Key takeaways
- Classify every AI use case first: prohibited, high-risk, limited-risk (transparency) or minimal-risk.
- Prohibited practices, AI literacy and Article 50 transparency already apply. High-risk duties for Annex III systems apply from 2 December 2027 under Regulation (EU) 2026/1744.
- High-risk systems need risk management, data governance, logging, technical documentation and human oversight, and those controls are cheap to design in and costly to retrofit.
- SMEs get a lower fine cap and simplified documentation, but not an exemption, and the GDPR applies in parallel whenever personal data is involved.
Where should your AI Act review start?
List every AI system your business builds or uses. For each one, record your role, intended purpose, affected people and risk classification. Then assign the applicable duties, an owner and evidence. This checklist covers the first assessment. Larger organisations can use our enterprise guide to coordinate procurement and operations.
If you commission a custom system and run it under your own brand, you will usually count as the provider, even though somebody else wrote the code. The checklist below then applies to you. Our guide to which companies must comply explains the roles in more detail.
Step 1: Classify every use case
The Act is risk-based. What you owe depends on what the system is used for, and the model underneath matters far less.
| Risk level | Examples | What it means | Applies from |
|---|---|---|---|
| Prohibited | Social scoring, manipulative techniques, untargeted facial scraping | Not allowed in the EU | 2 February 2025 |
| High-risk | AI in recruitment, credit scoring, education, access to essential services | Full set of obligations before go-live | 2 December 2027 (Annex III); 2 August 2028 (AI in regulated products) |
| Limited risk | Chatbots, voice agents, AI-generated text, images or audio | Transparency: tell people they are dealing with AI, and mark generated content | 2 August 2026 |
| Minimal risk | Spam filters, internal search, spell-check | No specific obligations. Voluntary codes | Not applicable |
The following controls describe high-risk provider requirements. A deployer’s duties differ, so map your role before treating this as a build checklist.
- A risk-management system covering the full lifecycle of the system.
- Data governance: relevant, representative and documented training and evaluation data.
- Automatic logging of events so outputs can be traced.
- Technical documentation and instructions for use.
- Human oversight: a named person can understand, override or stop the system.
- Accuracy, robustness and cybersecurity appropriate to the use case.
Step 3: Build the controls into the system
Define which events you need to audit, who can access logs and how long to keep them. Limit personal data sent to models and add human review where the use requires it. Document the system’s purpose, limits and failure modes. Logging every prompt in full can create unnecessary privacy risk.
Step 4: Handle transparency and training
- Chatbots and voice agents: tell people at the start of the interaction that they are talking to an AI, unless it is obvious.
- Generated audio, images, video or text: mark it in a machine-readable way. Providers of systems already on the market have until 2 December 2026 for this marking duty.
- Deepfakes: disclose them clearly at first exposure.
- Staff: take proportionate measures to build AI literacy among people who use AI for you under Article 4.
Key dates after the Digital Omnibus
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026 and entered into force on 27 July 2026. Check the dates on EUR-Lex before you plan around them.
- 1 August 2024: the Act entered into force.
- 2 February 2025: prohibitions and AI-literacy duties began to apply.
- 2 August 2025: obligations for general-purpose AI models began to apply.
- 2 August 2026: Article 50 transparency duties began to apply.
- 2 December 2026: marking duty for generative systems already on the market, and two new prohibitions.
- 2 December 2027: high-risk obligations for systems listed in Annex III.
- 2 August 2028: high-risk obligations for AI in products covered by Annex I safety law.
A one-page file you can start today
- A table of your AI systems: purpose, owner, role, risk class and the date you last reviewed it.
- For each high-risk or limited-risk system: the controls you built and where the evidence is.
- Your vendor contracts and the answers to your vendor questions.
- A record of AI-literacy training.
- The name of the person who answers for all of it.
Tell us what your AI system does and which data it handles. We can help translate your requirements into access controls, logging and review steps.
Plan your AI controlsFAQ
Does the EU AI Act apply to companies outside the EU?
Article 2 covers providers placing systems on the EU market and certain providers and deployers outside the EU whose system output is used in the Union. Check your role, intended use and the specific scope exceptions.
Is a customer-service chatbot high-risk?
Usually not. Most chatbots are limited-risk and need transparency: users have to know they are talking to an AI. It can become high-risk if it is used for something listed in Annex III, such as deciding on access to essential services.
Did the Digital Omnibus cancel the August 2026 deadline?
It moved the high-risk deadline for Annex III systems to 2 December 2027 and for AI in regulated products to 2 August 2028. Transparency duties under Article 50 began to apply on 2 August 2026, with a grace period until 2 December 2026 for the marking duty on systems already on the market.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the EU
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the EU, 24 July 2026
- European Commission, FAQ on transparency obligations under Article 50 of the AI Act
- Regulation (EU) 2016/679 (GDPR)
About the author
Artem Synytskyi · Co-founder · AI
Artem runs AI at ESADEX, building LLM, RAG and speech-to-text systems for regulated environments.