AI Act: what actually applies to your business since 2 August 2026?
·
Updated on ·
By 
Aymeric Guyard · 11 min read
In brief
- Since 2 August 2026, Regulation (EU) 2024/1689 on artificial intelligence has been largely applicable: transparency obligations for chatbots, deepfakes and generated content (Article 50), national governance and sanctions regime, in addition to prohibited practices and the AI literacy obligation in force since February 2025 and rules on general-purpose models since August 2025. High-risk obligations have been postponed by the Digital Omnibus: to 2 December 2027 for Annex III systems and to 2 August 2028 for those integrated into regulated products (Annex I).
The AI Act timetable after the Digital Omnibus
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) | In force |
| 2 August 2025 | Obligations for providers of general-purpose AI models (GPAI), designation of authorities, sanctions | In force |
| 2 August 2026 | Transparency (Article 50), general obligations, full sanctions regime, regulatory sandboxes | In force |
| 2 December 2026 | End of grace period for labelling AI-generated content; explicit ban on systems designed to produce non-consensual intimate content | Upcoming |
| 2 December 2027 | High-risk systems in Annex III (HR, education, credit, insurance, public services, biometrics, etc.) | Postponed by the Omnibus |
| 2 August 2028 | High-risk systems embedded in products subject to harmonisation legislation (Annex I) | Postponed by the Omnibus |
The postponement of high-risk obligations has created frequent confusion: many companies concluded that 'the AI Act was postponed'. This is false for the bulk of the obligations that concern a user company. See our AI Act regulation page for article-by-article details.
Are you a provider or a deployer?
The AI Act distinguishes two main roles, and your obligations depend on them:
- Provider: you develop an AI system or have it developed to place it on the market under your name. A company that trains a model, or that substantially customises an existing system and commercialises it, is a provider.
- Deployer: you use an AI system under your authority, in a professional context. The vast majority of SMEs and mid-caps are deployers: they use ChatGPT, Copilot, a CV-screening tool or a customer chatbot supplied by a vendor.
A deployer can become a provider if it substantially modifies a high-risk system or affixes its brand to it. This reclassification is the first point an audit checks.
The five obligations in force for a deployer company
- Avoid prohibited practices (Article 5): social scoring, subliminal manipulation, exploitation of vulnerabilities, emotion recognition at work and in education (except for medical or safety reasons), biometric categorisation based on sensitive data, untargeted scraping of facial images. Fine up to 35 million euros or 7% of worldwide turnover.
- Ensure AI literacy of your staff (Article 4): train employees who use or operate AI systems to a sufficient level, according to their role and context of use. There is no prescribed format, but proof of training is expected.
- Respect transparency (Article 50): inform individuals that they are interacting with an AI system (chatbot, voicebot) when this is not obvious; flag deepfakes; flag AI-generated texts published to inform the public on matters of public interest, unless subject to human review and editorial responsibility. Providers must technically mark generated content (grace period until 2 December 2026).
- Comply with the GDPR in parallel: the AI Act does not replace the GDPR. Any use of AI on personal data requires a legal basis, information to individuals, and often an impact assessment (DPIA). The French data protection authority (CNIL) has made training data a priority for inspections in 2026.
- Prepare for high risk before December 2027 if you use AI in the areas of Annex III: recruitment and management of employees, access to education, creditworthiness assessment, life and health insurance pricing, access to essential public services, biometrics, critical infrastructure, justice and democratic processes. For these uses, the deployer must use the system in accordance with the instructions, ensure human oversight, inform employees and the persons concerned, keep logs and, for certain bodies, carry out a fundamental rights impact assessment. See the definition of a high-risk AI system.
The penalty regime now complete
| Breach | Maximum fine |
|---|---|
| Prohibited practices (Article 5) | 35 million euros or 7% of worldwide turnover |
| Other obligations (including transparency and high risk) | 15 million euros or 3% of worldwide turnover |
| Inaccurate information provided to authorities | 7.5 million euros or 1% of worldwide turnover |
For SMEs and start-ups, the lower of the two amounts applies. In France, the French data protection authority (CNIL) has been designated as one of the competent authorities for AI systems processing personal data, alongside other sectoral authorities; coordination is entrusted to the DGE.
10-point checklist to be compliant in 2026
- Inventory of AI systems in use, including uses not validated by the company (shadow AI).
- Qualification of each use: prohibited, high-risk, transparency, minimal risk.
- Company's role for each system: provider or deployer.
- AI use policy communicated to employees (authorised data, validated tools, human review).
- Documented AI literacy training for users, with enhanced level for HR, legal and security functions.
- Information notice on chatbots and voicebots exposed to customers.
- Reporting procedure for generated content (deepfakes, texts of public interest).
- GDPR verification: legal basis, information, DPIA for high-risk uses, clauses with providers (DPA, location, training on your data).
- High-risk roadmap for December 2027 if an Annex III use exists.
- AI item on the management body's agenda with a designated responsible person.
Take action
Manage your compliance with Data Comply One: all-in-one software and outsourced DPO/CISO experts.
Discover the AI Act software →Test my AI compliance →Sources
- Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence, Articles 3, 4, 5, 26, 50, 99, 113 and Annexes I and III, EUR-Lex.
- Digital Omnibus, texts adopted by the European Parliament (16 June 2026) and the Council (29 June 2026).
- European Commission, AI Office, guidelines on prohibited practices and on the definition of AI systems (2025).
- The French data protection authority (CNIL), recommendations on the development of AI systems and 2026 control priorities.