The EU AI Act for businesses: what do you need to do?

What does the EU AI Act for businesses ask right now, and what comes later?

The EU AI Act for businesses depends on three things: which AI an organisation uses or builds, which of the four risk categories it falls into, and whether the organisation is a provider or a deployer. The prohibited practices and the AI-literacy duty have applied since 2 February 2025 and the transparency obligations since 2 August 2026; the ninth prohibition only applies from 2 December 2026, and systems already on the market before 2 August 2026 get a transitional period until 2 December 2026 for machine-readable content marking. The high-risk rules have applied since the Digital Omnibus from 2 December 2027 for Annex III applications and from 2 August 2028 for AI in Annex I products (as of October 2026).

Can an organisation become a provider under the EU AI Act for businesses without meaning to?

Yes. Under Article 25, that happens with a high-risk system when an organisation puts its own name or brand on it, modifies it substantially, or deploys a system in a way that turns it into a high-risk application. Under the EU AI Act for businesses, that question comes up, for example, with a general-purpose AI tool that starts ranking job applicants.

How long does a deployer of a high-risk system keep the logs under the EU AI Act for businesses?

At least six months is how long a deployer of a high-risk system keeps the automatically generated logs, under Article 26. Under the EU AI Act for businesses, that same article also names human oversight, incident reporting and informing staff and their representatives in advance for deployers using such a system in the workplace.

Does the EU AI Act for businesses come up in the AI Readiness Assessment?

Yes. The AI Readiness Assessment includes a risk and compliance scan, including the positioning of applications under the AI Act. For a board or supervisory board that needs a shared picture first, the Executive Briefing also covers regulation and supervision.

Source: article by Dave Willemstein; primary source: European Commission, "AI Act" (regulatory framework AI); Regulation (EU) 2024/1689 (AI Act), EUR-Lex; Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal L, 24.7.2026, EUR-Lex; European Commission, "AI Omnibus enters into force" (27 July 2026) (as of 6 October 2026). Updated: October 2026.

What is the AI Act?

The AI Act, formally Regulation (EU) 2024/1689, is the European law that sets rules for developing and using AI. It took effect on 1 August 2024 and applies in stages. Because it’s a regulation rather than a directive, it applies directly in all EU member states, with no national implementing law needed first.

The starting principle is simple: the greater the risk an AI application poses to health, safety or fundamental rights, the stricter the rules. For the AI Act for businesses, that means most applications you use today, such as text assistants, summarising tools or a search function across internal documents, fall into the lightest category. But a handful of obligations apply to almost everyone, including many UK organisations.

The Act’s reach isn’t limited to organisations established in the EU. Under Article 2 of the Act, it also applies to UK organisations that place an AI system on the EU market, and to UK providers or deployers whose AI system’s output is used in the EU, regardless of where the organisation itself is established. The UK has no AI Act of its own: it regulates AI through existing sector regulators, such as the ICO for data protection and the FCA for financial services, applying shared principles rather than one cross-cutting AI law, as set out in the UK government’s AI regulation: a pro-innovation approach. So a UK-only organisation with no EU market presence and no EU users of its AI output sits outside the Act’s scope, but many UK organisations with EU customers, staff or users of their AI systems are in scope even though they’re not established in the EU.

In 2026, the Act was amended for the first time. The European Commission proposed the Digital Omnibus in November 2025 to simplify the rules and postpone the high-risk obligations. The European Parliament and the Council reached a political agreement on 7 May 2026. The amendment was published as Regulation (EU) 2026/1744 and, according to the European Commission, took effect on 27 July 2026. That’s no longer a proposal, but settled law.

The main changes brought by the Omnibus:

• The high-risk rules move to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• The AI-literacy duty is softened to a duty to take measures, without a required level; the Commission and member states get a bigger role in supporting that.
• Simplifications for SMEs now also apply to so-called small mid-caps.
• The registration duty for exempt systems in the EU database has been simplified.
• A new prohibition has been added on AI systems that generate non-consensual intimate images, such as nudify apps. That prohibition applies from 2 December 2026.
• Processing special categories of personal data to detect and correct bias is permitted, under conditions.

This page is a practical explainer, not legal advice. Have the classification of your own applications reviewed by a lawyer or your data protection officer.

Risk categories

The AI Act has four risk levels. For each application, you determine which category it falls into; that’s your own responsibility as an organisation.

1. Unacceptable riskProhibited, such as social scoring and emotion recognition in the workplace
2. High riskStrict requirements, for example in recruitment or credit scoring
3. Transparency riskInformation duty, for example for chatbots and AI-generated content
4. Minimal riskNo specific AI Act rules; most AI in use today falls here

Unacceptable risk. Since 2 February 2025, certain practices have been prohibited. The European Commission names nine after the Omnibus; the ninth prohibition only applies from 2 December 2026. The nine are: harmful manipulation and deception, exploiting vulnerabilities, social scoring, predicting criminal offences based on personal characteristics, untargeted scraping of facial images, emotion recognition in the workplace and in education, biometric categorisation by protected characteristics, real-time remote biometric identification by police in public spaces, and systems that generate non-consensual intimate images or child sexual abuse material.

High risk. The heaviest requirements apply here: risk management, data quality, logging, documentation, human oversight and robustness. There are two groups. The first are AI systems in products already covered by EU product legislation (Annex I). The second are applications in sensitive areas (Annex III): biometrics, critical infrastructure, education and vocational training, employment, access to essential private and public services, law enforcement, migration and border management, and the administration of justice and democratic processes. For businesses, recruitment, staff assessment and credit scoring are the most recognisable examples.

Transparency risk. People need to know when they’re dealing with AI. A chatbot has to disclose that it’s an AI system, deepfakes have to be labelled as such, and AI-generated content has to be marked in a machine-readable way.

Minimal risk. All other AI, such as spam filters or a text assistant for internal notes. No specific AI Act rules apply here, though the AI-literacy duty still applies to anyone deploying AI.

Separate rules also apply to general-purpose AI models (GPAI), such as the language models behind chatbots. Providers of these have had to draw up technical documentation and maintain a copyright policy, among other things, since 2 August 2025. For models with systemic risk, they also have to assess and mitigate those risks. Those duties sit with the model makers, not with businesses that use them.

Obligations by role

Which AI Act obligations you have depends on your role. The two main roles are:

• Provider: the organisation that develops, or has developed, an AI system or AI model and places it on the market or puts it into service under its own name or brand, whether paid or free.
• Deployer: the organisation that uses an AI system under its own authority, except for purely personal, non-professional use.

The Act also recognises importers and distributors. Most businesses are deployers. Watch out, though: you can become a provider without meaning to. Under Article 25, that happens with a high-risk system if you put your own name or brand on it, modify it substantially, or deploy a system in a way that turns it into a high-risk application. Anyone planning to use a general-purpose AI tool to rank job applicants should take that question seriously.

Obligation	Provider	Deployer
AI literacy (take measures)	Yes	Yes
Transparency for chatbots and generated content	Design the system so people know, and mark content	Disclose deepfakes and emotion recognition; inform people
High risk: conformity assessment, CE marking, technical documentation	Yes	No
High risk: use according to instructions, human oversight, keep logs	Support with instructions	Yes
High risk: inform staff and those affected	No	Yes

For deployers of high-risk systems, Article 26 names, among other things: using the system according to the instructions for use, assigning human oversight to people with the right knowledge and authority, using relevant input data, monitoring operation and reporting incidents, keeping automatically generated logs for at least six months, and informing staff and their representatives in advance if you deploy such a system in the workplace.

If you work with AI that acts autonomously and processes personal data while doing so, data protection law, UK GDPR or EU GDPR depending on where you operate, applies alongside the AI Act. That interaction between AI agents and data protection law is a topic in its own right.

Timeline

This is the timeline as the European Commission publishes it after the Digital Omnibus (as of October 2026):

Date	What takes effect
1 August 2024	The AI Act takes effect
2 February 2025	Prohibited practices and the AI-literacy duty
2 August 2025	Governance rules and obligations for providers of general-purpose AI models
27 July 2026	The Digital Omnibus (Regulation (EU) 2026/1744) takes effect
2 August 2026	General application of the regulation, including the transparency obligations; the AI Office and national supervisory authorities start supervision and enforcement
2 December 2026	New prohibition on AI that generates non-consensual intimate images or child sexual abuse material; machine-readable marking of generated content for systems already on the market before 2 August 2026
2 December 2027	High-risk rules for Annex III applications, such as recruitment, education and biometrics
2 August 2028	High-risk rules for AI in products under EU product legislation (Annex I)

Note: at the time of checking in October 2026, not every UK and EU government page had been updated to reflect the new high-risk dates yet. Where in doubt, go by the European Commission’s own timeline and the text in the Official Journal.

First steps for businesses

You don’t have to wait until December 2027. The obligations that already apply now are straightforward to organise, and preparing for high risk takes time. A practical order:

1. Map your AI applications. Which tools and systems do you use, for what, with which data, and from which vendor? This register is the basis for everything that follows.
2. Determine the risk category and your role for each application. Are you a provider or a deployer? Does the application fall under an Annex III area?
3. Check for prohibited practices. Rare in ordinary business use, but check explicitly for emotion recognition or staff monitoring.
4. Arrange AI literacy. Take measures appropriate to who does what with AI, and keep a record of what you’ve done. An AI literacy training is a logical building block for this.
5. Check your transparency. Do customers know they’re talking to a chatbot? Do you mark AI-made images or video where required?
6. Prepare for high-risk applications. Ask vendors what documentation and instructions for use they provide, assign human oversight, and inform your staff council or employee representatives in good time.
7. Record it in policy and governance. Make the agreements part of your AI policy and set up light-touch oversight, the kind described in AI governance without bureaucracy.

Want to know where you stand? The AI Readiness Assessment includes a risk and compliance scan, including the positioning of your applications under the AI Act. If your board or supervisory board needs a shared picture first, the Executive Briefing also covers regulation and supervision. And if you’d like to talk through what the AI Act means for your situation, book a short call.