What the EU AI Act actually requires of you in 2026

Most of what is written about the EU AI Act is written for providers: the organisations that develop AI systems and place them on the market. Most organisations reading it are not providers. They are deployers: they buy AI systems and use them under their own authority. The obligations are different, lighter, and far more concrete than the discourse suggests.

This is a practitioner's summary of Regulation (EU) 2024/1689, not legal advice. How the Act applies to your organisation is a question for your own counsel and your data protection officer. Read this alongside them, not instead of them.

Updated on 11 October 2026 for Regulation (EU) 2026/1744, which moved the high-risk dates and reworded the AI literacy duty.

The timeline

The Act entered into force on 1 August 2024 and applies in stages. Regulation (EU) 2026/1744, in force since 27 July 2026, pushed the high-risk dates back:

• 2 February 2025: the prohibitions in Article 5, and the AI literacy duty in Article 4.
• 2 August 2025: obligations for general-purpose AI models, the governance structures, and most of the penalty regime.
• 2 August 2026: general applicability, including the Article 50 transparency duties.
• 2 December 2027: the high-risk obligations for Annex III systems. The original date was 2 August 2026.
• 2 August 2028: high-risk systems that are safety components of products already regulated under the Annex I legislation. The original date was 2 August 2027.

If you are a deployer, the transparency duties have applied since 2 August 2026, and 2 December 2027 is your date for anything high-risk.

First, work out what you are

Article 3 distinguishes the provider, who develops an AI system and places it on the market, from the deployer, who uses one under their own authority. Buying a commercial AI assistant makes you a deployer. So does switching on the AI features in a SaaS product you already licence.

The trap is Article 25. You become a provider, with the full high-risk obligation set, if you put your own name or trademark on a high-risk system, make a substantial modification to one, or repurpose a system so that it now serves a high-risk purpose it was not designed for. Building an internal hiring assistant on top of a general-purpose model is the textbook case.

Classify every system

There are four buckets.

Prohibited (Article 5). Social scoring, untargeted scraping of facial images, emotion inference in the workplace and in education, and the rest of the list. These have been unlawful since February 2025. There is no compliance path, only removal.

High-risk (Article 6 and Annex III). Employment and worker management, access to education, creditworthiness, essential private and public services, biometrics, critical infrastructure, law enforcement, migration, administration of justice. If you are screening CVs or scoring applicants with a model, you are here.

Limited risk (Article 50). Systems that interact directly with people, generate synthetic content, or perform emotion recognition or biometric categorisation. The obligation is disclosure.

Minimal risk. Everything else, which is most of it. No obligations beyond AI literacy.

The classification decision is itself the artefact a regulator will ask for. Record the reasoning, not just the outcome.

Deployer obligations for high-risk systems

Article 26 is the core of it:

• Use the system in accordance with the provider's instructions for use, and keep those instructions.
• Assign human oversight to people with the competence, training and authority to actually intervene, not a nominal reviewer.
• Ensure input data is relevant and sufficiently representative for the intended purpose, to the extent you control that data.
• Keep the logs the system automatically generates for at least six months, where those logs are under your control.
• Inform workers and their representatives before putting a high-risk system into use in the workplace.
• Suspend use and inform the provider and the market surveillance authority if you have reason to consider the system presents a risk.

Article 27 adds a fundamental rights impact assessment for public bodies, private entities providing public services, and deployers of creditworthiness and life or health insurance pricing systems.

Article 4 applies to everyone at every risk level: take measures to support the AI literacy of the staff who operate AI systems on your behalf. Since July 2026 the Act states that this does not mean guaranteeing a specific level.

The evidence you need to hold

Compliance here is documentary. In practice a regulator, or an enterprise customer's due-diligence team, will ask for:

1. An inventory of the AI systems in use, each with a named owner and a stated purpose.
2. A recorded risk classification per system, with the reasoning behind it.
3. The provider's instructions for use, retained, for anything high-risk.
4. A description of the human oversight arrangement: who intervenes, on what signal, with what authority.
5. Retained logs covering at least the last six months.
6. AI literacy training records.
7. A defined route for reporting serious incidents.

Every item on that list is a record about a system. If your inventory is a spreadsheet refreshed quarterly, each one becomes a manual project every time someone asks. If your inventory is continuously discovered and each system carries its own classification, owner and logs, the evidence pack is a query.

That is also the quiet reason the discovery problem and the compliance problem are the same problem. An obligation you cannot enumerate the subjects of is an obligation you cannot demonstrate you have met.

Penalties

Article 99 sets the ceilings: up to 35 million euro or 7% of total worldwide annual turnover for breaching the Article 5 prohibitions; up to 15 million euro or 3% for most other obligations, including the deployer duties in Article 26; and up to 7.5 million euro or 1% for supplying incorrect or misleading information to authorities. Whichever figure is higher applies, except for SMEs and start-ups, where the lower applies.

What to do now

Enumerate the estate. Classify each system and write down why. Find anything touching employment, credit, insurance pricing or biometrics and treat it as high-risk until you have shown otherwise. Turn on logging and confirm the retention period. Run AI literacy training and keep the attendance records.

None of that needs a legal opinion to begin. It needs an accurate answer to the question of what you are actually running.

Sources

• Regulation (EU) 2024/1689, the EU AI Act, Official Journal, 12 July 2024.
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, Official Journal, 24 July 2026.
• European Commission, AI Act Service Desk, consolidated text: Article 26, Article 27, Article 50, Article 99 and Annex III.
• European Commission, AI regulatory framework.