The EU AI Act has been phasing in since 2024, and in 2026 its timeline changed. If you build or sell an AI-enabled product and have customers in the EU, three questions matter: does the Act apply to you, which obligations apply today, and what is coming next.

This article reflects the Act as amended in July 2026. It is general information, not legal advice; your obligations depend on what your product does and who uses it.

What changed in 2026

The AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in stages. Bans on prohibited practices and the AI literacy duty have applied since 2 February 2025, and the rules for general-purpose AI models since 2 August 2025. Most of the rest applied from 2 August 2026.

In November 2025 the Commission proposed a “Digital Omnibus” to simplify the Act. After agreement between the Parliament and Council in May 2026, it became Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July 2026. Its main effects:

Obligation Original date Date now
High-risk systems listed in Annex III (stand-alone uses such as hiring or credit scoring) 2 August 2026 2 December 2027
High-risk AI built into regulated products (Annex I) 2 August 2027 2 August 2028
Transparency duties (Article 50) 2 August 2026 2 August 2026, unchanged
Machine-readable marking for systems already on the market before 2 August 2026 2 August 2026 2 December 2026
New bans on AI that generates non-consensual intimate content or child sexual abuse material n/a 2 December 2026
Each EU country’s AI regulatory sandbox in operation 2 August 2026 2 August 2027

The Omnibus also extended some simplifications for small companies to “small mid-caps”, and softened the AI literacy duty without removing it. The headline for startups: the high-risk rules moved, but the transparency rules are in force now.

Does the Act apply to you?

Probably, if you have EU customers. Under Article 2, the Act applies to providers that place AI systems on the EU market whether or not they are established in the EU, and to providers and deployers outside the EU where the output of their AI system is used in the EU. A US, UK or Indian SaaS company with EU users is in scope.

What matters next is your role:

  • Provider: you develop an AI system, or have one developed, and offer it under your own name. A startup that builds a chatbot or AI feature on top of a third-party model and sells it to customers is generally the provider of that AI system.
  • Deployer: you use an AI system under your authority in your own business, for example an AI tool your team uses internally.
  • General-purpose AI model provider: this is the company behind the model itself. Using or fine-tuning someone else’s model does not make you one, unless your modification uses more than a third of the original model’s training compute, the indicative threshold in the Commission’s guidelines.

Most startups are providers of their own AI features and deployers of the AI tools they use. Few are model providers.

What applies today

AI literacy (Article 4)

Providers and deployers must take measures to support AI literacy among staff who build or use AI systems. The Omnibus softened the wording: you no longer have to guarantee a specific level. The Commission’s guidance says no certificate is needed; an internal record of training and other initiatives can serve as evidence. National authorities have been able to enforce it since 2 August 2026.

What to do: give everyone who builds or uses your AI features short, role-specific training on what the system can and cannot do, and keep a record.

Prohibited practices (Article 5)

Some uses have been banned since February 2025, including manipulative or exploitative techniques that cause significant harm, social scoring, emotion recognition in workplaces and schools (with narrow exceptions), and untargeted scraping of facial images. The Commission published guidelines on these in February 2025.

What to do: check your product and roadmap against the list and record the result. For most B2B software this is a short exercise.

Transparency (Article 50)

These duties have applied since 2 August 2026:

  • If people interact with your AI system, for example a support chatbot or an AI assistant in your product, they must be told they are interacting with AI, unless it is obvious.
  • If your system generates synthetic audio, images, video or text, the output must be marked in a machine-readable way so it can be detected as AI-generated. Systems already on the market before 2 August 2026 have until 2 December 2026.
  • Deployers that use AI to create deepfakes, or to generate text published to inform the public on matters of public interest, must disclose it.
  • The information must be given clearly, at the latest at the first interaction.

In June 2026 a Code of Practice on transparency of AI-generated content was finalised, and the Commission and AI Board have confirmed it as an adequate voluntary way to show compliance. Final Commission guidelines on Article 50 followed in July 2026.

What to do: add clear AI disclosures to your interface, check whether your generated content needs machine-readable marking, and confirm what your model provider already does for you.

What is coming

High-risk systems: December 2027

If your product is used for a purpose listed in Annex III, such as recruitment or worker management, education and exam scoring, access to essential services including creditworthiness checks, or remote biometric identification, it may be high-risk. From 2 December 2027 high-risk systems need risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity measures, a quality management system and registration in the EU database.

There is an exception in Article 6(3) for systems that do not pose a significant risk, but if you rely on it you must still document your assessment and register the system. The Commission’s draft guidelines on high-risk classification were published in May 2026, with a final version expected by the end of 2026.

What to do now: check whether any feature falls under an Annex III use. If it might, start the documentation early. About fourteen months is not long to build a quality management system alongside a product.

Penalties

Fines are tiered. Breaching the prohibitions can cost up to €35 million or 7% of worldwide turnover. Breaching most other obligations, including transparency, can cost up to €15 million or 3%. For SMEs and startups, the cap is whichever of the two amounts is lower, and the Omnibus extended this to small mid-caps.

Standards and ISO/IEC 42001

The Act relies on harmonised European standards to show compliance. The first, EN 18286 on quality management systems for AI, was published by CEN-CENELEC in July 2026. A standard only gives a presumption of conformity once the Commission cites it in the Official Journal. Others, covering risk management, cybersecurity and logging, are still drafts.

ISO/IEC 42001, the international AI management system standard, does not give a presumption of conformity under the Act. It is still useful: it gives you a structure for AI governance that maps well to the Act and that enterprise customers increasingly ask about.

A 30-day readiness plan for a startup

  1. Inventory your AI. List every AI feature in your product and every AI tool your team uses, with the model and vendor behind each.
  2. Decide your role for each: provider, deployer or both.
  3. Screen for prohibited and high-risk uses against Article 5 and Annex III, and write down your conclusions.
  4. Fix transparency in your product. Add AI disclosures and check content marking.
  5. Run and record AI literacy training for the people who build and use your AI features.
  6. Collect your vendors’ documentation. Model providers have their own obligations and publish information you can rely on.
  7. Write a one-page AI policy covering approved tools, data you will not put into AI systems, and who signs off new AI features.
  8. Use the free official tools. The Commission’s AI Act Service Desk includes a compliance checker and lets you send questions.

These steps also answer most of the AI questions now appearing in enterprise security questionnaires, which for many startups is the more immediate pressure.

Mirawyn’s product security compliance service maps the AI Act alongside the Cyber Resilience Act, GDPR, SOC 2 and the rules in each market you sell to. AI governance helps you build the inventory, policies and evidence above, aligned with ISO/IEC 42001 and the NIST AI RMF.

Sources