What Does the EU AI Act Require from Companies?

Risk Levels

The AI Act classifies applications by risk:

• Prohibited – such as social scoring of individuals by authorities or emotion recognition in the workplace. These prohibitions are already in effect.
• High Risk – applications in personnel selection, credit granting, education, critical infrastructure, or as a safety component of a regulated product.
• Transparency Obligations – chatbots, generated images, and texts.
• Low Risk – everything else, without special obligations.

What Applies from August 2, 2026

The transparency obligations under Article 50:

• A chatbot must make it clear that one is interacting with a machine.
• Artificially generated or altered images, audio, and video recordings must be machine-readable labeled.
• Deepfakes must be disclosed as such.

For most companies, this is the only point that initially matters.

What Has Been Postponed

The extensive obligations for high-risk applications – risk management, technical documentation, human oversight, conformity assessment – were originally set to take effect earlier. With the so-called Digital Omnibus, the deadlines were postponed in July 2026: standalone high-risk systems under Annex III to December 2027, AI embedded in regulated products under Annex I to August 2028.

At the time of this compilation, the act had not yet been published in the official journal. Those affected should check the status before making investment decisions.

What Makes Sense Now

1. Identify which AI applications are currently in use within the company.
2. Classify: prohibited, high risk, transparency obligation, or non-critical.
3. Label chatbots and generated content.
4. Train employees – the obligation for AI competence is already in effect.

This text does not replace legal advice.