law
AI Act
If your staff use AI at work, you are probably a deployer. The high-risk dates moved in July 2026. The literacy duty and the bans did not.
at a glance
- what it is
- A regulation, directly applicable, amended in July 2026 by the Digital Omnibus on AI.
- who it covers
- Whoever builds AI systems, and also whoever uses one under its authority outside personal use.
- the size line
- None. SMEs pay the lower of the two fine amounts.
- fine ceilings
- €35 million or 7% for prohibited practices. €15 million or 3% for deployer and transparency duties.
- next dates
- 2 December 2026, 2 December 2027, 2 August 2028.
- status
- Partly applying. High-risk rules are deferred.
basis AI Act Art. 2(1), 3(4), 99(3), 99(4), 99(6); Regulation 2026/1744 Art. 1
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswhat the AI Act asks of you
- Does anyone use an AI system under your company's authority, for work?yesnoNo deployer duties. Check that this is true once a year.
- Is any use on the prohibited list?noyesStop that use. Banned since February 2025, with two more from 2 December 2026.
- Is it used to screen applicants, evaluate staff, or for another annex III purpose?noyesHigh-risk deployer duties from 2 December 2027: oversight, monitoring, logs, telling staff.
- Literacy measures now. Transparency where it applies.
basis AI Act Art. 3(4), 5, 26, 50, Annex III; AI Act Art. 4 and dates as amended by Regulation 2026/1744 Art. 1
the AI Act in six dates
- 12 February 2025 bans and the AI literacy duty apply
- 22 August 2025 general-purpose model rules and the penalties chapter
- 32 August 2026 general application, including transparency
- 42 December 2026 marking duty for generators placed on the market before 2 August 2026; two added bans for everyone
- 52 December 2027 high-risk rules for annex III systems, moved from 2 August 2026
- 62 August 2028 high-risk rules for AI inside regulated products
basis AI Act Art. 113; Regulation 2026/1744 Art. 1
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- settle who answers
Confirm that you are a deployer, name an owner and put the dates in one calendar.
- see what you use
List every AI tool in use, what it is used for and whether it touches people or personal data.
- write the rules and train people
Agree which tools are allowed, for what, and train the staff who use them.
- check the red lines
Check your tools against the banned practices and the transparency duties, and find out whether any use is high-risk.
- ask your suppliers
Put the right questions to every AI provider and keep the answers.
- if you use AI on applicants or staff
Meet the deployer duties for high-risk uses before 2 December 2027.
- show it keeps working
Keep the inventory current, keep the proof together and report to management.
the dates
What applies when. The reference sits under each date.
- 2 February 2025bans on prohibited practices and the AI literacy duty applyAI Act Art. 113applies now
- 2 August 2025general-purpose model rules and the penalties chapter applyAI Act Art. 113applies now
- 27 July 2026Digital Omnibus on AI in force, moving the high-risk datesRegulation 2026/1744 Art. 4applies now
- 2 August 2026general application, including the transparency dutiesAI Act Art. 113applies now
- 2 December 2026two added prohibitions apply; machine-readable marking duty for generators placed on the market before 2 August 2026Regulation 2026/1744 Art. 1coming
- 2 December 2027high-risk rules apply to Annex III systems, such as recruitment toolsRegulation 2026/1744 Art. 1coming
- 2 August 2028high-risk rules apply to AI inside regulated productsRegulation 2026/1744 Art. 1coming
the fine ceilings
The ceilings each text sets. The reference sits under each.
- prohibited practicesup to €35 million or 7% of worldwide annual turnover, whichever is higherAI Act Art. 99(3)
For SMEs, whichever is lower: AI Act Art. 99(6).
- deployer and transparency dutiesup to €15 million or 3% of worldwide annual turnover, whichever is higherAI Act Art. 99(4)
For SMEs, whichever is lower: AI Act Art. 99(6).
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
- AI Act Art. 4
Providers and deployers take measures to support AI literacy of the staff who use AI systems. Wording replaced by Regulation 2026/1744 Art. 1.
- AI Act Art. 15
High-risk AI systems: an appropriate level of accuracy, robustness and cybersecurity.
- AI Act Art. 26(1)
A deployer of a high-risk system uses it according to the provider's instructions. Further deployer duties cover oversight, monitoring, logs and informing workers.
- also in the plan
the work under this rule
- incident reportingFor the board and the owner of IT: one event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
- trainingNIS2, DORA and GDPR ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
the long read
The full explanation, section by section, with the sources.