What does the EU AI Act mean for my organisation?

Who the Act applies to

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, often called the Digital Omnibus on AI) sets rules for AI in the European Union. It names two main roles:

• Provider: an organisation that develops an AI system, or has one developed, and puts it on the market or into service under its own name.
• Deployer: an organisation that uses an AI system under its authority, for example a company whose staff use an AI assistant at work.

Many organisations are deployers. You can also become a provider if you build an AI tool and offer it to others under your name. The Act reaches beyond the EU: it covers providers placing AI on the EU market wherever they are based, and providers and deployers outside the EU where the output of their AI system is used in the EU. Purely personal, non-professional use is outside the deployer duties.

Want to know where your current use of AI sits under the Act? Book a free AI Value Briefing and we will look at it with you.

AI literacy: what changed in 2026

Article 4 is the duty that touches every organisation that provides or uses AI systems. As amended by Regulation (EU) 2026/1744, it says providers and deployers shall take measures to support the development of AI literacy of their staff and others using AI on their behalf, taking into account their knowledge, experience and the context of use. The amended text states plainly that it does not require a specific level of AI literacy for any individual.

In practice this means sensible, proportionate steps: clear guidance on approved tools, short training on real tasks, and someone people can ask. Keep a simple record of what you did.

Being open when people deal with AI

Article 50 sets transparency duties that apply from 2 August 2026:

• AI systems that talk with people must be designed so people know they are dealing with AI, unless that is obvious.
• Providers of tools that generate images, audio, video or text must mark the output in a machine-readable way.
• Deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and holds editorial responsibility.
• Deployers using emotion recognition or biometric categorisation must inform the people exposed to it.

High-risk uses

Annex III lists areas where AI is treated as high risk. Examples relevant to many businesses: recruiting and screening candidates, decisions on promotion or dismissal, credit scoring (fraud detection is excluded), risk assessment and pricing for life and health insurance, admission and grading in education, and safety components in critical infrastructure such as water, gas, electricity and road traffic.

Deployers of high-risk systems must, among other things, follow the provider's instructions, give oversight to competent people, keep the system's logs for at least six months, inform workers' representatives before using such a system at work, and tell people when a high-risk system is used in decisions about them. Following the Digital Omnibus, the European Commission's AI Act Service Desk gives 2 December 2027 for the Annex III rules and 2 August 2028 for high-risk AI built into regulated products.

Banned practices and penalties

A short list of practices has been banned since 2 February 2025, such as manipulative techniques that cause significant harm, social scoring, and emotion recognition in workplaces and schools (with medical and safety exceptions). The 2026 amendment adds bans on AI that creates non-consensual intimate images of real people or child sexual abuse material, applying from 2 December 2026. Our article on where you can use AI lists them in plain words.

Fines are set in Article 99. For banned practices they can reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher; for many other breaches, EUR 15 million or 3%. For small and medium-sized enterprises the lower of the two figures applies. Enforcement is carried out by national authorities, and by the EU AI Office for general-purpose AI models.

This is general information, not legal advice.

Goes deeper in our free AI Field Guide: 10. Data safety: what never to paste, and other rules, 26. Guardrails and permissions: what AI may and may not do, 32. Leading AI adoption: what leaders do differently. Ask for these guides.