EU AI Act: These rules apply since August 2026

What companies
need to know now

Artificial intelligence has long become part of everyday business operations in many companies – for example, when creating and analysing texts, communicating with customers, recruiting or analysing large volumes of data. At the same time, the legal framework governing its use is becoming more concrete.

With the EU AI Act, the European Union has created a harmonised legal framework for artificial intelligence. The regulation entered into force in 2024 and has been applied gradually ever since. As of 2 August 2026, a large proportion of its provisions now apply. At the same time, the EU has extended the deadlines for certain high-risk AI systems through the so-called AI Omnibus.

For companies, this means that some requirements already apply directly, while there is more time to prepare for others. However, companies should use this time to identify their AI applications, define responsibilities and establish appropriate governance structures.

A risk-based approach: Not all AI is treated equally

The EU AI Act takes a risk-based approach. What matters, therefore, is not simply whether a company uses artificial intelligence, but above all how and under what conditions it is used. The regulation essentially distinguishes between three levels: prohibited practices, strict requirements for high-risk systems and transparency obligations for certain other applications.

Prohibited: AI practices posing an unacceptable risk

Some AI applications are prohibited in principle, regardless of the industry or size of the company – and there is no way to circumvent these restrictions through documentation or controls. These include, for example, systems for emotion recognition in the workplace or educational institutions, so-called social scoring, biometric categorisation based on sensitive characteristics (such as inferences about political opinions or sexual orientation), and the untargeted scraping of facial images from the internet or CCTV footage to create facial recognition databases. Systems designed to deliberately manipulate people or exploit their vulnerabilities are also prohibited.

Strictly regulated but permitted: High-risk AI

The situation is different for so-called high-risk AI. Its use is generally permitted, but subject to particularly extensive requirements – including risk management, documentation, data quality and human oversight. Areas affected include, for example, certain AI applications in human resources, education, critical infrastructure or biometric identification.

Additional requirements: Transparency obligations

For other AI systems that are not classified as high-risk, the regulation sets out transparency obligations – for example, requirements to identify chatbots or AI-generated content (see below). By contrast, many low-risk applications are not subject to comparable additional obligations under the AI Act.

For companies, the first step should therefore be to take stock: Which AI systems are being used, and which of the three categories do they fall into?

AI literacy remains an important factor

The AI Act has also addressed AI literacy within companies since February 2025. While the AI Omnibus has made the original requirements more flexible, building the necessary knowledge and skills remains a key consideration for companies.

Employees should understand in particular which AI systems they are permitted to use, what risks are associated with them and which internal rules apply, for example when handling confidential or personal information.

Not everyone within a company needs the same level of knowledge. Instead, training and other measures should be tailored to specific roles and applications. Someone who uses generative AI simply to support everyday tasks requires a different level of knowledge from employees who select, implement or monitor AI systems.

Non-compliance can be costly

The AI Act provides for substantial penalties. Depending on the nature and severity of the infringement, breaches of certain provisions may result in fines amounting to millions of euros or a certain percentage of the company’s worldwide annual turnover.

For prohibited AI practices, the regulation generally provides for maximum fines of up to €35 million or 7% of worldwide annual turnover. Breaches of other obligations may result in fines of up to €15 million or 3% of worldwide annual turnover. Special provisions apply when determining fines for smaller companies.

AI compliance is therefore increasingly becoming an integral part of corporate risk management.

What companies should review now

Whether a company already uses complex AI systems or only individual generative AI applications, it is advisable to take a structured look at how AI is currently being used.

The first step should be to identify which AI applications are actually being used within the company – including tools that employees may be using independently. Companies should then determine their respective role in relation to each system and identify the resulting requirements.

Based on this, the following points in particular should be reviewed:

• AI inventory: Which systems and tools are being used in which areas of the company?
• Risk classification: Which applications are subject to specific requirements under the AI Act?
• Transparency: Have the information and labelling requirements applicable since August 2026 been taken into account?
• Responsibilities: Who decides on the introduction and use of AI, and who monitors compliance with internal requirements?
• Internal policies: Are there clear rules governing the use of AI, data and confidential information?
• AI literacy: Do employees have the knowledge and skills required for their respective roles?
• Documentation: Can decisions, approvals and key processes relating to the use of AI be traced and documented?

AI governance as part of corporate organisation

The EU AI Act makes it clear that AI is not solely an IT issue. Depending on the application, its use can affect areas including data protection, information security, HR processes, compliance and the internal control system.

It may therefore make sense for companies to incorporate AI into their existing governance and control structures rather than creating entirely new parallel structures. Responsibilities, approval processes and controls should be proportionate to the actual extent and risk of AI use.

In particular, the extended transition periods for high-risk AI give companies an opportunity to establish the necessary structures gradually and review existing processes at an early stage to identify potential areas requiring adjustment.

Our conclusion

2 August 2026 marks an important milestone in the implementation of the EU AI Act. In particular, the transparency requirements are now directly relevant for companies. At the same time, the postponement of the extensive requirements for high-risk AI gives many companies additional time to prepare.

Companies should make use of this time. The key question is no longer simply whether companies use AI, but how they organise its use in a transparent, controlled and traceable manner.

A structured inventory and clear governance rules provide the foundation for this – while also helping companies to harness the opportunities offered by artificial intelligence responsibly.