure they understand them, and you should be able to show what those measures were.

General-purpose AI model obligations have applied since 2 August 2025, and fall on the companies building the models rather than on the businesses using them.

Article 50 transparency has applied since 2 August 2026. This is the one that reaches ordinary businesses, and it applies whether or not your system is high-risk.

Does your chatbot have to say it is a chatbot?

Yes, unless that is already obvious to a reasonably well-informed person. Article 50(1) requires an interactive AI system to be designed so people are told they are dealing with a machine, and the disclosure must be clear, distinguishable and delivered no later than the first interaction. A line in a privacy policy does not meet it.

The obligation reaches you even when the software belongs to someone else. The Act splits duties between the provider, which develops the system, and the deployer, which puts it in front of people. Marking synthetic output is the provider’s job. Disclosing a deepfake, and disclosing AI-generated text published on matters of public interest, falls on the deployer. If your site shows a third-party assistant to EU customers, you are the deployer, and a custom front end that suppresses the provider’s marking is your exposure rather than theirs.

Penalties for Article 50 reach €15 million or 3% of worldwide annual turnover, whichever is higher.

What did the Digital Omnibus actually delay?

Two dates, and nothing else. The Council gave final approval on 29 June 2026, and the stated reason was that the harmonised technical standards needed for compliance were not finished.

Is anything you run high-risk?

For most businesses, no. Annex III covers AI used in recruitment and employment decisions, credit scoring, access to essential services, education, law enforcement, migration and certain biometric applications.

Recruitment is the one that catches ordinary companies. If a system screens applications, ranks candidates or materially assists a hiring decision, it is an Annex III high-risk system and you are its deployer. Your deadline is 2 December 2027, and the obligations were deferred rather than reduced: a risk management system, data governance documentation, technical files, human oversight procedures and a fundamental rights impact assessment where required.

What happens next, and when?

Two dates sit between now and the high-risk deadline. On 2 December 2026 the transition period ends for the Article 50(2) marking obligation on systems already on the market before August, and two new prohibitions phase in covering AI-generated child sexual abuse material and non-consensual intimate imagery. On 2 December 2027 the Annex III high-risk regime applies.

The Act reaches providers and deployers wherever they are established, where the output is used in the Union. A business outside the EU serving EU customers is in scope.