regulation

AI Act

If your staff use AI at work, you are probably a deployer. The high-risk dates moved in July 2026. The literacy duty and the bans did not.

last checked 2 November 2026not legal advice
what it is
A regulation, directly applicable, amended in July 2026 by the Digital Omnibus on AI.
who it covers
Whoever builds AI systems, and also whoever uses one under its authority outside personal use.
the size line
None. SMEs pay the lower of the two fine amounts.
fine ceilings
€35 million or 7% for prohibited practices. €15 million or 3% for deployer and transparency duties.
next dates
2 December 2026, 2 December 2027, 2 August 2028.
status
Partly applying. High-risk rules are deferred.

basis AI Act Art. 2(1), 3(4), 99(3), 99(4), 99(6); Regulation 2026/1744 Art. 1

01

you are probably a deployer

Paying for a chatbot and letting staff use it for work is enough to make you a deployer. The heavy duties fall on whoever builds and sells the system. Yours are lighter and depend on what you use it for.

what the AI Act asks of you

  1. Does anyone use an AI system under your company's authority, for work?
    yes
    noNo deployer duties. Check that this is true once a year.
  2. Is any use on the prohibited list?
    no
    yesStop that use. Banned since February 2025, with two more from 2 December 2026.
  3. Is it used to screen applicants, evaluate staff, or for another annex III purpose?
    no
    yesHigh-risk deployer duties from 2 December 2027: oversight, monitoring, logs, telling staff.
  4. Literacy measures now. Transparency where it applies.

basis AI Act Art. 3(4), 5, 26, 50, Annex III; AI Act Art. 4 and dates as amended by Regulation 2026/1744 Art. 1

basis AI Act Art. 3(4), 4, 5, 26

02

what applies now

AI literacy. You take measures to support the AI literacy of staff using these systems. The July 2026 rewrite says this does not require guaranteeing a specific level for any individual, which makes a short session about your actual tools a reasonable start.

The bans. Check your tools against the list once, and record that you did. Two prohibitions were added and apply from 2 December 2026, on AI that generates sexualised images of identifiable people without consent and on child sexual abuse material.

Transparency. If you publish deep fakes you disclose it, and if you use emotion recognition or biometric categorisation you tell the people exposed to it.

basis AI Act Art. 4 as replaced by Regulation 2026/1744 Art. 1; AI Act Art. 5, 50(3), 50(4)

03

what moved

the AI Act in six dates

2025202620272028
for you
135
for builders
246
  1. 12 February 2025 bans and the AI literacy duty apply
  2. 22 August 2025 general-purpose model rules and the penalties chapter
  3. 32 August 2026 general application, including transparency
  4. 42 December 2026 marking duty for generators placed on the market before 2 August 2026; two added bans for everyone
  5. 52 December 2027 high-risk rules for annex III systems, moved from 2 August 2026
  6. 62 August 2028 high-risk rules for AI inside regulated products

basis AI Act Art. 113; Regulation 2026/1744 Art. 1

basis AI Act Art. 113; Regulation 2026/1744 Art. 1, point 40

04

if your HR software is the high-risk use

This is the most likely case at a company of your size. Tools used to filter applications or evaluate staff are on the high-risk list. From 2 December 2027, you must use the system according to the provider’s instructions, give oversight to someone competent with real authority, monitor it, report serious incidents, keep its logs for at least six months where you control them, and tell workers and their representatives before it is used.

So the board decision is who owns this, and the technical work is finding out what you run and what the provider’s instructions say. December 2027 is the date to finish by. Finding out what you run should start now. Personal data in these systems stays under GDPR as well.

basis AI Act Art. 26(1), 26(2), 26(5), 26(6), 26(7), Annex III; GDPR Art. 32(1)

the work under AI Act

check it yourself

fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.

your next step

List every AI tool in use at your company this week, including the ones nobody approved, and mark any used on applicants or staff.

read the training work