With the EU AI Act, the European Union has created a uniform legal framework for artificial intelligence. As a regulation, it applies directly in all member states, including Austria and Germany. Companies outside the EU, for example in Switzerland, can also be affected if they offer AI systems in the EU or if their output is used in the EU.
The regulation entered into force on August 1, 2024, and its obligations apply in stages. With the Digital Omnibus Regulation on AI, Regulation (EU) 2026/1744 of July 8, 2026, the EU amended individual rules and deadlines. It was published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026.
Deadlines at a glance
As of October 25, 2026, according to Art. 113 as amended by Regulation (EU) 2026/1744:
- Since February 2, 2025: Prohibitions of certain AI practices and the rule on AI literacy in Art. 4.
- Since August 2, 2025: Rules for general-purpose AI models.
- Since August 2, 2026: General date of application, including the transparency obligations. For generative AI systems placed on the market before that date, the labeling obligation under Art. 50(2) applies from December 2, 2026.
- From December 2, 2026: Additional prohibitions, among others for AI systems that generate or manipulate sexual depictions of identifiable persons without their explicit consent.
- From December 2, 2027: Obligations for high-risk AI systems under Annex III, for example in recruitment, education, or creditworthiness assessment. Originally, August 2, 2026, was planned for this.
- From August 2, 2028: Obligations for high-risk AI systems under Annex I, that is, AI as a safety component of products such as medical devices. Originally, August 2, 2027, was planned for this.
How the EU AI Act is structured
The AI Act follows a risk-based approach:
- Prohibited practices: for example social scoring, manipulative techniques that can cause significant harm to people, or emotion recognition in the workplace, apart from narrowly defined exceptions.
- High-risk AI systems: for example in recruitment, education, or creditworthiness assessment, and as a safety component of certain products. Strict requirements apply here for risk management, data quality, documentation, and human oversight, from December 2, 2027, or from August 2, 2028, depending on the category.
- Transparency obligations: Anyone communicating with a chatbot should be able to recognize that it is AI. Deepfakes and certain AI-generated content must be labeled.
- Minimal risk: Many applications, such as spam filters, are not subject to any special additional obligations apart from the AI literacy measures.
General-purpose AI models, that is, typical foundation models, are subject to their own rules, which mainly affect their providers. What matters is the role in each individual case: providers develop an AI system or place it on the market under their own name, deployers use it under their own responsibility. Companies that use ready-made AI tools are usually deployers.
Typical examples
- A company uses Microsoft Copilot for texts and summaries. This is usually not a high-risk case, but AI literacy measures under Art. 4 are required.
- A chatbot on the website must be recognizable as AI, unless this is obvious anyway.
- Software that assesses or pre-sorts job applications can qualify as a high-risk system. Deployers are then required, among other things, to ensure human oversight and inform employees. These obligations apply to systems under Annex III from December 2, 2027.
What companies should keep in mind
- Maintain an inventory of all AI systems and use cases, including your own role.
- Classify use cases by risk level, especially in HR and in decisions about people.
- Implement and document AI literacy measures.
- Request instructions for use and transparency information from providers.
- Follow further developments, since guidelines, standards, and adjustments at EU level can change details and deadlines, as the 2026 Digital Omnibus most recently did.
What the Digital Omnibus changed
Regulation (EU) 2026/1744 amends the AI Act in several places. These points are particularly relevant for companies:
- Later high-risk obligations: The postponement is justified by the delayed availability of standards, common specifications, and guidelines, and by the delayed establishment of the competent national authorities.
- AI literacy redefined: Providers and deployers take measures to support the development of AI literacy among their staff. They do not have to guarantee a specific level of literacy. The Commission and member states provide support, especially to SMEs.
- Transitional period for labeling: Generative AI systems placed on the market before August 2, 2026, must implement the labeling obligation for AI-generated content by December 2, 2026.
- New prohibitions: AI systems that generate or manipulate intimate depictions of identifiable persons without their consent, or depictions of child sexual abuse, are prohibited from December 2, 2026, under the conditions set out in the regulation.
- Definitions for SMEs: The regulation defines SMEs and small mid-cap enterprises, to which individual simplifications are linked, for example quality management proportionate to company size for providers of high-risk systems.
How it differs
The AI Act does not replace the GDPR. If an AI system processes personal data, both sets of rules apply side by side.
How TOMORIS relates
TOMORIS offers AI training through UNIVERSITY.
This entry is a general overview and does not replace legal advice.