Updated 22 September 2026

AI Act obligations depend on what an AI system actually does and whether your organization provides, deploys or otherwise uses it in a regulated role. Saying that a company “uses AI” is not enough to determine its requirements.

Understand the implementation timeline

The AI Act became applicable in stages. According to the European Commission's published framework as checked on 15 October 2026:

  • 2 February 2025: Rules on prohibited AI practices and selected initial provisions began to apply.
  • 2 August 2025: Governance and obligations for general-purpose AI models began to apply.
  • 2 August 2026: The main application date, including relevant transparency requirements.
  • 2 December 2027: Rules for relevant high-risk AI systems listed under Annex III.
  • 2 August 2028: Rules for relevant high-risk AI embedded in regulated products under Annex I.

Authoritative reference: European Commission — AI regulatory framework.

Transparency is not just about customer chatbots

Depending on the system and use case, rules may concern informing people that they are interacting with AI, identifying certain AI-generated outputs and other transparency obligations. The exact requirements and exceptions must be assessed for the particular system.

Review the AI systems you actually use

Maintain an inventory of systems, purposes, data sources, suppliers and accountable people. Pay particular attention to uses affecting individuals or other sensitive areas. A tool being used by an HR team does not by itself determine the legal classification of every function it performs.

Keep the review up to date

A change in model, provider, purpose or decision-making role can affect the assessment. Legal requirements must be confirmed against the current legislation and the actual design of the system.

Related: Security & Governance · How We Work · Discuss the technical controls for your AI use case

Important: This article is general information, not a legal opinion or a compliance certification.