Your staff are already using AI: a chatbot to draft emails, a meeting-notes assistant, an AI feature inside your HR or CRM software. Under the EU AI Act, some of your obligations for that use already apply, and the timetable for the rest changed in July 2026.
This guide explains where the AI Act stands as of October 2026, which dates moved under the Digital Omnibus on AI, what the AI literacy duty and the Article 15 cybersecurity requirement mean in practice, and the steps you should take now.
The AI Act in one paragraph
The AI Act is Regulation (EU) 2024/1689. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It applies to organisations that place AI systems on the EU market or use them in the EU, including companies based outside the EU. It takes a risk-based approach: the higher the risk an AI use poses to health, safety or fundamental rights, the stricter the rules.
Most obligations attach to two roles:
- Providers develop an AI system (or have it developed) and place it on the market or put it into service under their own name.
- Deployers use an AI system under their authority in a professional context. Most businesses are deployers of tools they buy.
Importers, distributors and authorised representatives also have defined duties. One organisation can hold several roles, for example if you build an AI feature into your own product.
The four risk categories
| Category | Treatment | Examples |
|---|---|---|
| Unacceptable risk | Prohibited (Article 5) | Harmful manipulation, social scoring, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools (with limited exceptions) |
| High risk | Allowed, subject to strict requirements | AI used in recruitment and worker management, credit scoring, education, critical infrastructure, essential services, law enforcement, migration and justice (Annex III); AI that is a safety component of regulated products (Annex I) |
| Transparency risk | Disclosure duties (Article 50) | Chatbots must tell people they are dealing with AI; AI-generated or manipulated content, including deepfakes, must be identifiable |
| Minimal or no risk | No specific AI Act rules | Spam filters, AI in video games, most everyday productivity uses |
Separately, the Act sets rules for general-purpose AI (GPAI) models, such as large language models, which mainly fall on the model providers rather than on businesses that use them.
Application dates after the Digital Omnibus
The AI Act applies in stages. In November 2025 the European Commission proposed the Digital Omnibus on AI to simplify implementation and delay the high-risk rules. That proposal is no longer a proposal: it was adopted as Regulation (EU) 2026/1744, signed on 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026.
| Obligation | Original date | Date as of October 2026 |
|---|---|---|
| Prohibited practices (Art. 5) and AI literacy (Art. 4) | 2 February 2025 | 2 February 2025 – already applies |
| GPAI model obligations, governance, penalties | 2 August 2025 | 2 August 2025 – already applies |
| General application, including transparency duties (Art. 50) | 2 August 2026 | 2 August 2026 – already applies |
| Machine-readable marking of AI-generated content (Art. 50(2)) for systems placed on the market before 2 August 2026 | 2 August 2026 | 2 December 2026 (grace period) |
| New prohibition: AI systems generating non-consensual intimate content or child sexual abuse material | Not in original Act | 2 December 2026 |
| High-risk systems in Annex III (e.g. employment, credit, education) | 2 August 2026 | 2 December 2027 |
| High-risk systems in Annex I (AI in regulated products) | 2 August 2027 | 2 August 2028 |
| Legacy high-risk systems used by public authorities | 2 August 2030 | 2 August 2030 |
Three points to take from this:
- Nothing that already applied was paused. The prohibitions, AI literacy, GPAI rules and penalties continue to apply.
- Transparency rules were not postponed. If you run a customer-facing chatbot or publish AI-generated content, Article 50 applies now.
- The high-risk delay is time to prepare, not an exemption. If you use AI for hiring, performance evaluation or creditworthiness, December 2027 is closer than it looks once you factor in vendor contracts and documentation.
The Omnibus also extended simplified documentation to small mid-cap companies, widened access to regulatory sandboxes and strengthened the AI Office’s oversight of AI systems built on GPAI models.
Do not confuse this with the wider Digital Omnibus. The Commission’s separate Digital Omnibus proposal on data, GDPR and a single incident-reporting entry point is a different legislative file. As of October 2026 it is still a proposal under negotiation and has not been adopted.
Italy: national AI law
Italy adopted its own framework law, Law No. 132 of 23 September 2025, in force since 10 October 2025. It complements the AI Act and designates AgID and ACN as national AI authorities. If you operate in Italy, follow guidance from both.
AI literacy (Article 4): the obligation that already applies
Article 4 applies to all providers and deployers, whatever the risk level of the AI system. It is the obligation most businesses already have today.
The Digital Omnibus rewrote Article 4. In its amended form, providers and deployers shall take measures to support the development of AI literacy of their staff. The amended text makes clear that this does not require you to guarantee any specific level of AI literacy for any individual. The Commission and Member States must support these efforts, and the Commission will publish practical examples of how to comply.
In practice, “measures” means you should be able to show:
- Which staff use or oversee which AI systems.
- What training or guidance each group received, and when.
- That the content fits their role, technical knowledge and the context of use.
- That training is refreshed when tools or risks change.
Article 99 does not set a dedicated fine tier for Article 4. Even so, documented AI literacy is the foundation for meeting the human-oversight and transparency duties that are enforced, and it is the first thing a regulator or customer is likely to ask about.
Cybersecurity for high-risk AI (Article 15)
Article 15 requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity, and to perform consistently throughout their lifecycle. Its main elements are:
- Declared accuracy: accuracy levels and metrics must be stated in the instructions for use.
- Resilience: systems should be as resilient as possible to errors, faults and inconsistencies, using technical and organisational measures such as redundancy and fail-safe plans.
- Feedback loops: systems that keep learning after deployment must reduce the risk of biased outputs influencing future inputs.
- Resistance to attack: systems must resist attempts by unauthorised third parties to alter their use, outputs or performance by exploiting vulnerabilities.
- AI-specific threats: where appropriate, measures must prevent, detect, respond to and control attacks such as data poisoning, model poisoning, adversarial examples (model evasion), confidentiality attacks and model flaws.
Under the amended timetable, Article 15 applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Article 15 duties fall mainly on providers, but deployers need evidence from their vendors that the requirements are met, and deployers’ own security controls around the system still matter.
For a security team, Article 15 extends familiar practice to AI: threat modelling that includes prompt injection and poisoning, access control on models and training data, logging, testing before release, and incident response that covers AI behaviour. Our article The AI Tools You Trust Can Be Turned Against You covers the attack side, and Zero Trust Architecture is a useful model for limiting what an AI tool can reach.
Penalties
Article 99 sets maximum fines of up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for breaches of most other operator obligations; and up to EUR 7.5 million or 1% for supplying incorrect or misleading information to authorities. For large companies the higher figure applies; for SMEs and start-ups, the lower one.
This is general guidance, not legal advice.
What to do now: practical steps
1. Build an AI inventory
You cannot classify what you have not found. Start with procurement records, SaaS admin consoles, browser extension lists and a short staff survey. Many AI features arrive silently inside existing software.
| Field | What to record |
|---|---|
| System / feature | Name, vendor, version, whether built in-house |
| Business owner | Named person accountable for the use |
| Purpose and users | What it is used for, by which teams, affecting whom |
| Your role | Provider, deployer or both |
| Risk category | Prohibited, high (Annex I/III), transparency, minimal; with reasoning |
| Data | Personal data, confidential data, where it is processed and stored |
| Security | Access controls, logging, vendor security evidence |
| Training | Which users received AI literacy training and when |
2. Check for prohibited uses and transparency duties
Confirm that nothing in the inventory falls under Article 5. Then list every customer-facing chatbot and every place you publish AI-generated images, audio, video or public-interest text, and make sure the required disclosures are in place.
3. Flag potential high-risk uses early
HR screening, employee monitoring and credit decisions are the most common high-risk uses in ordinary businesses. For each, ask the vendor for its AI Act compliance roadmap, and plan for deployer duties such as human oversight, monitoring, log retention and informing workers.
4. Publish an AI acceptable-use policy
A short, clear policy prevents most problems. It should cover:
- Approved tools and how to request a new one.
- What data must never be entered into AI tools (personal data, client confidential data, credentials, source code, unless approved).
- The need for human review before AI output is used in decisions about people or sent to customers.
- Disclosure rules for AI-generated content.
- How to report errors, misuse or suspected security issues.
5. Train staff by role
One generic video will not satisfy Article 4. Plan at least three levels: all staff (what AI is, risks, your policy); power users and AI system owners (limitations, bias, oversight, data handling); and management (accountability, risk appetite, regulatory exposure). Fold this into your existing security awareness training program and keep attendance records.
6. Connect AI to your existing governance
Do not build a parallel universe. Map AI risks into your ISMS, your GDPR records, your vendor risk process and, if you are in scope, your NIS2 risk management. See our NIS2 guide for how those obligations overlap.
Quick checklist
- AI inventory created and owned
- Prohibited-practice check completed
- Article 50 disclosures in place for chatbots and generated content
- Potential high-risk uses flagged, vendors contacted
- AI acceptable-use policy approved and communicated
- Role-based AI literacy training delivered and recorded
- AI added to risk register, vendor assessments and incident response plan
AceFortis runs practical AI literacy and AI governance training for staff and management, aligned with the AI Act — get in touch to plan a session.
FAQ
Was the EU AI Act postponed?
Partly. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The prohibitions, AI literacy, GPAI rules and transparency duties were not postponed.
Does the AI Act apply if we only use tools like ChatGPT or Copilot?
Yes. As a deployer you must take AI literacy measures under Article 4, and transparency duties apply if you use AI to interact with customers or publish generated content. Most internal productivity use is otherwise minimal risk.
Does the AI Act apply to UK and US companies?
It can. The Act applies to providers placing AI systems on the EU market and, in some cases, to providers and deployers outside the EU whose AI output is used in the EU.
Who enforces the AI Act in Italy?
Italy’s Law No. 132/2025 designates AgID and ACN as national AI authorities, while the European AI Office oversees general-purpose AI models.
