The EU AI Act in business: what it requires and what to do

Since 2 August 2026, the European Regulation on artificial intelligence (the AI Act) applies and the authorities can already supervise it. Many companies are still waiting for 2027 because they have read that it “has been delayed”. Only part of it has. This article explains what is in force today, what comes next and what an organization that uses or develops AI has to do.

What is in force and what has been delayed

The AI Act (Regulation (EU) 2024/1689) applies in phases. In July 2026 the so-called Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force, which delayed the obligations for high-risk systems. The rest of the timetable did not move:

• Since 2 February 2025: prohibited practices and the AI literacy obligation.
• Since 2 August 2025: obligations for providers of general-purpose AI models, such as those behind GPT, Claude or Gemini, and the governance structure.
• Since 2 August 2026: general application, supervision by the authorities and transparency obligations.
• 2 December 2026: a new prohibited practice (generating non-consensual sexual content or child sexual abuse material) and the end of the period to mark AI-generated content in systems already on the market.
• 2 December 2027: high-risk obligations for the Annex III uses, such as employment, credit, life and health insurance, education or critical infrastructure.
• 2 August 2028: high risk for AI embedded in regulated products (Annex I).

What affects a company’s day-to-day the most is already enforceable: what is prohibited, training the people who use AI and telling people when they are talking to an AI.

The first question: do you use other people’s AI or put your own into service?

The Regulation allocates obligations according to the role the organization has for each system, and almost every company has both:

• You are a deployer when you use, under your authority, an AI system from a third party: the corporate assistant, the agent that comes with your CRM, the tool that screens résumés.
• You are a provider when you develop a system or an agent, or have it developed, and put it into service under your name: the customer service chatbot your team built or an internal agent on your data.

There is an important nuance (Article 25): if you put your name or trademark on someone else’s high-risk system, substantially modify it or change its intended purpose so that it becomes high risk, you take on the provider’s obligations. And building an agent on a general-purpose model does not make you the provider of the model, but it does make you the provider of the system you put into service.

What you already have to comply with

Prohibited practices

Since February 2025, the following are prohibited, among others: systems that manipulate people in harmful ways, social scoring, emotion recognition in the workplace and in education (except for medical or safety reasons) and biometric categorization to infer sensitive data. It is the infringement with the highest fines.

In practice: check that no use, your own or a provider’s, falls into these categories.

AI literacy

Article 4 requires providers and deployers to take measures so that their staff, and anyone using AI on their behalf, have a sufficient level of knowledge. The Commission has clarified that no certificate or specific level is required. What is required is training adapted to each person’s role and to the risk of the systems they use, and it is advisable to keep a record of what has been done. Referring staff to the instructions for use is, in general, not enough.

In practice: a training programme by profile (who uses an assistant, who decides with the help of a system, who builds it) and a record of who has received it. If a provider uses AI for you, include it in their contract.

Transparency

Since 2 August 2026, Article 50 requires:

• that anyone talking to a chatbot or an agent knows it is an AI, unless it is obvious;
• that providers of generative AI mark the content they generate so that it can be detected;
• that anyone publishing deepfakes says the content is artificial, and that anyone publishing AI-generated text to inform the public on matters of public interest also says so, unless a person has reviewed it and takes editorial responsibility.

In June 2026 the Commission published a voluntary code of practice on how to mark and label AI-generated content, with a common European icon.

In practice: review your customer-facing chatbots and agents, your campaigns and the content you publish that is generated with AI.

If any of your systems is high risk

Annex III high risk arrives on 2 December 2027, and that is not much time: you need to know which systems are high risk, prepare the people who oversee them and have the logs in order. In a company, the most common cases are recruiting and evaluating people, granting credit and pricing life and health insurance. In May 2026 the Commission published draft guidelines with examples of what is and is not high risk.

If you use a third party’s high-risk system, Article 26 asks you to:

• use it according to the provider’s instructions;
• assign human oversight to people with the competence, training and authority to stop it;
• if you control the input data, make sure it is relevant and representative;
• monitor its operation, inform the provider of risks and serious incidents and suspend use if there is a risk;
• keep the logs it generates for at least six months;
• inform workers and their representatives before using it in the workplace, and the people it decides about or helps to decide about.

Public bodies, companies providing public services and anyone using AI to assess creditworthiness or to price life and health insurance must also carry out a fundamental rights impact assessment before using it (Article 27).

If you are the provider of a high-risk system, you add risk management, data quality, technical documentation, automatic event logging, transparency towards the people who use it, design for human oversight, accuracy and robustness (Articles 9 to 15), a quality management system and the conformity assessment.

What is at stake

The maximum fines are:

• 35 million euros or 7% of worldwide turnover for prohibited practices;
• 15 million or 3% for breaching the rest of the obligations, including transparency and those of the deployer;
• 7.5 million or 1% for supplying incorrect information to the authorities.

The higher figure applies, except to SMEs and small mid-caps, to which the lower one applies. In Spain, the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) supervises, and the draft Organic Law for the good use and governance of AI, which specifies the penalty regime, is going through the Cortes.

Where to start: a six-step plan

1. Take inventory. List all the AI systems and agents in the organization: your own, those of providers and those that come inside the tools you already use (CRM, office suite, customer service). For each one: what it is for, who is responsible, what data it uses and who the provider is. Without an inventory nothing can be classified.
2. Classify each system by risk and by role, with your legal counsel, and write down the reasoning.
3. Withdraw what is prohibited. It is already punishable.
4. Train people according to their role and keep the record.
5. Meet the transparency requirements in chatbots, agents and generated content.
6. Prepare for high risk: name who oversees each system, make sure the logs are kept and define how incidents are detected and notified.

The AI Act is not just an IT matter: it involves management, legal or data protection, IT and human resources.

The underlying problem: being able to prove it

Complying is not just doing: it is being able to prove it when an authority, a customer or an auditor asks. And that is where the difficulty lies. Companies no longer have one AI system: they have dozens of agents from different providers, each with its own logs. With an inventory in a spreadsheet and documents made by hand, the inventory goes stale, the logs end up scattered and human oversight is not traced.

The sustainable way is to take the evidence from what the systems already do: which agent acted, with what data, with what model, how much it cost and who approved it.

How we help

We do it with our AI Governance service, on Regentic.AI, the AI agent observability and governance platform of which Zemsania is the exclusive distributor in Europe:

• A living inventory of agents, knowledge bases and integrations, your own and third-party, connected without rewriting them through OpenTelemetry, MCP, REST or A2A.
• Deterministic rules for cost, latency, errors and sensitive data: first warn, then block.
• Policies and approvals where a person has to decide, with the oversight traced.
• AI Act evidence drawn from real data, with sealed reports explained in natural language for management and for the data protection officer.

We start with a census of your agents, connect them and observe them, and then we govern. The platform provides the evidence; the risk classification is declared by your organization.

This article is for information only and does not replace your organization’s legal advice.