EU AI Act: What Businesses Need to Check

Updated 30 October 2026

The AI Act doesn’t regulate “using AI” in general. Obligations depend on what a specific system does and the role your organisation plays. So the first step is not a legal analysis but a clear view of what is actually running in the business.

The timeline after the 2026 changes

In July 2026 an amendment to the AI Act, known as the AI Omnibus, was published in the Official Journal of the EU. The timeline now looks like this:

2 February 2025: prohibited practices and AI literacy.
2 August 2025: governance rules and obligations for general-purpose AI models.
2 August 2026: most remaining provisions, including the transparency obligations in Article 50.
2 December 2026: a transitional date for certain existing systems under Article 50(2), and a new ban on systems generating child sexual abuse material and non-consensual intimate content.
2 December 2027: high-risk systems listed in Annex III, for example in employment.
2 August 2028: high-risk AI in regulated products under Annex I.

The delay for high-risk systems doesn’t mean there is nothing to do. Transparency rules and prohibitions already apply, and listing your systems after the fact is harder than keeping track as you go.

AI literacy has changed, not gone

The original text required a sufficient level of AI literacy to be ensured. After the amendment, providers and deployers must support its development and need not guarantee a specific level for each person. In practice this changes the wording, not the need. Someone who can’t check an AI output or doesn’t know what shouldn’t go into it is an operational risk, whatever the legal text says.

Work out your role

The same organisation can play different roles for different systems. Using an off-the-shelf assistant usually makes it a deployer. Having a system built and placing it on the market under its own name can make it a provider. Check modifications too: a substantial change to a system or its purpose can shift the role.

Transparency takes several forms

Article 50 isn’t just about customer chat. Depending on the system and role, it covers telling people they are interacting with AI, labelling certain outputs and other situations. There are conditions and exceptions that need assessing for each case.

Five steps you can take now

List your systems. All of them, including assistants in office suites and tools people got for themselves.
Note the purpose and data for each. What it is for, what data it uses and who is responsible.
Flag sensitive uses. Decisions about people, access to services, customer contact. Being placed in the HR department doesn’t by itself determine a function’s legal category.
Define the controls. Who checks the output, who approves and how errors are corrected.
Keep the list up to date. A change of model, supplier or purpose calls for a fresh assessment.

How we approach this at ENTER

The overview of AI use comes out of the Audit, together with the map of bottlenecks. For each proposed solution we then set the permission level and the points where a person decides. In Adoption, people learn to check outputs and work within company rules. In Integration we set up records, monitoring and a way to stop the system. We help with the technical and organisational assessment. A lawyer confirms the legal classification of a specific use.

Sources (checked 30 October 2026): AI Omnibus in the Official Journal of the EU; Future of Privacy Forum, overview of timeline changes; European Commission, AI Act. This is a general overview to support decisions, not an assessment of a specific deployment or legal advice.