In forceEU AI Act9 min read

EU AI Act Requirements Already in Force in 2026

The EU AI Act now applies in stages. Organisations should identify whether they are providers, deployers, importers or distributors, inventory their AI systems, address prohibited practices, take AI-literacy measures and check which transparency or high-risk duties apply to each use case.

Applies from: Phased application from 2 February 2025; general application from 2 August 2026
For: EU organisations that develop, supply, buy or use AI systems
Last legally reviewed: 22 September 2026

Educational guidance: This overview explains EU rules in general terms. Applicability depends on the organisation, system, service and national law.

The AI Act is not a single compliance date

Regulation (EU) 2024/1689 entered into force in 2024 and applies through a staged timetable. The rules on prohibited AI practices and Article 4 AI literacy started applying on 2 February 2025. Much of the Regulation applies from 2 August 2026, but Regulation (EU) 2026/1744 moved the main high-risk-system dates: Annex III systems to 2 December 2027 and Annex I product-safety systems to 2 August 2028.

That means a business should not ask only whether the AI Act applies. It should identify its role for each AI system, the system's purpose and risk category, and the provisions whose application date has arrived.

What organisations should already have done

A proportionate baseline starts with a documented inventory and named responsibility. The inventory should cover public AI tools used by staff as well as AI embedded in purchased software.

Identify the provider and the organisation's own role for every AI system.
Record the intended purpose, users, affected people, data involved and business process.
Screen for prohibited practices and higher-risk uses, including employment, education and access to essential services.
Provide context-appropriate AI literacy for staff and other people operating AI on the organisation's behalf.
Check whether Article 50 transparency duties apply to chatbots, synthetic content, deepfakes or public-interest text.
Keep supplier information, internal instructions, decisions and review evidence together.

Role and use case matter more than company size

The same organisation can be a deployer for one tool and a provider for another. Using an external chatbot internally will usually create a different set of responsibilities from placing a branded AI product on the market or substantially modifying a third-party system.

Small organisations should keep the process proportionate, but they should not assume that being small removes AI Act duties. The legal assessment must follow the actual system and use case.

What this means for training and evidence

Training should connect the law to the tools and decisions people actually handle. A generic awareness video may help, but it is not a substitute for instructions on approved tools, confidential information, human review, incident escalation and role-specific risks.

The AI Act does not prescribe one universal certificate for Article 4. Useful evidence can include the training scope, attendees, dates, learning material, role mapping, completion records and the next review date.

Action list

Practical checklist

Create or refresh the AI-system inventory.
Assign the organisation's role and risk screening for each system.
Check prohibited-practice controls.
Map AI-literacy training to roles and systems.
Assess Article 50 transparency requirements.
Record suppliers, instructions, incidents and review dates.

Questions

Common questions

Does the EU AI Act apply to every business using ChatGPT?

The Act can apply to organisations using AI, but the exact duties depend on the organisation's role, the system and the use case. Ordinary use does not automatically make an organisation the provider of the underlying model.

Is an AI Act certificate legally required?

No. As amended in 2026, Article 4 requires providers and deployers to take measures that support the development of AI literacy. It does not require them to guarantee a particular level or prescribe one universal certificate, course length or examination format.

Are all AI Act rules already applicable?

No. The Regulation uses staged application dates. Under the amended timetable, the principal requirements for Annex III high-risk systems apply from 2 December 2027 and those for Annex I product-safety systems from 2 August 2028. Each relevant article must be checked separately.

Primary material

Official sources

Last legally reviewed: 22 September 2026. Recheck the consolidated legislation and relevant national implementation before relying on this guide for a specific decision.