The European Union’s AI Act has crossed from phased preparation into active enforcement for transparency, AI literacy, prohibited practices and general-purpose AI models. High-risk system deadlines have moved, but the practical lesson has not: organisations should treat compliance as an operating discipline now, because inventories, labels, training, contracts and evidence cannot be assembled credibly after an incident.
Table of Contents
The European Union’s Artificial Intelligence Act is not merely “coming”. It entered into force on 1 August 2024, its first obligations began applying in February 2025, and enforcement of several major duties began on 2 August 2026. The important qualification is that the law still operates through a phased calendar. Transparency rules, AI-literacy duties, prohibited practices and rules for general-purpose AI models are now enforceable, while many high-risk-system requirements were postponed by the 2026 AI Omnibus to December 2027 or August 2028. tinction matters because two opposite mistakes are spreading. One is to claim that every AI Act obligation now applies to every organisation. The other is to treat the delayed high-risk deadlines as permission to wait. Both are wrong. The defensible business position is to comply with what applies today and build the evidence base for what applies next. The work is less about producing a ceremonial policy than knowing which systems are used, who provides them, what they do, whose rights they affect, what disclosures are required and who can prove that controls work. For most companies, the expensive part is not reading the regulation. It is discovering unmanaged AI use after contracts, workflows and customer interfaces have already hardened around it.
The law has entered its enforcement phase
The AI Act is a regulation, so it applies directly across the European Union rather than waiting for each member state to rewrite it as national legislation. Its reach is also designed to follow the EU market: providers and deployers outside the Union can fall within scope when they place AI systems on the EU market, use them in the Union or produce outputs used in the Union. Exact applicability still depends on the organisation’s role, the system, the use case and the territorial link. ed calendar is now the starting point for any serious assessment. Definitions, AI literacy and the ban on prohibited practices have applied since 2 February 2025. Obligations for providers of general-purpose AI models applied from 2 August 2025. On 2 August 2026, Article 50 transparency duties began applying, and the Commission’s AI Office and national authorities began enforcing the rules that are already applicable. rce” and “fully applicable” are not interchangeable.** The original regulation set a broad August 2026 application date with exceptions. The 2026 AI Omnibus then extended the main high-risk deadlines, leaving Annex III systems—such as certain uses in employment, education, essential services, biometrics, migration and law enforcement—until 2 December 2027, while high-risk AI embedded in regulated products moves to 2 August 2028. lt is not a pause. It is a split regime. A customer-facing chatbot may already need a clear disclosure even when it is not high-risk. A company using generative AI for marketing may face AI-literacy and content-transparency duties now, while a recruitment screening system may sit on a longer high-risk compliance timetable. Managers therefore need a system-by-system view, not a single corporate answer to whether the AI Act “applies”.
Everyday AI use now creates legal duties
Many organisations still frame AI regulation as a problem for model developers. That misses the Act’s distinction between providers, deployers, importers, distributors and product manufacturers. A business that buys a third-party AI tool can still be a deployer with its own obligations. A company that substantially modifies a system, changes its intended purpose or puts its name on it may acquire provider responsibilities. The legal role follows conduct, not the label chosen in a procurement document. why ordinary operational uses matter. The Commission’s AI-literacy guidance specifically addresses companies whose employees use tools such as ChatGPT for advertising copy or translation: those staff should be informed about relevant risks, including hallucination. Article 4 requires providers and deployers to take measures supporting AI literacy for staff and other people operating or using AI on their behalf, with the approach adjusted to knowledge, experience, context and risk. does not prescribe a universal course, certificate or governance committee. The Commission says organisations can document training and other guidance internally, and that no specific AI-officer structure is required solely for Article 4. That flexibility is useful, but it also removes the comfort of a checklist. A ten-minute generic video may be defensible for low-impact use only if it addresses the real tools and risks. Staff approving credit, screening candidates or handling medical information need different instruction from employees generating draft social posts. tical threshold is whether the organisation can show that its measures fit the people, systems and context. Training without an inventory is guesswork. An inventory without owners becomes stale. A policy that ignores browser-based tools, embedded software features and contractors leaves the most common routes of unmanaged use untouched. Compliance begins by finding the AI already present, including tools purchased by departments outside central IT.
Transparency has become a product requirement
Article 50 is the most visible change from 2 August 2026. Providers of systems intended to interact directly with people must generally design them so users are informed that they are interacting with AI, unless this is obvious to a reasonably well-informed and observant person in the circumstances. Providers of systems generating synthetic audio, image, video or text must also support machine-readable marking and detection, subject to the Act’s conditions and exceptions. s have separate duties. Deepfakes generally require disclosure that the content was artificially generated or manipulated. AI-generated or manipulated text published to inform the public on matters of public interest also requires disclosure, subject to an exception where the content has undergone human review or editorial control and a person bears editorial responsibility. Systems used for emotion recognition or biometric categorisation trigger information duties toward exposed people. ligations make transparency an interface and workflow decision, not a paragraph buried in terms and conditions. A chatbot notice must appear at the point of interaction. A synthetic-media label must travel with the content. A machine-readable mark must survive the production pipeline sufficiently to perform its regulatory purpose. The Commission’s July 2026 guidance aims to support consistent and proportionate implementation, while a voluntary code offers a route for providers to demonstrate practices; the legal obligation, however, comes from Article 50, not from signing the code. gn challenge is avoiding both concealment and noise. Over-labelling every AI-assisted output can make notices meaningless, while under-labelling creates deception risk. Organisations need rules that distinguish AI-generated content from routine editing assistance, public-interest communications from internal drafts, and realistic synthetic media from content where artificiality is obvious. Those decisions should be recorded because later disputes will turn on context, not slogans.
The compliance calendar rewards preparation, not delay
The 2026 amendments changed deadlines, but they did not create one universal date. The current sequence separates obligations that already apply from high-risk rules that arrive later. operative milestones after the AI Omnibus
| Date | Main milestone | Practical meaning |
|---|---|---|
| 2 February 2025 | Definitions, AI literacy and prohibited practices apply | Organisations should already have stopped prohibited uses and begun role-based literacy measures |
| 2 August 2025 | General-purpose AI provider rules apply | New GPAI models placed on the market must meet documentation, copyright and information duties, with added duties for systemic-risk models |
| 2 August 2026 | Article 50 transparency rules and enforcement begin | Customer interfaces, synthetic-content workflows and existing literacy controls become immediate enforcement issues |
| 2 December 2026 | Limited transition for certain pre-existing synthetic-content systems | Only specified Article 50 marking obligations receive the additional transition |
| 2 December 2027 | Annex III high-risk rules apply | Providers and deployers in listed high-impact fields need completed high-risk controls and evidence |
| 2 August 2028 | High-risk rules for AI embedded in regulated products apply | Product manufacturers and connected supply chains receive the longest runway |
The table compresses the main milestones; individual provisions, legacy systems and sectoral rules can produce different results, so the regulation and current official guidance remain controlling.
The delayed high-risk dates are commercially important because conformity assessment, quality management, data governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity can require product redesign and supplier cooperation. They cannot be credibly completed in the final month. The delay should be treated as implementation time, not idle time. also a transition trap. The Commission’s Article 50 FAQ says the limited grace period applies only to certain systems placed on the market before 2 August 2026 and only to the machine-readable marking and detection obligation in Article 50(2). It does not suspend the full transparency chapter for every existing AI deployment. ral-purpose AI providers, the calendar is different again. Obligations have applied to models placed on the market since 2 August 2025; Commission enforcement powers began on 2 August 2026; and models placed on the market before August 2025 generally have until 2 August 2027 to comply. That sequencing makes model versioning, release dates and documentation provenance legally relevant. eal burden sits in evidence and ownership
The regulation’s visible outputs—labels, notices, policies and conformity marks—depend on less visible operating systems. An organisation must know which department owns an AI use, which vendor supplies it, which data enters it, which people rely on its output and which controls are monitored. Without that chain, no executive can confidently answer whether the organisation is a provider or deployer, whether a use is prohibited, whether a transparency duty applies or whether a future high-risk classification is likely.
Evidence is the scarce asset. Procurement teams may hold contracts but not model documentation. Security teams may know integrations but not intended purposes. Human-resources teams may understand decisions but not training data. Marketing may publish synthetic content through agencies that use multiple tools. Legal teams can interpret duties, but they cannot reconstruct operational facts that were never recorded. The compliance programme must connect these fragments.
A useful minimum record for each system includes the vendor and model, owner, intended purpose, affected people, input and output data, decision influence, geographic use, integration points, disclosures, human review, incident history, contractual rights and current risk classification. The record should also identify the evidence supporting each answer. A spreadsheet can begin the process, but ownership and change control determine whether it remains true.
This is also where AI Act work intersects with data protection and cybersecurity. The European Data Protection Board has said AI models trained with personal data cannot automatically be treated as anonymous; anonymity must be assessed case by case. ENISA has separately framed AI cybersecurity and standardisation as part of the European control environment. AI Act compliance therefore does not replace the General Data Protection Regulation, security duties or sector rules. It adds another layer of role, risk and evidence. y that treats these regimes as separate paperwork streams will duplicate effort and miss conflicts. The stronger design is one control library with mapped legal bases: data governance can support privacy, model quality and high-risk documentation; incident handling can connect security, safety and regulatory reporting; supplier reviews can gather both data-processing and AI-system evidence.
Suppliers cannot carry the whole compliance risk
Most deployers will depend on vendors for technical information, updates, logging, marking and instructions. Yet buying from a well-known provider does not transfer every duty. Deployers control the purpose, context, users and decisions around the system. They may also combine tools in ways the provider did not anticipate. Vendor compliance is an input, not an outsourcing strategy.
Contracts should therefore do more than promise that a product “complies with the AI Act”. The useful questions are specific: What role does each party hold? Which model versions are covered? What documentation will be supplied? How are material changes announced? Can the customer access logs? Who implements Article 50 notices and machine-readable marks? What happens when the provider changes the model, data sources or intended use? Which audit and remediation rights survive termination?
General-purpose AI creates a particularly layered chain. Model providers must prepare technical documentation and give downstream providers information needed to understand capabilities and limits. Providers of models with systemic risk face additional evaluation, incident-reporting and cybersecurity duties. Downstream system providers still need to translate model-level information into controls for the particular application. companies face a bargaining problem. They often receive standard terms, limited technical detail and rapidly changing cloud services. That does not make compliance impossible, but it changes the decision. Where a supplier will not provide enough information, the deployer can restrict the use case, add independent testing, increase human review, choose a different service or accept a documented residual risk. The worst option is silent dependence on evidence the contract does not promise.
Agencies and contractors belong in the same map. The Commission’s literacy guidance says people operating or using AI on an organisation’s behalf can include contractors and service providers. A marketing agency generating campaign assets or a recruiter using automated screening can create transparency, literacy and future high-risk issues for the client. Procurement and statements of work should describe permitted uses and required evidence, not merely confidentiality and delivery dates. cement will test proportionality and credibility
The AI Act permits substantial penalties, including higher ceilings for prohibited practices than for many other infringements, but the maximum fine is not the most useful planning metric. Penalties must account for the circumstances, including the nature, gravity and duration of the infringement, the organisation’s size and conduct, and whether authorities were notified or cooperated with. Exact exposure depends on the violated provision and the applicable enforcement route. immediate risk is an organisation unable to explain its system after a complaint or incident. A missing chatbot notice is visible. A synthetic advertisement can be copied and preserved. A failed employment decision may expose the absence of training, oversight or documentation. The Commission’s AI-literacy guidance notes that enforcement may be more likely where an incident shows inadequate training or guidance. National market-surveillance authorities enforce Article 4, while the AI Office has direct responsibilities for general-purpose AI models. ent will not be perfectly uniform from the first day. Member states designate authorities and establish national penalty rules, while the Commission, AI Board and AI Office coordinate at EU level. Guidance is also non-binding even when it signals the Commission’s interpretation. That creates uncertainty around edge cases, but it does not erase clear obligations. criticism deserves attention. Reporting around the August 2026 transparency deadline described concerns about late guidance, compliance cost and inconsistent interpretations, especially for content labels. Those concerns are credible where technical standards and workflows are still maturing. They are weaker as a reason to ignore direct disclosure duties that have a clear purpose and application date. aith preparation is not a safe harbour, but it changes the evidence.** A current inventory, documented classification, role-based training, tested labels, supplier escalation and incident process show a regulator that the organisation treated the law as an operating requirement. A generic policy approved just before an inspection shows far less.
A practical programme starts with six decisions
The first decision is scope: identify every AI system used or supplied, including embedded features, pilots, browser tools and contractor-operated services. Do not begin by debating high-risk classification in the abstract. Begin with facts about purpose, users, outputs and affected people. The Commission’s definition guidance can help distinguish AI systems from simpler software, but it is non-binding and must be applied to the actual product. nd decision is legal role. Record whether the organisation acts as provider, deployer, importer, distributor or product manufacturer for each use. Flag modifications, rebranding and purpose changes that may shift responsibilities. Role determines the control owner.
The third decision is immediate applicability. Screen for prohibited practices, Article 50 transparency, AI literacy and any general-purpose AI provider obligations. Test live customer journeys: calls, chat, avatars, generated images, public-interest text and emotion or biometric categorisation. Correct visible gaps first because they combine legal exposure with customer trust.
The fourth decision is future high-risk exposure. Map Annex III uses and AI embedded in regulated products even though their deadlines moved. For plausible high-risk systems, perform a readiness assessment against risk management, data governance, documentation, logs, human oversight, accuracy, robustness and cybersecurity. Do not claim conformity early; measure the gap. h decision is evidence ownership. Assign one accountable business owner per system and one control owner per obligation. Set review triggers for vendor changes, new data, new markets, incidents and material changes in purpose. Compliance must follow the system lifecycle, not the annual policy calendar.
A seventh practical choice concerns tolerance for uncertainty. Not every classification question will have a definitive answer before standards and enforcement practice mature. Organisations should record the interpretation adopted, the evidence considered, the accountable decision-maker and the event that would trigger reassessment. That turns uncertainty into a managed decision rather than an undocumented assumption. It also prevents teams from presenting a provisional legal view as a permanent technical fact. A regulator may disagree with a classification, but a reasoned record is more credible than discovering that nobody can explain why a system was treated as outside scope.
The sixth decision is escalation. Define who can pause a deployment, remove content, notify a vendor, preserve logs and contact authorities. Test that process through a realistic scenario. An AI incident is a poor moment to discover that legal, security, product and communications teams use different system names and cannot retrieve the same evidence.
Compliance now is cheaper than reconstruction later
The AI Act’s staggered implementation can make delay look rational. Some technical standards are still developing, national enforcement will vary, and the largest high-risk obligations now sit in 2027 and 2028. A company may reasonably avoid building final controls before specifications settle. It should not avoid the factual work that every later control depends on.
Inventory, classification, ownership and evidence are no-regret investments. They reveal prohibited or undisclosed uses today and reduce the cost of future conformity work. They also improve procurement, security, privacy and incident response. By contrast, waiting creates path dependence: AI becomes embedded in customer journeys, employment processes and supplier contracts before the organisation has negotiated access to logs, documentation or change notices.
The forward judgment is therefore conditional but firm. Organisations with only low-impact internal tools may need a proportionate programme rather than a large compliance office. Providers of general-purpose models, customer-facing generative services and systems likely to fall within high-risk categories need deeper technical and legal work. The scale should follow risk; the discipline should not disappear.
The strongest reason to comply is not fear of the maximum fine. It is control over systems that increasingly speak, recommend, classify and generate content on an organisation’s behalf. The AI Act is now enforceable where its current duties apply, and the extended deadlines increase—not reduce—the value of starting properly. That judgment would weaken if the EU suspended enforcement or materially narrowed scope again. The evidence available on 3 August 2026 points the other way: transparency and existing duties are active, while the postponed high-risk timetable gives organisations a defined runway to build defensible systems rather than excuses.
Yes. Regulation (EU) 2024/1689 entered into force on 1 August 2024. Its obligations apply in stages, so the relevant question is which provisions apply to a particular system and organisation on a particular date.
No. Transparency rules and enforcement of several already-applicable duties began then, but the 2026 AI Omnibus moved many Annex III high-risk requirements to 2 December 2027 and product-embedded high-risk requirements to 2 August 2028.
The Commission says companies whose staff use tools such as ChatGPT should address relevant risks. Article 4 requires measures supporting AI literacy, but it does not mandate one universal course, certificate or governance structure.
No. Article 50 distinguishes providers, deployers, types of content and context, and contains exceptions. Deepfakes and certain public-interest text have specific disclosure rules, while providers of generative systems have machine-readable marking duties.
There is no general exemption for small businesses. Proportionality, support measures and penalty calculations may account for size, but applicable obligations still depend on role and use.
No. A vendor can supply compliant technology and documentation, but deployers remain responsible for their own purpose, context, staff, disclosures and use of outputs.
They justify sequencing work, not inactivity. Inventory, role mapping, supplier evidence, data governance and control ownership are prerequisites for later high-risk conformity and can reveal current transparency or prohibited-practice issues.
No. The AI Act applies alongside data-protection, cybersecurity, consumer, employment and sector-specific law. An AI system can be low-risk under the AI Act and still create significant GDPR obligations.
Create a verified inventory of AI systems and uses, assign legal roles and owners, screen for current duties, test disclosures, document AI-literacy measures and identify systems likely to become high-risk.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
Regulation (EU) 2024/1689 Artificial Intelligence Act
The official legal text established the Act’s scope, roles, risk categories, obligations, penalties and original phased application framework.
The European Commission confirmed the July 2026 amendments and the extension of selected implementation deadlines.
Timeline for the implementation of the EU AI Act
The official AI Act Service Desk supplied the updated milestone sequence through August 2028.
Commission starts enforcing AI Act rules and new transparency requirements
The Commission confirmed that EU and national enforcement began for applicable provisions on 2 August 2026.
Guidelines on transparency obligations for providers and deployers
The Commission explained the provider and deployer duties under Article 50 for interactive systems and synthetic content.
Transparency obligations under Article 50 of the AI Act
The official FAQ clarified the August 2026 start date, scope and limited transition for certain pre-existing systems.
Code of Practice on transparency of AI-generated content
The Commission distinguished the voluntary code from the binding transparency obligations in Article 50.
AI literacy questions and answers
The Commission detailed Article 4’s scope, proportionate training approach, documentation options and enforcement arrangements.
Guidelines for providers of general-purpose AI models
The Commission set out the GPAI compliance and enforcement timeline and the information-submission process.
Guidelines for providers and deployers of high-risk AI systems
The Commission confirmed the revised 2027 and 2028 dates for the two main high-risk categories.
Guidelines on the definition of an artificial intelligence system
The Commission provided non-binding interpretive guidance for determining whether software falls within the Act’s AI-system definition.
Opinion 28/2024 on AI models and personal data
The European Data Protection Board explained why AI models trained with personal data cannot automatically be treated as anonymous.
Artificial intelligence and next-generation technologies
ENISA supplied the cybersecurity context for the AI Act’s risk-based product-safety approach.
AI’s cookie banner moment as EU labels come for bots
The Financial Times reported business concerns about late guidance, compliance cost and the risk of disclosure fatigue.
EU countries and lawmakers agree delayed high-risk AI rules
Reuters documented the political agreement that moved key high-risk deadlines before the final 2026 amendments.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
