EU AI Act: What Companies Need to Know in 2026

The Artificial Intelligence Act (Regulation EU 2024/1689) is the world's first comprehensive AI legislation. It applies directly in all EU member states and does not only concern AI developers, but also every company that uses tools like ChatGPT, Microsoft Copilot, or AI in HR and sales systems for their work. In August 2026, the largest part of the obligations came into force — below we explain what this means for your business.

TL;DR — Key Takeaways

• The AI Act classifies AI systems by risk: prohibited, high-risk, transparency-obligated, and minimal risk.
• From Feb 2, 2025, prohibitions and the AI literacy obligation for employees apply — even for companies that only use AI.
• From Aug 2, 2026, most remaining obligations apply, including transparency (labeling AI content, chatbots).
• Fines reach up to 35 million EUR or 7% of annual global turnover.
• First step for SMEs: audit AI tools, establish internal usage rules, and provide employee training.

What is the EU AI Act?

The AI Act is an EU regulation that entered into force on August 1, 2024, and is being implemented gradually until 2027. As it is a regulation and not a directive, it applies directly without needing local transposition. Its goal is to ensure that AI systems on the EU market are safe, transparent, and respect fundamental rights, while not stifling innovation.

The regulation distinguishes between providers (those who develop or market an AI system) and deployers (companies that use an AI system for business purposes). Most companies act as deployers, which means fewer obligations than for developers — but not zero.

Four Risk Levels

Timeline: When Does What Apply

The European Commission has proposed a delay for certain deadlines for high-risk systems as part of the digital omnibus. Since the legislative process is still finalizing, we recommend not relying on delays — prohibitions, AI literacy, and transparency are already in effect.

What the AI Act Means for Your Business

If your company uses Microsoft 365 Copilot, ChatGPT, or AI features in CRM, ERP, or HR systems, you are a deployer under the regulation. Your key obligations are:

• AI Literacy (Article 4): Employees using AI must have adequate knowledge of the operation, limitations, and risks of the tools.
• Transparency (Article 50): If you use a chatbot on your website or publish AI-generated content, you must label it appropriately.
• High-Risk Use: If you use AI for candidate selection or employee evaluation, you must ensure human oversight, keep logs, and inform employees.
• Data Protection: The AI Act does not replace GDPR — personal data in AI tools must still be processed lawfully.

The regulation also overlaps with other rules. Companies falling under the NIS2 Directive must include AI tools in their cyber risk assessment, as AI introduces new attack vectors like data leakage via prompts and prompt injection attacks.

Fines for Non-Compliance

• Up to 35 million EUR or 7% of annual global turnover for prohibited practices.
• Up to 15 million EUR or 3% for violations of other obligations (e.g., transparency, high-risk systems).
• Up to 7.5 million EUR or 1% for providing incorrect information to authorities.
• For SMEs and startups, the lower of the two amounts applies.

How to Prepare — 6 Steps for SMEs

1. Audit AI tools: Which tools are employees using, including unapproved ones (so-called shadow AI).
2. Classify usage by risk: Are you using AI in recruitment, evaluation, or customer decision-making?
3. Adopt an internal policy: Which tools are allowed, what data must not be entered, who approves new tools.
4. Train employees: Short training on AI literacy fulfills Article 4 and reduces data leak risks.
5. Implement technical protection: Use business versions of tools (e.g., Copilot within Microsoft 365) with appropriate DLP and conditional access policies.
6. Label AI content and chatbots on your website and in customer communications.

We have written more about safe AI implementation in a business environment in the article AI in Business: How to Implement Safely. The technical part — Microsoft 365 settings, data protection, and access control — is part of our Cybersecurity and Microsoft 365 Cloud services.

Common Business Mistakes

• Believing the regulation only applies to big tech companies.
• Using free consumer AI tools with confidential customer data.
• Absence of rules — employees choosing tools themselves without IT department knowledge.
• A chatbot on a website pretending to be human.

Frequently Asked Questions

Does the AI Act apply to small businesses?

Yes. It applies to everyone developing or using an AI system in the EU, regardless of size. SMEs have some alleviations (lower fines, regulatory sandboxes), but the AI literacy obligation applies to all.

Do we need to fix anything because of ChatGPT or Copilot usage?

This is usually minimal risk, so there are no special obligations — except for employee AI literacy and GDPR compliance. If you use AI for decision-making about people (e.g., recruitment), requirements are stricter.

When does the AI Act take effect?

The regulation has been in effect since Aug 1, 2024, but obligations are implemented gradually: prohibitions and AI literacy from Feb 2, 2025, most other obligations from Aug 2, 2026, and rules for AI in regulated products from Aug 2, 2027.

What is the difference between the AI Act and GDPR?

GDPR regulates the processing of personal data, while the AI Act regulates the safety and transparency of AI systems. They often apply simultaneously, so it makes sense to address them together.

What is AI literacy?

Under Article 4, companies must ensure that employees using AI have sufficient knowledge of its operation, limitations, and risks. The regulation does not prescribe the format — documented, targeted training is sufficient.