Date note: Postponed from 2026-08-02 by the Digital Omnibus on AI, Regulation (EU) 2026/1744 (OJ 2026-07-24, in force 2026-07-27)
AI used for recruiting and managing workers, credit scoring, insurance pricing, education admissions, biometric identification, critical infrastructure and law enforcement becomes 'high-risk'. Providers need a risk-management system, data governance, technical documentation, logging, human oversight and a conformity assessment; deployers must use the systems as instructed, keep logs and inform affected people.
Companies building such AI systems, and any employer or lender that uses them (deployer duties), regardless of size. SMEs get simplified documentation templates.
Sizes: micro, small, medium, large · Sectors: All sectors · Applies if: We use or build AI systems; We employ staff; We process personal data
Map every AI system you build or use against Annex III. For in-scope systems, start a compliance file now: intended purpose, risk assessment, training-data description, human-oversight design, accuracy and cybersecurity testing. Deployers: get provider documentation, appoint a human overseer, and prepare worker information notices. Register systems in the EU database before use.
Up to €15M or 3% of worldwide turnover (SMEs: lower of the two)
Last verified 7 September 2026. Informational only, not legal advice.
In force since 2025-02-02; the Digital Omnibus on AI (Reg. 2026/1744, in force 2026-07-27) softened Art. 4 to a duty to support AI literacy rather than guarantee it
Any business that develops or uses AI systems in the EU, including ordinary firms using AI chatbots, recruiting tools or analytics.
Commission (AI Office) enforcement powers only from 2026-08-02; models placed on the market before 2025-08-02 have until 2027-08-02
Companies that train or substantially fine-tune general-purpose AI models and place them on the EU market. Businesses merely using such models via API are not GPAI providers.
Kept at 2026-08-02 by the Digital Omnibus on AI; only the marking/detection duty for systems already on the market before this date is deferred to 2026-12-02
Any company that offers a customer-facing chatbot, generates synthetic media or text for the public, or uses emotion recognition or biometric categorisation.
Grace period introduced by the Digital Omnibus on AI (Reg. 2026/1744) for systems placed on the market before 2026-08-02; the new prohibition was also added by the Omnibus
Providers of generative AI products released before August 2026 that have not yet implemented watermarking; any business deploying image or video generators.
Providers of older foundation models still offered in the EU, including companies that fine-tuned and released such models.
Postponed from 2027-08-02 by the Digital Omnibus on AI (Reg. 2026/1744)
Manufacturers and importers of physical products with AI safety functions, and their software suppliers.