EU Artificial Intelligence Act: Key Provisions, Deadlines and Business Obligations in 2026

European artificial intelligence regulation has entered a new phase. The EU AI Act has already begun to roll out its main obligations and, following the amendments introduced in 2026, companies must take into account an updated implementation timetable, new transparency obligations and a more clearly defined supervisory framework.

In this article, we examine what the EU Artificial Intelligence Act currently provides, which obligations are already applicable, which will become applicable at a later date and what companies should review in light of the evolving European regulatory framework.

What is the EU Artificial Intelligence Act?

Regulation (EU) 2024/1689, known as the EU Artificial Intelligence Act or AI Act, establishes a common legal framework for the development and use of artificial intelligence systems within the European Union.

Its defining feature is its risk-based approach. Not all AI systems are subject to the same obligations: requirements become more stringent depending on the risks that a particular technology may pose to safety, health or fundamental rights.

The Regulation applies both to companies that develop or market AI systems and to those that use them in the course of their business activities, depending on their role and the characteristics of the system concerned.

Furthermore, the AI Act must be considered alongside other legislation that may apply, particularly the General Data Protection Regulation (GDPR), cybersecurity legislation, sector-specific regulations and intellectual property law.

AI Act implementation timeline: What is already applicable in 2026?

One of the main aspects that has changed since the Regulation was first published is its implementation timetable.

The AI Act entered into force on 1 August 2024, but its obligations apply progressively.

2 February 2025: Prohibited AI practices and AI literacy

Since this date, the provisions concerning certain prohibited AI practices and the obligation to promote AI literacy have been applicable.

The AI literacy obligation applies to providers and deployers of AI systems, which must take measures to ensure that people working with these tools have an adequate level of knowledge and skills, taking into account the context in which the systems are used.

The same level of knowledge is not required of every individual or company. Training must be tailored to factors such as experience, technical knowledge, educational background and the intended use of the system.

2 August 2025: Governance and general-purpose AI models

Since August 2025, provisions relating to the governance of the Regulation and general-purpose artificial intelligence (GPAI) models, among others, have been applicable.

These obligations particularly affect providers of general-purpose AI models, especially those that may pose systemic risks.

The framework includes requirements concerning transparency, copyright, documentation and, in the case of models posing systemic risks, risk assessment and mitigation.

2 August 2026: General application and transparency

2 August 2026 is a particularly significant date.

From this date, the Regulation becomes generally applicable, subject to the exceptions and transitional periods established for certain obligations.

The transparency obligations applicable to certain AI systems also become enforceable.

Among other requirements, these rules may require individuals to be informed when they are interacting with certain AI systems and certain AI-generated or manipulated content to be identifiable.

2 December 2027: Certain high-risk AI systems

Following the amendments introduced by the AI Omnibus, the obligations applicable to certain high-risk AI systems listed in Annex III will apply from 2 December 2027.

The areas concerned include, for example, certain uses relating to employment, education, critical infrastructure, biometrics, migration and the administration of justice.

2 August 2028: AI systems integrated into certain products

For AI systems classified as high-risk because they are integrated into products subject to certain EU product safety legislation, the revised timetable sets 2 August 2028 as the date from which the corresponding obligations will apply.

Companies must therefore work with the updated timetable rather than relying on the dates originally included in the first guidance documents on the AI Act.

How does the AI Act classify AI systems?

The Regulation establishes different categories according to the level of risk.

Prohibited AI practices

Certain practices considered incompatible with the values and fundamental rights protected by the European Union are prohibited.

These include certain systems involving harmful manipulation, exploitation of vulnerabilities, social scoring and certain uses of biometric categorisation and emotion recognition.

In 2026, a specific prohibition was also introduced concerning certain systems intended to generate non-consensual sexually explicit or intimate content and child sexual abuse material.

High-risk AI systems

These are systems that may pose significant risks to health, safety or fundamental rights.

The Regulation covers, among others, certain systems used in:

• Recruitment and workforce management.

• Education and vocational training.

• Critical infrastructure.

• Certain essential services.

• Biometrics.

• Migration and border control.

• Law enforcement.

• Administration of justice and democratic processes.

Where a system falls into this category, the applicable obligations may be considerably more demanding. They may include risk management and mitigation, data quality, traceability, documentation, information for deployers, human oversight, accuracy, robustness and cybersecurity.

Transparency obligations

A specific category of obligations applies to certain systems whose principal risk relates to a lack of transparency.

For example, certain conversational AI systems must inform users that they are interacting with a machine.

Specific obligations also apply to certain AI-generated or manipulated content, including certain deepfakes and synthetic content.

These transparency obligations are particularly relevant from August 2026.

Minimal-risk or no-risk AI systems

Most AI systems used in the European Union fall into this category.

The Regulation does not impose the same obligations on these systems as it does on high-risk AI systems. Nevertheless, companies must continue to take account of other legislation that may apply, including the GDPR, intellectual property law and cybersecurity regulations.

What are general-purpose AI models?

General-purpose AI models, known as GPAI models, can be used to perform a range of tasks and serve as the foundation for other AI systems.

The Regulation establishes specific obligations for their providers, including those relating to:

• Transparency and documentation.

• Information about the content used for training.

• Compliance with copyright legislation.

• Cooperation with the competent authorities.

• Risk assessment and mitigation in the case of models posing systemic risks.

These obligations began to apply in August 2025, although transitional periods are provided for certain models that had already been placed on the market before that date. For companies that develop or provide general-purpose AI models, compliance with the AI Act requires a specific assessment of their position within the value chain.

What has changed under the AI Omnibus?

The implementation of the Regulation has not remained static.

In 2026, the European Union adopted the AI Omnibus, aimed at simplifying certain aspects of the AI Act’s implementation and facilitating compliance.

Among the most significant amendments are the revised timetable for certain high-risk AI systems and changes relating to the governance and supervision of general-purpose AI models.

Measures have also been introduced to facilitate compliance by certain smaller companies and to promote regulatory sandboxes for innovative solutions.

The European debate on AI therefore no longer focuses exclusively on establishing new obligations, but also on how to implement existing requirements in a proportionate manner that is compatible with innovation and business competitiveness.

AI and data protection: An evolving regulatory framework

Artificial intelligence regulation cannot be considered in isolation from the General Data Protection Regulation (GDPR).

A company that uses personal data to train, develop or operate an AI tool must assess, among other matters, the purposes of processing, the legal basis, data minimisation, transparency, security and the rights of the data subjects concerned.

This area is also becoming particularly important in the European debate on regulatory simplification.

In 2025, the European Commission presented a Digital Omnibus proposal aimed at simplifying various pieces of digital legislation, including certain aspects of the GDPR and the European AI regulatory framework. Throughout 2026, the proposal has continued through the legislative process and interinstitutional negotiations.

The issues under discussion include potential amendments concerning the processing of personal data in the context of developing and operating AI systems or models.

However, it is important to distinguish between legislative proposals and legislation currently in force. Until these amendments have been definitively adopted and become applicable, companies must continue to comply with the GDPR as it currently stands.

Furthermore, the possibility that future legislation may recognise certain forms of processing based on legitimate interests does not mean that the use of personal data for AI will become unrestricted or automatically lawful in all circumstances. The conditions governing the applicable legal basis, individuals’ rights and the safeguards established by law will remain relevant.

What should companies review in 2026?

For many organisations, the main challenge is no longer simply understanding the AI Act, but identifying which AI tools they use and determining the specific obligations arising from their use.

As a starting point, companies should review the following areas.

1. Inventory of AI tools. Companies should identify which AI systems and applications are used by their employees, departments and service providers. This includes both solutions purchased from third parties and tools integrated into other corporate software.
2. Purpose and classification of AI systems. Simply knowing that a company uses AI is not enough. It is necessary to determine what each system is used for and whether it falls within any of the categories regulated by the AI Act. Particular attention should be paid to AI applications used in human resources, recruitment, employee assessment and workforce management, as certain systems used for these purposes may be classified as high-risk.
3. Personal data protection. Where an AI tool processes information relating to natural persons, compliance with the GDPR must be assessed. This is particularly important when personal data relating to customers, employees, suppliers or other third parties is entered into generative AI tools.
4. Transparency. Companies must establish whether any of the systems they use are subject to the new transparency obligations applicable since August 2026. These obligations may affect, for example, certain conversational interfaces or content generated or manipulated using AI.
5. AI literacy and training. Training for individuals who use AI systems forms part of the new European regulatory framework. Companies should establish internal rules governing the use of these tools and provide training tailored to the risks and responsibilities associated with each role.
6. Employees’ use of AI. Companies should also address so-called shadow AI: the use of artificial intelligence tools by employees without the company’s authorisation or oversight. An internal policy can establish which tools may be used, what information may be entered into them, which types of data are prohibited and what controls must be implemented.
7. Contracts and suppliers. Where a company uses AI solutions provided by third parties, it should review the relevant contracts and terms of service. This assessment may cover data protection, confidentiality, intellectual property, security, data location and international transfers, data retention, liability and compliance assistance.
8. Documentation and governance. Organisations should retain evidence of decisions made regarding the use of AI and clearly define who is responsible for overseeing these tools. Internal governance also helps coordinate legal, technological, security and data protection matters.

How does the AI Act interact with other legislation?

The AI Act does not replace other applicable legislation.

A single technological solution may be subject to several legal frameworks simultaneously.

These may include:

• The GDPR and other data protection legislation, where personal data is processed.

• Intellectual property legislation, particularly in relation to content and data used by AI systems.

• NIS2 and other cybersecurity legislation, where applicable according to the company’s activities or status.

• The Cyber Resilience Act, for certain products with digital elements.

• DORA, in the financial sector, where its conditions for application are met.

• Employment legislation, where AI is used in recruitment, employee assessment or workforce management.

Compliance with the AI Act should therefore be integrated into a broader technology governance and regulatory compliance strategy.

Who oversees compliance with the AI Act?

The enforcement of the Regulation is shared between the European AI Office and the competent national authorities.

Since August 2026, the supervisory and enforcement powers established by the Regulation have begun to take effect.

The European AI Office plays a particularly important role in relation to general-purpose AI models, while national authorities participate in supervising AI systems and enforcing obligations within their respective areas of competence.

For companies, this means that AI Act compliance is progressively moving beyond a purely preventive exercise and becoming part of a regulatory framework with effective supervisory and enforcement mechanisms.

What should companies do now?

The progressive application of the Regulation does not mean that all companies must implement identical measures or that all AI tools are subject to high-risk requirements.

An initial assessment can be structured around five steps:

1. Identify the AI tools currently in use.

2. Determine the company’s role in relation to each system.

3. Classify the systems according to their risk level and applicable obligations.

4. Review data protection, transparency, security, contractual arrangements and training.

5. Document the measures adopted and monitor regulatory developments.

This assessment should be updated whenever new tools are introduced or the company changes how it uses existing AI systems.

What could change next in European AI regulation?

The European regulatory framework continues to evolve.

On the one hand, the AI Act now has a revised implementation timetable following the adoption of the AI Omnibus.

On the other hand, discussions are continuing on the Digital Omnibus, which aims to simplify various elements of the European digital regulatory framework, including certain provisions relating to AI, data protection and cybersecurity.

These initiatives aim to reduce administrative burdens and facilitate regulatory compliance. However, proposals that are still under negotiation must not be confused with obligations that are already legally binding.

For companies, this makes continuous regulatory monitoring particularly important, both to avoid failing to comply with obligations already in force and to prevent the premature implementation of requirements that have not yet been adopted.

Frequently asked questions about the EU Artificial Intelligence Act

When does the EU Artificial Intelligence Act apply?

The Regulation entered into force on 1 August 2024 and applies progressively. Certain provisions have applied since February 2025 and others since August 2025. The Regulation became generally applicable on 2 August 2026, although transitional periods apply to certain obligations, particularly those concerning specific high-risk AI systems.

Do all companies have to comply with the AI Act?

The Regulation may affect companies of different sizes and across various sectors. However, the specific obligations depend on the type of AI system, its intended purpose and the role performed by the organisation. Not all companies or AI tools are subject to the same requirements.

Which companies should pay particular attention to high-risk AI systems?

These include companies using AI in areas such as recruitment and workforce management, education, critical infrastructure, certain essential services, biometrics and specific applications relating to justice, migration and law enforcement.

Is the use of ChatGPT or other AI tools prohibited?

No. The AI Act does not impose a general prohibition on the use of generative AI tools or conversational assistants. Companies must assess the purposes for which they use these tools, the data entered into them, the applicable obligations and the risks associated with their use.

Does the AI Act replace the GDPR?

No. Where an AI system processes personal data, the GDPR continues to apply. The same activity may simultaneously fall within the scope of the AI Act and data protection legislation.

What should companies do in 2026?

At a minimum, companies should identify the AI tools they use, assess their purposes and classification, review any applicable transparency and data protection obligations, train users and establish internal rules governing their use and oversight.

Conclusion: AI regulation enters a more practical phase

European artificial intelligence regulation has moved beyond the adoption of its legal framework and entered a phase focused on effective implementation and enforcement.

The AI Act already includes applicable obligations and a revised timetable following the amendments introduced in 2026. At the same time, the European Union continues to review its digital regulatory framework with a view to simplifying certain requirements and promoting innovation and competitiveness.

For companies, the challenge is to strike the right balance between harnessing the opportunities offered by artificial intelligence and ensuring its safe, transparent and legally compliant use.

Rather than waiting for the regulatory framework to stop evolving, companies should identify the AI systems they currently use, assess the risks they pose and determine which obligations may apply.

At Adlanter, we help companies assess the legal and regulatory implications of artificial intelligence and integrate these obligations into their corporate compliance and governance frameworks.