The EU AI Act in 2026: What Companies Need to Do to Comply with the New Artificial Intelligence Regulations

Artificial Intelligence is already part of everyday business operations.

A sales team uses ChatGPT to prepare proposals. Human Resources introduces a tool to screen candidates. Marketing generates images and content using AI. Customer service deploys a chatbot. Finance uses algorithms to detect anomalies. And in many cases, different departments begin using Artificial Intelligence tools without a centralized overview of all the systems in use.

The question is no longer simply how to make the most of Artificial Intelligence.

In 2026, a second question is becoming increasingly important:

Are we using AI in compliance with the EU AI Act?

Since 2 August 2026, the European Union’s Artificial Intelligence Act has become generally applicable, although some of its obligations have entered into force—or will become applicable—gradually.

This does not mean that all companies must implement the same measures.

In fact, one of the fundamental principles of the EU AI Act is its risk-based approach.

That is why, before creating dozens of documents, policies or procedures, there is something much more fundamental that an organisation should do:

understand which AI systems it uses, what they are used for, what role it plays in relation to those systems, and which obligations may apply.

Let’s explore this step by step.

The EU AI Act is no longer a regulation of the future.

Over the past few years, it was common to hear the EU AI Act described as legislation that would “come into effect soon”.

That moment has arrived.

Regulation (EU) 2024/1689 establishes a common framework for the development, placing on the market and use of Artificial Intelligence systems in the European Union.

Consolidated text of Regulation (EU) 2024/1689 — EUR-Lex

Its implementation has been designed to take place gradually.

Obligations relating to certain prohibited AI practices and AI literacy began to apply in February 2025.

Other parts of the Regulation subsequently became applicable, and from August 2026, the EU AI Act applies generally, including important obligations concerning the transparency of certain AI systems.

However, some specific obligations relating to systems classified as high-risk are subject to a later timetable.

In particular, certain provisions applicable to high-risk systems listed in Annex III will apply from 2 December 2027, while certain obligations relating to systems associated with regulated products under Annex I will apply from 2 August 2028.

This introduces an important distinction:

having more time to meet certain obligations does not mean that companies should wait to start identifying and governing their AI systems.

In fact, the greater the number of AI tools and use cases within an organisation, the more difficult it becomes to reconstruct later who uses what, for what purpose, which data is involved, and who is responsible.

1. The first step: understanding which AI systems the company actually uses

It may seem obvious.

In practice, however, it is not always that straightforward.

Imagine a company with 300 employees.

The Marketing department uses a generative AI tool to create images and text.

The Sales department uses AI assistants integrated into its CRM.

Human Resources is testing software that helps rank job applications.

Customer Service has connected a chatbot to its knowledge base.

Some employees also use public AI tools to summarise documents, analyse information or prepare presentations.

How many AI systems does this organisation actually use?

Probably more than Management, IT or Compliance are aware of.

That is why one of the first steps in a serious AI Governance strategy is to create an inventory of AI systems and use cases.

Among other things, this inventory may include:

System or tool name
Provider
Responsible department
Purpose
People using the system
Data processed
People affected by its outputs
Degree of autonomy
Decisions in which it plays a role
Internal system owner
Preliminary regulatory classification

This is not simply about creating a spreadsheet.

It is about obtaining an accurate picture of how AI is actually being used across the organisation.

2. Not all AI tools carry the same level of risk

This is where one of the EU AI Act’s key concepts comes into play.

The Regulation does not treat all Artificial Intelligence systems in the same way.

The level of obligations depends, among other factors, on the system’s intended purpose, the context in which it is used, and the impact it may have on individuals.

Consider two examples.

Example 1: Marketing content generation

A company uses Artificial Intelligence to generate an initial draft of copy for its social media posts.

A person subsequently reviews the content before publication.

Example 2: Recruitment and candidate selection

The same company introduces an AI system that analyses CVs and helps determine which candidates progress to the next stage of the recruitment process.

Both use Artificial Intelligence.

However, the consequences of their decisions are very different.

That is why one of the most common mistakes is to adopt a generic AI policy and assume that all systems are covered in the same way.

Each use case must be assessed individually.

At Aicertia, this process begins with a Regulatory Risk and Impact Classification, which examines the system, its use case, the organisation’s role, and the potential obligations that may apply.

AI Regulatory Risk and Impact Classification — Aicertia

3. Provider or deployer? The company’s role matters tooAnother fundamental question is:

What role does our organisation play in relation to the AI system?

Developing and marketing an in-house system is not the same as using a solution developed by a third party.

Depending on the circumstances, an organisation may act as a provider, a deployer, an importer, a distributor, or another operator within the value chain.

This role matters because it determines which obligations apply to each organisation.

For example, a company that uses a commercial AI platform to support certain internal processes is not necessarily in the same regulatory position as the company that develops that system.

However, using third-party technology does not eliminate responsibility.

It may still be necessary to assess:

What the system is used for
Which decisions it supports
Which individuals are affected
What instructions the provider supplies
What data is entered into the system
What human oversight is in place
What information users receive
How the system’s operation is monitored

That is why a proper classification should not stop at answering:

“Is this tool classified as high-risk?”

It should also answer:

“What role does our company play, and what obligations arise from that role?”

4. AI Literacy: Training the People Who Use Artificial Intelligence

Another aspect of the EU AI Act potentially affects a vast number of organisations: Artificial Intelligence literacy, or AI Literacy.

Article 4 establishes obligations for providers and deployers to take measures to ensure, to the best of their ability, a sufficient level of AI literacy among their staff and other individuals operating or using AI systems on their behalf.

The idea is straightforward:

if an organisation introduces Artificial Intelligence into its processes, the people working with it should have a sufficient understanding of the technology they are using and its implications.

However, this does not necessarily mean delivering exactly the same training course to everyone in the organisation.

An HR manager using an AI system to support recruitment processes may need different knowledge from someone using a generative AI tool to prepare internal drafts.

An IT department will have different needs from Marketing.

And a Compliance or AI Governance manager will probably require a different level of expertise.

A simple example

Imagine a company that allows its employees to use generative AI tools.

A policy that simply states:

“Artificial Intelligence may be used responsibly”

is unlikely, on its own, to address all the associated risks.

Employees should understand, for example:

Which tools are authorised
What information they may enter
What information they should not share
How to verify AI-generated outputs
When human review is necessary
What risks relating to errors, bias or confidentiality may arise
When the use of Artificial Intelligence must be disclosed

Training therefore becomes more than an academic exercise.

It becomes a core AI governance measure.

5. Transparency: Does a Person Know When They Are Interacting with AI?

From 2 August 2026, the transparency obligations set out in Article 50 of the EU AI Act also become particularly relevant.

Among other scenarios, the Regulation introduces obligations concerning certain AI systems that interact directly with people and certain content generated or manipulated using Artificial Intelligence.

Consider a very common example.

A company integrates a conversational assistant into its website to answer customer questions automatically.

The first question should not simply be:

“Does the chatbot work well?”

We should also ask:

“Does the user know they are interacting with an Artificial Intelligence system?”

Article 50 specifically addresses these types of situations, as well as certain cases involving synthetic content, deepfakes, emotion recognition and biometric categorisation.

In July 2026, the European Commission published specific guidelines to help clarify how these obligations should be interpreted and applied.

This is a good example of how EU AI Act compliance is moving from broad principles to very concrete business scenarios.

6. What If the System May Be High-Risk?

This is where the assessment begins to require greater depth.

The EU AI Act classifies certain Artificial Intelligence systems as high-risk when their use may have particularly significant effects on health, safety or fundamental rights.

The areas covered include certain uses relating to:

Employment and worker management
Education
Certain essential services
Biometrics
Critical infrastructure
Migration and border control
The administration of justice and other areas specified in the Regulation

This does not mean that every HR software application, for example, is automatically high-risk.

The determining factor is the specific use case and whether it meets the criteria established by the Regulation.

That is why it is particularly important to avoid making quick assumptions based solely on the name of the technology.

If an initial classification indicates that a system may fall within a high-risk category, the next step may be to conduct a more in-depth readiness assessment.

EU AI Act Pre-Assessment — High-Risk AI Systems — Aicertia

Areas that may require analysis include risk management, data governance, documentation, record-keeping, human oversight, accuracy, robustness, cybersecurity and the responsibilities of each operator.

7. Compliance Does Not Mean Creating Documents and Forgetting About Them

There is another common mistake: treating compliance as a project with a start date and a completion date.

An Artificial Intelligence system can change.

The provider may update its model.

The purpose for which the system is used may change.

It may begin processing new data.

It may be integrated into another process.

It may affect new groups of people.

Or a new regulatory obligation, guideline or interpretation may emerge.

That is why a sound AI Governance strategy requires ongoing attention.

For example, a company initially classifies an internal assistant as a system used exclusively to help employees find documentation.

Several months later, the same system starts recommending automated responses that customer service agents send directly to customers.

Although the technology itself may appear unchanged, its context of use has changed.

And that change may justify a fresh assessment.

A continuous governance model helps keep the inventory, responsibilities, risks, controls, changes, providers and supporting evidence up to date.

Continuous AI Governance — vAIO — Aicertia

8. Five Questions Every Company Should Be Able to Answer Today

The EU AI Act can seem complex when viewed as a Regulation running to hundreds of pages.

But there is a much more practical way to get started.

Any organisation using Artificial Intelligence should aim to answer five questions clearly.

1. Which AI systems do we use?
Not just those officially procured by IT, but also the tools and use cases present across different departments.
2. What do we use each system for?
The purpose and context of use are fundamental to determining risk.
3. What role do we play?
Do we develop the system? Market it? Use it within our organisation?
4. What risks and obligations may apply?
AI literacy, transparency, potential high-risk classifications, human oversight, documentation and other applicable requirements.
5. Can we demonstrate what we are doing?

This last question may be the most important.

A company can claim to use Artificial Intelligence responsibly.

But when the time comes, it should be able to demonstrate how it does so.

Which systems has it identified?
Who is responsible?
What assessment was carried out?
What training did staff receive?
Which controls have been implemented?
What decisions were made?
What evidence is available?

In regulatory compliance, what an organisation can demonstrate is often just as important as what it claims to be doing.

From Using AI to Governing AI

Over the past few years, many organisations have focused on one question:

“How can we use more Artificial Intelligence?”

The EU AI Act inevitably introduces a second:

“How can we use it in a controlled, responsible and legally compliant way?”

This does not mean slowing innovation down.

On the contrary, an organisation that knows which systems it uses, understands their risks, establishes clear responsibilities and adequately trains its teams has a much stronger foundation for adopting new AI solutions.

The goal should not be to create bureaucracy around every tool.

The goal should be to understand what AI we have, what risks it presents and what we need to do about them.

That is probably the best starting point for any EU AI Act compliance strategy.

Where Should You Start?

At Aicertia, we help organisations turn EU AI Act requirements into concrete, actionable measures.

The process can begin by identifying and classifying the Artificial Intelligence systems used across the organisation, determining the company’s role and analysing the applicable regulatory obligations.

AI Regulatory Risk and Impact Classification

From there, where necessary, organisations can move on to high-risk system readiness assessments, transparency measures, AI literacy programmes, remediation and continuous governance models.

Because EU AI Act compliance does not begin with filling out paperwork.

It begins with understanding which Artificial Intelligence systems the organisation uses, what they are used for and what responsibilities their use entails.

Aicertia — EU AI Act Compliance, Governance, Training & Certification.