The EU AI Act: what your company needs to do now

2026-10-25T00:00:00Z

Most companies are “deployers”: they use AI tools rather than build them. For them, three things already apply: no prohibited practices, measures to train staff in AI, and transparency towards customers. The strict rules for high-risk systems, such as CV screening or credit scoring, have been moved to December 2027.

Regulation (EU) 2024/1689, the AI Act, is the world’s first horizontal law on artificial intelligence. It does not regulate the technology as such but the ways it is used, according to the risk each use creates. For a typical company that uses ChatGPT, Copilot or a customer-service chatbot, the obligations are manageable. For one that uses AI in hiring or to assess customers, preparation should start now.

This guide explains what applies as of late October 2026, after the changes made by the Digital Omnibus, and the practical steps to take.

First: what is your role?

The Act assigns obligations by role:

A provider develops an AI system and places it on the market under its own name. For example, a software company selling a CV-screening tool.
A deployer uses an AI system in the course of its professional activity. This is where most companies sit: a hotel with a chatbot, an accounting firm using AI to process invoices, a company giving Copilot to its staff.

Be careful: if you substantially modify a high-risk system, or put it on the market under your own name, you may be treated as a provider, with far more obligations.

The four risk categories

Category	Examples	What it means
Prohibited practices	Social scoring, emotion recognition in the workplace, manipulating vulnerable groups	Banned since 2 February 2025
High-risk	CV screening, promotion decisions, credit scoring, life and health insurance pricing	Strict obligations from 2 December 2027
Transparency obligations	Chatbots that talk to customers, deepfakes, AI-written text published on matters of public interest	Apply since 2 August 2026
Minimal risk	Spam filters, invoice data extraction, internal reporting, writing assistants	No specific obligations beyond staff training

The large majority of AI tools that companies use today fall into the last category.

What the Digital Omnibus changed

In 2026 the EU adopted the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026. The main changes for companies:

High-risk obligations postponed. For stand-alone systems listed in Annex III (recruitment, education, creditworthiness and others), the deadline moved from 2 August 2026 to 2 December 2027. For AI embedded in products such as medical devices or machinery (Annex I), it moved to 2 August 2028.
A softer AI literacy duty. Article 4 now asks providers and deployers to take measures to support their staff’s AI literacy, rather than to “ensure a sufficient level” of it. The duty remains, but it is an obligation of effort, not of result.
A new prohibition. From 2 December 2026, AI systems that generate non-consensual intimate images of identifiable people (“nudify” apps) or child sexual abuse material are banned.

The Article 5 prohibitions and the Article 50 transparency obligations were not postponed.

What already applies to a typical company

1. Staff training in AI (Article 4)

The Act calls this “AI literacy”. If your company uses any AI system, it must take measures so that the people using it understand what it does, where it makes mistakes and how to check it. In practice, that means:

a short written AI use policy (what is allowed, and which data never goes into AI tools)
training tailored to each role: different for the finance team checking invoices than for HR
a record of who was trained and when, so you can show it

2. Transparency towards customers (Article 50)

If a chatbot talks to customers, they must know they are talking to an AI system, unless that is obvious.
If you publish AI-generated images, video or audio that look real (deepfakes), you must disclose it.
If you publish AI-written text to inform the public on matters of public interest, you must disclose that too, unless it has been reviewed by a person who takes editorial responsibility.

3. No prohibited practices (Article 5)

For most companies this is straightforward, with one exception that is often missed: emotion recognition in the workplace is banned. Tools that “read” employees’ mood from camera or voice, for example in call centres, need to be checked.

If you use AI in hiring or to assess customers

These are the most common high-risk uses for ordinary companies. By 2 December 2027, as a deployer you will need to:

use the system in line with the provider’s instructions
assign people with the right skills to provide human oversight of its decisions
check that the input data you supply is relevant to the purpose
monitor how it runs and report serious incidents
keep the system’s logs for at least six months
inform employees before using such a system in the workplace

Banks and insurers that use AI for credit scoring or for pricing life and health insurance will also need a fundamental rights impact assessment.

December 2027 sounds far away, but the vendor contracts that matter are being signed now. Ask your provider whether its tool will comply and what documentation it will give you.

Who enforces it

Each EU country designates its own authorities: a market surveillance authority that checks compliance, a notifying authority that oversees conformity-assessment bodies, and a single point of contact. Existing sector regulators, such as financial supervisors, keep their role in their own sectors.

In Greece, for example, Law 5321/2026 (Government Gazette A' 114/20.07.2026) makes the Hellenic Data Protection Authority the central market surveillance authority for prohibited practices, Annex III high-risk systems and transparency obligations, as well as the single point of contact. The Hellenic Telecommunications and Post Commission (EETT) is the notifying authority.

Fines under the Act reach €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for other breaches. For SMEs, the lower of the two amounts applies.

Seven steps to get started

List every AI tool used in the company, including AI “hidden” inside your ERP, CRM or HR software.
Place each tool in one of the four risk categories.
Write a one-page AI use policy: what is allowed, with which data, and who approves new tools.
Train your staff by role, and keep a record.
Add transparency notices to chatbots and AI-generated content.
For high-risk tools, ask the provider for its compliance plan for December 2027.
Combine it with GDPR. Most uses of AI process personal data, so they also need a legal basis, a privacy notice and, often, a data protection impact assessment (DPIA).

If you want a first view of where your company stands, the AI readiness assessment takes three minutes.

Frequently asked questions

Does the AI Act apply to a small company that just uses ChatGPT?

Yes, but with minimal obligations. It must take measures to train its staff in AI, such as a use policy and short training, and must not use the tool for prohibited practices. The obligations for the models themselves, such as GPT, fall on the provider.

When do the high-risk obligations apply?

After the Digital Omnibus, from 2 December 2027 for stand-alone Annex III systems such as CV screening and credit scoring, and from 2 August 2028 for AI embedded in products covered by Annex I.

Do we have to say that our chatbot is AI?

Yes. Since 2 August 2026, anyone talking to an AI system must be told so, unless it is obvious from the context. A short notice at the start of the conversation is enough.

Who enforces the AI Act?

Each EU country designates national authorities. In Greece, under Law 5321/2026, the Hellenic Data Protection Authority is the central market surveillance authority, EETT is the notifying authority, and sector regulators remain responsible in their own sectors.

Sources

Regulation (EU) 2024/1689 on artificial intelligence (EUR-Lex)
Regulation (EU) 2026/1744, the Digital Omnibus on AI (EUR-Lex)
Greek Law 5321/2026, Government Gazette A' 114/20.07.2026

This article is for information only and is not legal advice.

Eigen — Insights