The AI Act: a complete guide for businesses

Contents — The AI Act in brief · Timeline · What the Omnibus changes · Provider or deployer · High risk · Transparency · Who enforces it in France · Penalties · 7-step action plan · FAQ · Sources

The AI Act in brief: regulating uses, not a technology

Adopted in 2024 and in force since 1 August 2024, the AI Act is the first comprehensive legal framework for artificial intelligence. Its principle is simple: the more a use of AI puts people’s health, safety or fundamental rights at risk, the stricter the requirements. The same model can therefore be largely unconstrained in one use and tightly regulated in another.

The regulation applies to any organisation that places an AI system on the EU market or uses one in the Union, whatever its size and wherever the provider is established. It sets out four levels of risk.

Level	Examples	What the text requires
Unacceptable	Social scoring, manipulation exploiting vulnerabilities, emotion recognition at work or in schools, sensitive biometric categorisation, non-consensual intimate deepfakes	Prohibited
High risk	Recruitment and HR management, credit scoring, life and health insurance pricing, access to education, critical infrastructure, safety components of regulated products	Allowed but tightly regulated: risk management, data quality, documentation, logging, human oversight, robustness, cybersecurity
Transparency	Chatbots, AI-generated content, deepfakes, emotion recognition outside prohibited cases	Inform people and mark generated content
Minimal	Spam filters, content recommendation, internal writing assistance, logistics optimisation	No specific obligation, voluntary codes of conduct

On top of these four levels, there is a dedicated regime for general-purpose AI models (large language models, for example). It applies to their providers: technical documentation, information for downstream integrators, copyright compliance and, for models with systemic risk, assessment and mitigation of those risks.

The timeline after the Digital Omnibus

Rather than all at once, the AI Act applies in stages. The original timeline set most “high-risk” obligations for 2 August 2026. As harmonised standards and guidelines were not ready in time, the EU adopted a Digital Omnibus in July 2026 that pushes these deadlines back.

Date	What applies
1 August 2024	The regulation enters into force
2 February 2025	Prohibited practices and AI literacy (Article 4)
2 August 2025	Obligations for providers of general-purpose AI models, EU governance, penalty regime
27 July 2026	The Digital Omnibus enters into force (Regulation (EU) 2026/1744)
2 August 2026	Transparency obligations (Article 50), Commission enforcement powers over general-purpose models
2 December 2026	New prohibitions (non-consensual intimate deepfakes, child sexual abuse material) and content marking for generative systems already on the market
2 August 2027	At least one national regulatory sandbox operational in each Member State
2 December 2027	High-risk systems in Annex III (employment, credit, education, essential services…)
2 August 2028	High-risk systems built into regulated products (Annex I: machinery, medical devices, toys…)
2 August 2030	Compliance of high-risk systems already in service and used by public authorities

For high-risk systems already on the market before these dates, the obligations only apply if they are substantially modified after the deadline. A new project launched in 2027, on the other hand, must comply from the day it goes live.

What the Digital Omnibus changes

Beyond the postponement, the Omnibus (Regulation (EU) 2026/1744 of 8 July 2026) changes several practical points for businesses:

• AI literacy relaxed. Article 4 now asks providers and deployers to “take measures to support” their teams’ AI literacy, with no obligation to guarantee an individual level of competence. The duty to act remains: train, document, adapt to each role.
• Two new prohibited practices from 2 December 2026: generating or manipulating realistic intimate images of an identifiable person without their explicit consent (so-called “nudification” apps), and generating child sexual abuse material.
• Relief for SMEs and small mid-caps. A new “small mid-cap” category (fewer than 750 employees, turnover up to €150 million or balance sheet up to €129 million) benefits from the same measures as SMEs: simplified documentation, proportionate quality management, priority access to sandboxes, adapted penalty caps.
• Sensitive data to correct bias. Processing special categories of personal data (within the meaning of the GDPR) is allowed to detect and correct bias, subject to strict necessity and safeguards.
• A narrower definition of “safety component”, which limits the cases where AI built into a product automatically becomes high-risk.
• Centralised supervision by the European AI Office for systems built on a general-purpose model from the same provider, and for AI built into very large online platforms and search engines.

Provider or deployer: what is your role?

This is the first question to ask for each system, because the obligations follow from it. The provider develops an AI system, or has it developed, and places it on the market under its own name. In contrast, the deployer uses it in the course of its professional activity. The vast majority of businesses are deployers: they buy HR software with an AI component, use a generative assistant, integrate a language model API.

Watch out for role changes. A company becomes a provider if it develops its own system, puts its name on an existing system, or substantially modifies a high-risk system or changes its intended purpose. An internal chatbot fine-tuned on your data and opened to your customers can therefore make you a provider.

For a high-risk system	Provider	Deployer
Risk management and data quality	Yes, throughout the lifecycle	Ensure the input data it controls is relevant
Technical documentation and CE marking	Yes	No, but keep the instructions for use
Logging	Design the system to record events	Keep logs for at least six months
Human oversight	Make it possible by design	Exercise it through competent, trained people
Informing people	Clear instructions for the deployer	Inform the employees concerned and the people subject to a decision
Fundamental rights impact assessment	No	Yes for public bodies and certain uses (credit, life and health insurance)

High risk: how to tell if you are concerned

A system is high-risk in one of two ways. Either it is a safety component of a product already subject to an EU conformity assessment (Annex I: machinery, medical devices, lifts, toys…). Or its use falls into one of the eight areas of Annex III:

• biometrics (remote identification, categorisation, emotion recognition);
• critical infrastructure (water, gas, electricity, road traffic, digital infrastructure);
• education and training (admission, assessment, exam proctoring);
• employment and worker management (CV screening, evaluation, promotion, task allocation, dismissal);
• access to essential services (credit, life and health insurance, social benefits, emergency call triage);
• law enforcement;
• migration, asylum and border control;
• administration of justice and democratic processes.

The text provides an exception: an Annex III system is not high-risk if it does not significantly influence the decision. This covers a narrow procedural task, improving the result of human work already done, or a preparatory task. The exception never applies to profiling of individuals. A provider relying on it must document its analysis.

In May 2026, the Commission published draft guidelines on this classification, with many examples. The final version is expected by the end of 2026. In parallel, the European harmonised standards, which will provide a presumption of conformity, are still being developed by CEN-CENELEC. Publication is targeted for the end of 2026 at the earliest: this is one of the reasons for the postponement.

Transparency: what applies from 2026

These obligations affect far more businesses than the high-risk rules, because they cover very common uses of generative AI. They have applied since 2 August 2026.

Situation	Who	Obligation
Chatbot, voice assistant, conversational agent	Provider	Tell people they are interacting with an AI, unless it is obvious
Generated text, images, audio or video	Provider	Mark content in a machine-readable, detectable format (watermark, metadata); until 2 December 2026 for systems already on the market
Emotion recognition, biometric categorisation	Deployer	Inform the people exposed
Deepfake (image, audio, video)	Deployer	Disclose that the content was generated or manipulated; lighter regime for artistic or satirical works
Generated text published to inform the public	Deployer	Disclose it, unless it has undergone human review under editorial responsibility

To help businesses, in July 2026 the Commission endorsed a Code of Practice on the transparency of AI-generated content, which organisations can sign up to voluntarily, and published its final guidelines on Article 50. In practice, for a deployer: a clear notice on your chatbots, a label on generated visuals shared externally, and a simple rule for editorial content. A text written with the help of AI but reviewed and approved by a person who takes responsibility for it does not need to be disclosed.

Who will enforce the AI Act in France?

Each Member State must designate its market surveillance authorities. In France, at the time of this update, the designation law is still being debated in Parliament, as part of a bill adapting French law to EU law. The planned set-up gives the CNIL (the French data protection authority) oversight of prohibited practices and of a large share of Annex III high-risk uses (biometrics, employment, access to services), and gives the DGCCRF (the consumer protection authority) a coordinating role as single point of contact. Sector regulators would remain competent in their fields, such as the ACPR for banking and insurance.

For general-purpose AI models, the European AI Office, within the Commission, supervises providers directly.

Penalties

Breach	Maximum fine
Prohibited practices	€35 million or 7% of worldwide annual turnover
Other obligations (high risk, transparency, general-purpose models…)	€15 million or 3% of worldwide annual turnover
Incorrect or misleading information supplied to authorities	€7.5 million or 1% of worldwide annual turnover

For large companies, whichever amount is higher applies. For SMEs, and now small mid-caps, it is whichever is lower. Beyond fines, the most concrete risk is operational: having to withdraw a tool that has become central to a business process.

Action plan: 7 steps to get ready

Pushing the high-risk rules back to the end of 2027 gives you time, but not much. A serious compliance effort often takes six to twelve months, and some obligations already apply. Here is the order we recommend.

1. Map your AI uses

This is the starting point, and often the first surprise. List every system: business tools with an AI component, generative assistants used by teams (including without formal approval), models developed in-house, AI features built into your SaaS software. For each one, record the provider, purpose, data processed, people affected and the business owner.

2. Qualify each use: role and risk level

For each system, determine your role (provider or deployer) and the risk level, using Annex III and the Commission’s draft guidelines. First check that no use falls under a prohibited practice: that already applies. Document your reasoning, especially when you conclude that an Annex III use is not high-risk.

3. Set up lightweight governance

Appoint an AI lead, working with the DPO, IT and the business. Keep your register of uses up to date, and add an “AI Act” check to the scoping phase of every new project. The aim is not to slow innovation down, but to avoid discovering a problem at deployment time.

4. Train your teams

Article 4 has applied since February 2025. Even relaxed by the Omnibus, it requires concrete measures. Tailor training to roles: general awareness for everyone (capabilities, limits, errors, confidentiality), in-depth training for those who run or oversee systems. Keep a record of what was done.

5. Bring transparency into compliance

This is the most immediate obligation for most businesses. Disclose your chatbots, set up labelling for generated visuals and videos shared externally, and set a human review rule for editorial content produced with AI.

6. Secure your suppliers and contracts

Ask your software vendors for their AI Act roadmap, classification, documentation and instructions for use. Add clauses to your contracts on compliance, transparency, logging and incident notification. For high-risk systems, the provider’s instructions are what will let you meet your own obligations as a deployer.

7. Industrialise: documentation, logging, human oversight

For systems you develop or that are high-risk, the regulation’s requirements largely match good engineering practice: versioning data and models, tracing training runs, monitoring performance in production, logging decisions, planning for human intervention. Well-established MLOps practices cover most of what the text requires.

Horizon	Priorities
Now	Mapping, checking for prohibited practices, training, transparency of chatbots and content
By December 2026	Marking generated content, checking the new prohibitions, supplier clauses
By December 2027	Full compliance of Annex III high-risk systems
By August 2028	High-risk systems built into regulated products

Compliance and responsible AI: one and the same approach

Applied well, the AI Act is not a brake on innovation. It formalises what responsible AI already does: choosing the right use, controlling data, explaining results, keeping humans in the loop. It is also an opportunity to clear things out. A poorly controlled use is costly in both risk and resources, and a frugal AI approach reduces regulatory exposure, costs and environmental footprint at the same time: fewer unnecessary systems, models sized to the need, easier to document and control.

At Acrion, compliance is part of scoping every AI project, alongside business value and sobriety. Want to review your uses? Let’s talk.

Frequently asked questions

Our company only uses ChatGPT or Copilot: does the AI Act apply to us?

Yes, as a deployer. Generative assistants used for internal writing are generally minimal risk. However, AI literacy applies (training your teams), and so does transparency if you publish generated content without human review or expose an assistant to your customers. If you use it to screen applications or assess employees, the use may become high-risk.

Does the high-risk postponement to 2027 mean there is no rush?

No. Prohibitions, AI literacy and transparency already apply, and new prohibitions arrive on 2 December 2026. For high-risk systems, bringing an existing system into compliance (documentation, logging, human oversight, contracts) often takes more than a year.

Do we need a certificate to prove AI literacy?

No. The text requires no certificate, no minimum hours and no test. It asks for measures suited to roles and risks. Keep a record of what was done: training content, participants, dates.

Does text written with AI always have to be disclosed?

No. The obligation covers generated text published to inform the public on matters of public interest. It does not apply when a person has reviewed the content and takes editorial responsibility for it. Deepfakes (images, audio, video), however, must be disclosed.

Do SMEs have lighter obligations?

Yes. SMEs, and since the Omnibus small mid-caps with fewer than 750 employees, benefit from simplified documentation, proportionate quality management, priority access to regulatory sandboxes and lower penalty caps. The prohibitions and substantive requirements remain the same.

Sources

• Regulation (EU) 2024/1689 on artificial intelligence (AI Act), Official Journal of the EU
• Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, Official Journal of the EU
• Digital Omnibus on AI, consolidated text and application dates, artificialintelligenceact.eu
• EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes, Orrick, July 2026
• AI literacy – Questions & Answers, European Commission
• Code of Practice on Transparency of AI-generated Content, European Commission
• Draft guidelines on classification of high-risk AI systems: key points, DLA Piper, June 2026
• The government plans to give AI regulation to the CNIL (in French), Next

This article gives a general overview of the regulation, up to date as of 23 October 2026. It does not constitute legal advice. For a specific use, have the analysis validated by your legal department or a specialist adviser.