import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689

const system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenza

const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3

if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');

if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });

await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');

await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });

const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41

await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });

const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99

await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42

await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13

export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });

import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });
import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });
import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });

EU AI Act

EU AI Act:
what companies must do in 2026

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's risk-based law on artificial intelligence, and it applies to companies that simply use AI at work, not only to AI developers. Bans, AI literacy and transparency rules already apply; two new bans start on 2 December 2026 and high-risk obligations on 2 December 2027.

It also reaches companies outside the EU that sell AI systems into the EU or whose AI output is used there. This guide was checked against the official texts on 11 November 2026, including the Digital Omnibus amendments: your role, what applies now, fines and 7 steps to comply.

By Cesare D'Adamo/Updated 11 November 2026/10 min read

Book a free consultation All guides

In this guide

01What is the EU AI Act and who does it apply to?
02Provider or deployer: which role do you have?
03The four risk levels of the EU AI Act
04What applies now, and what starts on 2 December 2026?
05What did the Digital Omnibus change?
06EU AI Act fines: how much can a company be fined?
07How to comply with the EU AI Act: 7 steps
08Frequently asked questions

What is the EU AI Act and who does it apply to?

The EU AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in stages until 2028. It defines an AI system as a machine-based system that, with varying levels of autonomy, infers from its inputs how to generate outputs such as predictions, content, recommendations or decisions (Article 3). Large language models, chatbots and CV screening tools all qualify.

Article 2 sets a wide scope. The Act applies to providers that place AI systems or models on the EU market, wherever they are based; to deployers established or located in the EU; and to providers and deployers in third countries when the AI output is used in the EU. A US or UK software company selling an AI feature to EU customers is in scope. Exclusions include AI used only for military, defence or national security purposes, pure scientific research and purely personal use.

There is no size exemption. A five-person company with a chatbot on its website has the same transparency duty as a multinational; what changes with size is the fine ceiling and some simplifications.

Provider or deployer: which role do you have?

A provider develops an AI system or general-purpose AI model, or has it developed, and places it on the market under its own name or trademark, paid or free. A deployer uses an AI system under its authority in a professional activity.

Most companies are deployers. In its Article 50 FAQ, updated on 24 July 2026, the European Commission confirms that employees acting under the company's instructions are not separate deployers: the company is.

Role	Examples	Main obligations
Deployer	A vendor's chatbot on your website, ChatGPT in marketing, purchased HR software	AI literacy, transparency; for high risk, use per instructions, human oversight, logs
Provider	A software company selling an AI product, an assistant shipped under your own brand	Transparency by design, machine-readable marking; for high risk, documentation and CE marking
Deployer treated as provider (Article 25)	You rebrand or substantially modify a high-risk system, or change a system's purpose so it becomes high-risk	The provider's obligations

The last row is the common trap: using a general-purpose assistant to screen job candidates changes its intended purpose and turns it into a high-risk use.

The four risk levels of the EU AI Act

Unacceptable riskBanned since 2 February 2025, two new bans from 2 December 2026

High riskObligations from 2 December 2027

TransparencyChatbots, deepfakes and AI text from 2 August 2026

Minimal riskNo specific obligations beyond AI literacy

The four risk levels of the EU AI Act: the higher the risk, the heavier the obligations. Dates as amended by the Digital Omnibus.

Level	Examples	Applies from
Unacceptable risk (banned)	Harmful manipulation, social scoring, emotion recognition at work and in schools, non-consensual intimate deepfakes	2 February 2025; new bans from 2 December 2026
High risk	Hiring and worker management, credit scoring, life and health insurance pricing, education, critical infrastructure	2 December 2027 (2 August 2028 for AI in regulated products)
Transparency	Chatbots, generated content, deepfakes	2 August 2026
Minimal risk	Spam filters, spell checkers, most everyday use of ChatGPT	No specific obligations

The level depends on the use, not the technology: the same model is minimal risk when it summarises email and high risk when it evaluates employees. The same logic applies to AI agents that act in your email, CRM or ERP.

What applies now, and what starts on 2 December 2026?

2 Feb 2025Bans and AI literacy
2 Aug 2025General-purpose AI model rules
2 Aug 2026Transparency, enforcement and fines
2 Dec 2026New bans, end of the marking grace period
2 Aug 2027At least one AI sandbox per Member State
2 Dec 2027High-risk rules, Annex III
2 Aug 2028High-risk rules for regulated products, Annex I

EU AI Act application dates after the Digital Omnibus. Source: European Commission AI Act Service Desk, checked on 11 November 2026.

Prohibited practices (Article 5): since 2 February 2025, for providers and deployers alike.
AI literacy (Article 4): since 2 February 2025. As rewritten by the Digital Omnibus, it requires measures that support the AI skills of staff and others using AI on your behalf, without guaranteeing a set level.
Transparency (Article 50): since 2 August 2026 for chatbots, deepfakes and AI-generated text on matters of public interest published without human review. The Commission published a voluntary Code of Practice on 10 June 2026 and guidelines on 20 July 2026.
General-purpose AI models: since 2 August 2025 the obligations fall on the model developers, not on the companies using them. Since 2 August 2026 the Commission can enforce them.
National rules: each Member State designates its authorities and sets penalties, and some go further. Italy's Legislative Decree 179/2026, in force since 23 October 2026, reserves final decisions on hiring, evaluations and dismissals to a person and voids purely automated ones.

On 2 December 2026 two new prohibitions added by the Digital Omnibus apply: AI systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent, and systems that generate child sexual abuse material (Article 5(1), points (ba) and (bb)). The same day, the grace period for machine-readable marking of AI-generated content ends for providers whose generative systems were on the market before 2 August 2026 (Article 111(4)).

If you only use AI, check the safeguards of any image tool you adopt and ask vendors how they mark outputs. Labelling the deepfakes you publish is already mandatory. If you publish AI-assisted content to get cited by AI search, human review by someone with editorial responsibility also keeps that text outside the labelling duty.

What did the Digital Omnibus change?

The Digital Omnibus on AI is Regulation (EU) 2026/1744, signed on 8 July 2026 and in force since 27 July 2026. It did not pause the AI Act: it moved some dates, eased some duties and added two bans.

Topic	Original text	After the Digital Omnibus
High risk, Annex III (employment, credit, education)	2 August 2026	2 December 2027
High risk in regulated products (Annex I)	2 August 2027	2 August 2028
AI literacy (Article 4)	Ensure a sufficient level, to the best extent possible	Take measures to support it
Small mid-cap companies	No specific relief	Lower fine caps, except for prohibited practices
Intimate deepfakes and child abuse material	Not listed as bans	Banned from 2 December 2026

Small mid-caps are companies that are not SMEs but have fewer than 750 staff and turnover up to EUR 150 million or a balance sheet up to EUR 129 million (Commission Recommendation (EU) 2025/1099). A new Article 4a also allows sensitive personal data to be processed to detect and correct bias, only where strictly necessary.

The Commission's guidelines on high-risk classification are still a draft, published for consultation on 19 May 2026.

EU AI Act fines: how much can a company be fined?

Fines have three tiers under Article 99. For SMEs and start-ups each fine is capped at whichever is lower of the fixed amount and the percentage of worldwide annual turnover; for other companies, whichever is higher.

Infringement	Maximum	SMEs and small mid-caps
Prohibited practices (Article 5)	EUR 35 million or 7% of turnover, whichever is higher	SMEs: whichever is lower. Small mid-caps: no reduction
Other obligations, including deployers (Article 26) and transparency (Article 50)	EUR 15 million or 3%, whichever is higher	Whichever is lower
Incorrect or misleading information to authorities	EUR 7.5 million or 1%, whichever is higher	Whichever is lower

An SME with EUR 10 million turnover therefore faces at most EUR 300,000 (3%) for a transparency breach, not EUR 15 million. These are ceilings: under Article 99(7) authorities weigh gravity, duration, cooperation, intent and the company's size.

National market surveillance authorities enforce most rules, while the Commission's AI Office supervises general-purpose AI models. Italy, for example, named ACN as market surveillance authority and AgID as notifying authority, and added a tier of up to EUR 1 million or 0.5% for the fundamental rights impact assessment (Article 27) and the right to explanation (Article 86).

How to comply with the EU AI Act: 7 steps

01Map your AI use: list every AI tool in use, including those staff use with personal accounts: vendor, team, data entered, owner.
02Clarify your role for each tool, deployer or provider, and check the three Article 25 cases that turn a deployer into a provider.
03Classify the risk: rule out prohibited practices, flag high-risk uses (hiring, credit, life and health insurance, education) and uses with transparency duties.
04Fix transparency now: an AI notice at the start of every chat, labels on deepfakes, human review with an accountable editor for public-interest text.
05Write an AI use policy and train people: approved tools, data that must not be entered, who reviews outputs; a baseline module for everyone and a record of dates and attendees.
06Check national employment rules: some Member States add duties to inform workers or to keep a person in charge of hiring and dismissal decisions, as Italy does.
07Prepare high-risk uses by 2 December 2027: instructions from the provider, trained people for human oversight, logs kept for at least six months, workers informed before use (Article 26). Public bodies, providers of public services, credit scoring and life or health insurance pricing also need a fundamental rights impact assessment (Article 27).

Steps 1 to 6 apply to almost every company. Turning them into a plan that fits your tools and teams is the work of an AI transformation engagement, and the first consultation is free. More practical guides are in the AI guides for companies.

Free consultation

Want to apply this to your company?

In a free first call we look at your situation and I tell you where I would start, with which tools and what results to expect.

Book a free consultation Services

Frequently asked questions

Does the EU AI Act apply to companies outside the EU?

Yes, in two cases. It applies to providers that place AI systems or models on the EU market wherever they are based, and to providers and deployers outside the EU when the AI output is used in the EU (Article 2).

Does the EU AI Act apply to small businesses?

Yes. There is no size exemption: SMEs and start-ups get lower fine caps (whichever is lower of amount and percentage) and some simplifications. Since 27 July 2026 part of this relief also covers small mid-caps with fewer than 750 staff.

We only use ChatGPT or Copilot. Do we need to do anything?

Yes, but not much: AI literacy measures for staff, an internal AI use policy and care with personal data under the GDPR. If you publish deepfakes or AI-generated text on matters of public interest without human review, transparency labelling applies too.

What changes on 2 December 2026?

Two new bans apply: AI systems that create realistic intimate images, video or audio of identifiable people without explicit consent, and systems that generate child sexual abuse material. The grace period for marking AI-generated content also ends for systems on the market before 2 August 2026.

Did the Digital Omnibus delay the whole AI Act?

No. It delayed high-risk obligations to 2 December 2027, and to 2 August 2028 for AI in regulated products. Bans, AI literacy and transparency still apply on their original dates.

Who enforces the EU AI Act?

National market surveillance authorities designated by each Member State enforce most rules, and the Commission's AI Office supervises general-purpose AI models. Enforcement started on 2 August 2026. Italy, for example, designated ACN and AgID.

Do we need an AI literacy certificate or an AI officer?

No. Article 4 asks for proportionate measures, not a certified level for each person, and the Act does not require deployers to appoint a dedicated AI officer. A training record, a written policy and an AI inventory are the simplest evidence.

Sources

This guide is for information only and is not legal advice. Sources checked on 11 November 2026.

About the author

Cesare D'Adamo

Product and AI strategy consultant

15+ years in product, growth and AI, more than 20 AI-powered products built, and executive teams trained on EU AI Act compliance. Works from Berlin with companies across Europe, in English and Italian.

LinkedIn Full profile Services

Let's put AI to work

Strategy, products and automation with AI that deliver measurable results, within the rules. It starts with a free call.

Book a free consultation

First call free, no commitment

EU AI Act:
what companies must do in 2026

In this guide

What is the EU AI Act and who does it apply to?

Provider or deployer: which role do you have?

The four risk levels of the EU AI Act

What applies now, and what starts on 2 December 2026?

What did the Digital Omnibus change?

EU AI Act fines: how much can a company be fined?

How to comply with the EU AI Act: 7 steps

Want to apply this to your company?

Frequently asked questions

Does the EU AI Act apply to companies outside the EU?

Does the EU AI Act apply to small businesses?

We only use ChatGPT or Copilot. Do we need to do anything?

What changes on 2 December 2026?

Did the Digital Omnibus delay the whole AI Act?

Who enforces the EU AI Act?

Do we need an AI literacy certificate or an AI officer?

Sources

Cesare D'Adamo

Related guides

AI agents for business: what they are, examples and costs

GEO: how to get cited by ChatGPT, Gemini and AI Overviews

/services/ai-transformation

/services/interim-leadership

All guides

Let's put AI to work

EU AI Act: what companies must do in 2026

In this guide

What is the EU AI Act and who does it apply to?

Provider or deployer: which role do you have?

The four risk levels of the EU AI Act

What applies now, and what starts on 2 December 2026?

What did the Digital Omnibus change?

EU AI Act fines: how much can a company be fined?

How to comply with the EU AI Act: 7 steps

Want to apply this to your company?

Frequently asked questions

Does the EU AI Act apply to companies outside the EU?

Does the EU AI Act apply to small businesses?

We only use ChatGPT or Copilot. Do we need to do anything?

What changes on 2 December 2026?

Did the Digital Omnibus delay the whole AI Act?

Who enforces the EU AI Act?

Do we need an AI literacy certificate or an AI officer?

Sources

Cesare D'Adamo

Related guides

AI agents for business: what they are, examples and costs

GEO: how to get cited by ChatGPT, Gemini and AI Overviews

/services/ai-transformation

/services/interim-leadership

All guides

Let's put AI to work

EU AI Act:
what companies must do in 2026