Short answer: Most companies are deployers, and three duties already apply to them: do not use banned AI practices, take measures to support staff AI literacy, and meet the transparency rules in force since 2 August 2026. The heavier high-risk duties, such as for AI that screens job applicants or scores credit, apply from 2 December 2027.
As of October 2026, a company that uses AI in the EU has three duties under the AI Act that already apply. It must not use any banned AI practice. It must take measures to support the AI literacy of its staff.
And it must meet the transparency rules that started on 2 August 2026: people must know when they are talking to an AI system, and deepfakes and AI-written public-interest text must be labeled. The heavier rules for high-risk uses, such as AI that screens job applicants or scores credit, were postponed and now apply from 2 December 2027.
The date that moved is the high-risk one. In July 2026 the EU adopted the Digital Omnibus on AI, which pushed back the high-risk deadlines and rewrote the AI literacy duty. It is law, not a proposal. Below is what that means for a company that buys and uses AI rather than builds models, with a checklist you can hand to your team.
This is general information, not legal advice. For your specific systems, ask your lawyer.
Are we a provider or a deployer?
The AI Act puts most obligations on two roles. A provider develops an AI system and places it on the market or puts it into service under its own name. A deployer is anyone “using an AI system under its authority” in a professional context, as the Act defines it. If your team uses ChatGPT, Copilot, an AI feature in your CRM or a vendor’s screening tool, you are a deployer of those systems.
Two caveats matter. First, a company that builds a tool in-house and runs it under its own name is a provider of that tool. The Commission’s Article 50 guidelines give the example of an organization that develops a chatbot itself and puts it into service for its own use.
Second, under Article 25, a deployer becomes the provider of a high-risk system if it puts its name on one, makes a substantial modification, or changes the purpose of a general-purpose system so that it becomes high-risk. Wiring a general chatbot into a CV-screening step is the kind of change that can do this.
What did the Digital Omnibus change, and is it in force?
Yes, it is in force. The Commission proposed the Omnibus on 19 November 2025. Parliament and Council reached a political agreement on 7 May 2026, Parliament approved it on 16 June 2026 by 423 votes to 57, with 174 abstentions, and the Council adopted it on 29 June, according to the European Parliament’s legislative train. Regulation (EU) 2026/1744 was signed on 8 July, published in the Official Journal on 24 July and, as the Commission confirms, entered into force on 27 July 2026.
For a deployer, five changes matter:
High-risk deadlines. The rules for Annex III uses (employment, credit, education and others) now apply from 2 December 2027. The rules for AI in regulated products (Annex I) apply from 2 August 2028.
AI literacy. Article 4 no longer asks you to ensure a “sufficient level.” It asks you to take measures to support literacy.
New bans. AI that generates non-consensual intimate images of identifiable people, or child sexual abuse material, is prohibited from 2 December 2026.
Watermarking grace period. Providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to mark outputs as AI-generated.
Smaller companies. Some SME relief now also covers small mid-caps, including lower fine caps.
What did not change: the bans already in force, the Article 50 transparency rules, and the content of the deployer duties in Article 26. The Council summed up the political intent. Marilena Raouna, Cyprus’s deputy minister for European affairs, said in the Council’s announcement that “technological progress must always go hand in hand with the protection of our fundamental values.”
What is the EU AI Act timeline as of October 2026?
Date | What applies |
|---|---|
1 August 2024 | The Act enters into force |
2 February 2025 | Eight banned practices · AI literacy (Article 4) |
2 August 2025 | Obligations for providers of general-purpose AI models · governance and penalty rules |
27 July 2026 | Omnibus in force · new Article 4 wording |
2 August 2026 | Most of the Act · Article 50 transparency · enforcement by national authorities and the AI Office |
2 December 2026 | Ninth ban (intimate deepfakes, child sexual abuse material) · watermarking deadline for older generative systems |
2 December 2027 | High-risk rules for Annex III uses, including Article 26 deployer duties |
2 August 2028 | High-risk rules for AI in regulated products (Annex I) |
Sources: Article 113 of the AI Act, as amended by Article 1(40) of the Omnibus, and the Commission’s AI Act page. 2 August 2026 brought the transparency rules and enforcement. The high-risk rules come later.
Which AI practices are banned?
The Commission counts nine prohibited practices. Eight have applied since February 2025. Article 5 bans, among others, manipulative or deceptive techniques that cause significant harm, exploiting vulnerabilities due to age, disability or economic situation, social scoring, and untargeted scraping of facial images.
The one an ordinary employer can trip over is emotion recognition. Article 5 prohibits AI systems “to infer emotions of a natural person in the areas of workplace and education institutions,” except for medical or safety reasons. A sales-call tool that scores an agent’s mood, or an interview tool that reads a candidate’s face for enthusiasm, deserves a hard look. The Commission’s guidelines on prohibited practices, published 4 February 2025, give worked examples.
The ninth ban, on systems that generate intimate images of identifiable people without consent or child sexual abuse material, applies from 2 December 2026. For a deployer, it bites where the deployer uses a system for that purpose.
What does Article 4 AI literacy require now?
The new Article 4, in force since 27 July 2026, says providers and deployers “shall take measures to support the development of AI literacy” of their staff and others who operate or use AI systems on their behalf. It adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The German text calls it KI-Kompetenz, hence the search for “KI-Kompetenz Pflicht.”
So the duty still exists. It applies to every AI system you use, not only high-risk ones. What is gone is the old “sufficient level” standard. The Commission’s AI literacy Q&A makes three practical points:
A company whose staff use ChatGPT for ad copy or translation is in scope. Staff “should be informed about the specific risks, for example hallucination.”
“There is no need for a certificate.” An internal record of trainings is enough.
No AI officer or governance board is required for Article 4.
National market surveillance authorities enforce Article 4, under national penalty rules, and the Q&A says sanctions are more likely “if there is proof of an incident due to lack of appropriate training.” For high-risk deployers, the stricter training duty in Article 26 still applies on top.
What does Article 50 require: chatbots, deepfakes and AI-written text?
Article 50 has applied since 2 August 2026, and the Omnibus did not delay it. The Commission’s 31 July press release put it plainly: chatbots must tell users they are dealing with AI, and deepfakes must be labeled. Four duties are worth knowing:
Chatbots and voice agents (Article 50(1)). People must be told they are interacting with AI unless it is obvious. The legal duty sits with the provider, which includes you if you built the bot in-house. The Commission’s guidelines of 20 July 2026 list helpdesk chatbots whose replies users “may perceive as human-generated” as cases where the obviousness exception does not apply.
Deepfakes (Article 50(4)). Deployers must disclose that image, audio or video content has been artificially generated or manipulated. Artistic or satirical work gets a lighter regime.
AI-written public-interest text (Article 50(4)). Deployers must disclose AI-generated text “published with the purpose of informing the public on matters of public interest,” unless it has undergone human review or editorial control and someone holds editorial responsibility. The guidelines say spell-checks and “cursory editorial approval” do not count, and they cite AI-edited investor reports on a listed company’s website as in scope. They place ordinary ad copy and product descriptions outside the rule, but expressly not claims about health, consumer safety or sustainability.
Emotion recognition and biometric categorization (Article 50(3)). Where these are lawful, deployers must inform the people exposed.
The disclosure must be clear and given “at the latest at the time of the first interaction or exposure.” The Commission’s voluntary Code of Practice on AI-generated content includes EU icons you can use, and more than 180 organizations had signed it by 31 July.
When does an ordinary business become a high-risk deployer?
When it uses an AI system for a purpose listed in Annex III. Three areas catch ordinary companies:
Recruitment and HR (point 4). Systems used “to analyse and filter job applications, and to evaluate candidates,” or to make decisions on promotion, termination, task allocation, or monitoring of performance and behavior.
Credit (point 5(b)). Systems that “evaluate the creditworthiness of natural persons or establish their credit score,” except fraud detection.
Insurance and essential services (points 5(a), (c)). Risk assessment and pricing in life and health insurance, and public-benefit eligibility decisions.
There is a narrow exit. Under Article 6(3), an Annex III system is not high-risk if it performs a narrow procedural or preparatory task and does not materially influence the decision. But a system that profiles people is always high-risk. The Commission published draft classification guidelines on 19 May 2026 and says the final version will be adopted by the end of 2026.
What does Article 26 require from a high-risk deployer?
From 2 December 2027, Article 26 requires deployers of Annex III systems to:
use the system according to the provider’s instructions for use;
assign human oversight to people “who have the necessary competence, training and authority”;
make sure input data they control is relevant and sufficiently representative;
monitor the system, and inform the provider and the authority, and suspend use, if it presents a risk; report serious incidents;
keep the automatically generated logs under their control for at least six months;
inform workers’ representatives and affected workers before using a high-risk system at work;
inform people when a high-risk system makes or assists decisions about them.
Private companies that use AI for credit scoring or life and health insurance pricing must also run a fundamental rights impact assessment under Article 27. The oversight rule is easiest to meet if you design for it from the start: a named person who reviews and can overrule the output. We cover where to put those approval points in a separate guide.
Do the general-purpose AI rules apply to us?
Mostly not. The obligations for general-purpose AI models, on technical documentation, copyright and training-data summaries, fall on the providers of those models and have applied since 2 August 2025. The Commission’s AI Office holds the enforcement powers over them, which it has used since 2 August 2026. As a user of a model, your exposure is through the system you build or deploy on top of it: Article 50, Article 4, and the high-risk rules if your use case falls in Annex III.
What should a deployer do this quarter? A ten-point checklist
Build an AI inventory. List every AI system in use, including AI features inside tools you already pay for. Note the owner and the purpose of each.
Classify each use. Banned, high-risk (Annex III), transparency (Article 50) or minimal. Record your reasoning in a sentence or two.
Remove anything banned. Check especially for workplace emotion recognition.
Run literacy measures. Short, role-based sessions: what the tool does, where it fails, what staff must check. Keep an internal record.
Add transparency notices. Chatbots and voice agents say they are AI at the first interaction. Deepfakes and public-interest text get labels unless a person has substantively reviewed the text and someone owns the publication.
Check your role. If you built a system in-house or changed a tool’s purpose, you may be a provider.
Fix vendor contract terms. Ask for instructions for use, the vendor’s own classification, a commitment to Article 50 compliance, log access, incident notification, and notice of changes to the model.
Name human oversight. For every high-risk or consequential use, one person with the competence and authority to overrule or stop the system.
Keep logs. Make sure the logs your systems generate are retained for at least six months where you control them, in line with data protection rules.
Set an incident route. Who stops the system, who informs the provider, and who informs the authority, written down before you need it.
Fines show why the order matters. Breaching the bans can cost up to €35 million or 7 percent of worldwide annual turnover, whichever is higher. Breaching the deployer or transparency duties can cost up to €15 million or 3 percent, according to Article 99. For SMEs, and since the Omnibus also small mid-caps, the lower of the two figures applies.
We are in the UK or the US. Does this apply to us?
It can. Article 2(1)(c) applies the Act to providers and deployers outside the EU “where the output produced by the AI system is used in the Union.” If your chatbot answers customers in Germany, your AI screens applicants for a role in Amsterdam, or your marketing team publishes AI-generated video aimed at EU audiences, you are likely in scope for that use.
The Commission’s Article 50 guidelines add a useful limit: a deployer outside the EU is not bound where content reaches EU audiences “through channels that are unforeseeable and outside their control.”
For a UK or US company with EU customers or staff, the practical answer is to run the same inventory and apply the checklist to the uses that touch the EU.
Where to start
Start with the inventory, because every other item on the checklist depends on it. Then fix the two things that already apply, literacy records and transparency notices, and put the high-risk work on a plan that ends well before December 2027.
Your lawyer or data protection officer decides how each system is classified. We build the workflow around that decision, with the approval points, logs and staff training it needs. To check one workflow, book a fit check. For the design side, read how to choose your first AI workflow, and for the budget, our guide to AI implementation cost in 2026.
Frequently asked questions
Are we a provider or a deployer under the AI Act?
If your team uses ChatGPT, Copilot, an AI feature in your CRM or a vendor’s tool, you are a deployer of those systems. You become a provider if you build a tool in-house and run it under your own name. A deployer can also become the provider of a high-risk system by rebranding, substantially modifying or repurposing it.
Is the Digital Omnibus on AI in force?
Yes. Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved the high-risk deadlines to 2 December 2027 for Annex III uses and to 2 August 2028 for AI in regulated products, and it rewrote the AI literacy duty in Article 4.
What does AI literacy under Article 4 require?
Companies must take measures to support the AI literacy of the staff who use AI on their behalf. There is no required level and no need for a certificate. An internal record of trainings is enough, and no AI officer is required. The duty applies to every AI system you use.
What does Article 50 require from companies?
People must be told when they are talking to a chatbot or voice agent, unless it is obvious. Deployers must disclose deepfakes. They must also disclose AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and someone holds editorial responsibility.
Does the EU AI Act apply to UK or US companies?
It can. The Act applies to providers and deployers outside the EU where the output of the AI system is used in the Union. A UK or US company with EU customers or staff should run the same inventory and apply the checklist to the uses that touch the EU.
Related reading
Sources
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal, July 12, 2024. Articles 2, 3, 5, 6, 25, 26, 27, 50, 99, 113 and Annex III.
Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, July 24, 2026. Article 1(5), (7), (39), (40).
European Commission, AI Act, page updated August 3, 2026.
European Commission, AI Omnibus enters into force, July 27, 2026.
European Commission, Commission starts enforcing AI Act rules and new transparency requirements on 2 August, July 31, 2026.
European Commission, Guidelines on transparency obligations for providers and deployers of AI systems, C(2026) 5054, July 20, 2026.
European Commission, Code of Practice on Transparency of AI-generated Content, page updated July 31, 2026.
European Commission, AI Literacy: Questions & Answers, accessed October 4, 2026.
European Commission, Guidelines on prohibited artificial intelligence practices, February 4, 2025.
European Commission, Draft guidelines on the classification of high-risk AI systems, May 19, 2026, and the targeted consultation.
Council of the EU, Artificial Intelligence: Council gives final green light to simplify and streamline rules, June 29, 2026.
European Parliament, Legislative Train: Digital Omnibus on AI, procedure 2025/0359(COD), updated September 20, 2026.