2026 AI Act: What Your Company Needs to Review Now

The question is no longer whether your company uses artificial intelligence.

He probably uses it.

It could be in a customer service chatbot, Microsoft Copilot, a marketing campaign, a recruitment tool, the CRM, or even in software features that the team uses without specifically regarding them as “AI.”

The relevant question as of August 2, 2026, is a different one:

For what purposes do we use AI, what role do we play in each case, and what obligations might that use entail?

The European Artificial Intelligence Regulation—Regulation (EU) 2024/1689, known as the AI Act—applies generally from that date, although several of its obligations began earlier and others will apply at a later stage.
Furthermore, the original timeline was altered in July 2026 with the adoption of Regulation (EU) 2026/1744.

Therefore, before acting based on an old article or checklist, it is advisable to verify that it is still current.

Before we begin: there is no single obligation associated with “using AI.”

One of the easiest mistakes to make is thinking that the AI Act divides companies into those that use artificial intelligence and those that do not.

It doesn’t work like that.

Obligations depend, among other factors, on:

which AI system is used.
what it is used for.
who it can affect.
if the company develops, markets, or simply uses the system.
and what role it plays within the value chain.

This means that two companies using the exact same AI model can face different situations.
A company using ChatGPT to prepare a first draft of a newsletter is not in the same situation as one that incorporates AI to automatically screen candidates during a hiring process.
And neither is necessarily in the same situation as a company that develops its own AI-based product and markets it.

What actually changes starting August 2, 2026

The AI Act entered into force in August 2024, but its implementation has been phased in.
The initial prohibitions and AI literacy provisions began to apply on February 2,
2025. Governance rules and certain obligations regarding general-purpose AI models apply
as of August 2, 2025.
From August 2, 2026, the Regulation applies generally, and the transparency obligations
under Article 50 also apply.
However, the timeline for certain high-risk systems was modified in July 2026:

Date

What to keep on your radar

February 2, 2025

Application of the initial
prohibited practices and
AI literacy obligations

August 2, 2025

Governance and obligations
applicable to certain
general-purpose AI models

August 2, 2026

General application of the Regulation
and transparency obligations
under Article 50

December 2, 2027

Key requirements for
high-risk systems under Annex
III

August 2, 2028

Key requirements for
certain high-risk systems
linked to regulated products
in Annex I

For a company, therefore, the priority should not be to try to “comply with AI” in a generic way.
It should be to identify its use cases and determine the situation corresponding to each one.

I have an AI chatbot on my website: do I need to provide a notice?

This is one of the cases that should be reviewed right away.

Article 50 establishes that providers of AI systems designed to interact directly with natural persons must ensure that those persons are informed that they are interacting with an AI, except where this is obvious from the context.

The European Commission has also specified that the information must appear from the beginning of the first interaction and in a clear and distinguishable manner.

In practice, if someone can visit your website and hold a conversation with an assistant, they shouldn’t need multiple messages to discover that there isn’t a person on the other end.

A simple message may be enough:

“Hello, I am the virtual assistant for…”

There is no need to turn the chatbot into a legal notice.

The experience needs to be transparent.

What happens if the chatbot is from a third-party provider?

An important distinction arises here.
The obligation under Article 50.1 falls specifically on the system provider. That does not mean a company incorporating a third-party solution can simply forget about the matter.

If you integrate a chatbot into your website, you should check at least the following:

who is legally the provider of the system.
what obligations it assumes.
how information for the user has been implemented.
if the configuration or customization performed alters your company’s role.
and if the final experience remains transparent.

Purchasing technology from a third party does not eliminate the need to understand what has been installed on your own digital channels.

Does all AI-generated content have to carry a label?

No.
And this is probably one of the ideas that is most important to clarify.

Using ChatGPT to brainstorm campaign approaches, prepare a draft, summarize documentation, or improve a newsletter headline does not mean that all those pieces must automatically be published with a visible “AI-generated” label.

Article 50 sets out different obligations depending on the content and the role played by each organization.

Technical marking is one thing, and issuing a public warning is another.

Providers of systems that generate synthetic content—text, images, audio, or video—must ensure, subject to the conditions and exceptions provided for in the regulations, that their outputs incorporate machine-readable marking that allows for the detection of their artificial origin.

It is an obligation incumbent upon the technology provider.

A separate issue is when a company using that technology must publicly disclose that content has been generated or manipulated using AI.

There are two especially relevant cases here.

Deepfakes: When the artificial can look authentic

If a company uses an AI system to generate or manipulate images, audio, or video that constitute a deepfake, the deployer has specific transparency obligations.

Let’s consider examples such as:

a person who apparently recommends a product even though they never recorded that video.
a synthetic voice imitating a real person.
a manipulated scene that appears to document an authentic event.
certain audiovisual content capable of being reasonably mistaken for real material.

In these cases, we should not ask ourselves only:

“Can we produce this creativity with AI?”

Also:

“How should we present this content so as not to be misleading?”

For marketing, advertising, corporate communications, and social media, this review process should be progressively integrated into the creative workflow itself.

And what about an article or a text written with ChatGPT?

Nor is there a general obligation to label any text in the creation of which AI has played a part.

Article 50 establishes a specific obligation for certain AI-generated or AI-manipulated texts published for the purpose of informing the public about matters of public interest.

However, it allows for an important exception when the content has undergone human review or editorial oversight, and a natural or legal person assumes editorial responsibility for what is published. This has business implications that are far more interesting than simply applying a label.

Using AI to produce content does not eliminate the need for a person responsible for the content.
You can use it to research, summarize, structure, translate, or generate a first draft.

What should not be offloaded to the tool is the responsibility for what the company ultimately publishes.

My team uses ChatGPT, Copilot or Gemini: do I also have obligations?

The fact that you do not develop artificial intelligence does not mean the AI Act is irrelevant to your organization.

As of February 2025, there are obligations related to Artificial Intelligence literacy.

Furthermore, Regulation (EU) 2026/1744 amended the wording of this requirement in July 2026.

Currently, providers and deployers must take measures to support the development of AI literacy among the individuals who use or operate these systems on their behalf, taking into account their knowledge, experience, and training, as well as the context in which the technology is used.

The standard expressly clarifies that this does not require guaranteeing a specific level of knowledge for each employee.

For a company, a reasonable way to approach this issue may be to focus on very practical decisions:

What tools are authorized?
What corporate or customer information can be entered into them?
Who should review a result before using it?
Can AI be used to generate code that goes directly into production?
What do we do if the system invents information?
How do we handle confidential documents?
What uses require prior approval?
Who is responsible for the final result?

An internal AI usage policy can be a useful tool for structuring these decisions.

But the goal shouldn’t be to have a PDF saved in a folder.

The goal should be to ensure that people know how to use the tools in a manner consistent with the actual risk associated with

their work.

Note: Some practices are not “high-risk.” They are prohibited.

There is another important distinction.

When discussing the AI Act, attention tends to focus on “high-risk” systems. However, there are uses that the Regulation explicitly prohibits.

For example, with certain exceptions related to medical or safety reasons, the use of AI systems to infer people’s emotions in workplaces or educational institutions is prohibited.

There are also specific prohibitions regarding certain biometric categorization systems used to infer particularly sensitive characteristics of a person.

Why does this distinction matter?
Because, when faced with a prohibited system, the solution is neither to add a transparency notice nor to wait until 2027.
The first question of an AI inventory should always be:
1. Do we have any use that might be prohibited?
2. And only then move on to the remaining risk levels.

We use AI to select candidates: what happens?

Systems intended for specific uses in employment and worker management appear among the cases covered by Annex III of the Regulation.

This includes systems designed to analyze and filter job applications or evaluate candidates, among other uses.

The timeline for these obligations has changed. Following the amendment approved in July 2026, the main obligations under Chapter III for systems classified as high-risk in accordance with Annex III will apply from 2 December 2027.

This does not mean that a company already using such a solution should ignore it until December 2027.

It means there is time to correctly answer questions such as:

Do we know which tool is being used?
Do we know exactly what function it performs?
Who is your supplier?
Does it really play a role in a decision regarding people?
What data does it use?
What human oversight is in place?
Are we dealing with a high-risk system under the Regulation, or is there an applicable exception?
The greater the impact of a system on an individual, the less sense it makes to leave the analysis until the week before an obligation takes effect.

Is using AI the same as developing an AI-powered solution?

No.

This is likely one of the most important issues for companies that are incorporating AI into their own products or services.

A company that uses an AI tool provided by a third party does not have the same responsibilities as a company that introduces an AI system to the market under certain conditions.

And there are many intermediate scenarios.

For example, you can develop your own platform and integrate a model provided by a third party into it. Or, you can use an API to create an assistant where you control the experience, logic, data, and interface.

In projects like this, the conversation about regulation shouldn’t come up when development is already finished.

It should be part of the initial product decisions, just like privacy, security, accessibility, analytics, or user experience.

Because correcting an architecture, a data flow, or an interface at the end is usually more complicated than designing them correctly from the start.

Six common situations a company should review

1. We use AI to write product descriptions.

There is no general obligation to add a visible notice to each entry simply because an AI tool was involved.

The company remains responsible for reviewing what it publishes: product features, commercial terms, advertising claims, or any other information.

2. We have a chatbot on the e-commerce site.

Check the identity of the provider and your company’s role, and ensure the experience makes it clear from the start—when appropriate—that the user is interacting with an AI.

3. We generate images for campaigns.

Not all AI-generated images require the same treatment.

A distinction must be made between a synthetic illustration and content that could constitute a deepfake, leading people to believe that a real person or event existed in the manner depicted.

4. We create videos or voices of real people using AI.

This scenario requires special attention.

If the result constitutes an ultra-impersonation within the meaning of the Regulation, the corresponding transparency obligations apply.

In addition to the AI Act, there may be other issues related to image rights, intellectual property, data protection, or advertising that will need to be analyzed separately.

5. Employees use generative AI tools daily.

It inventories tools and use cases, defines internal rules, and adapts AI literacy to the risk level of each team.

Marketing and development do not necessarily require the same training, because they do not use AI for the same purposes.

6. We use AI in personnel selection or management.

Conduct a specific review.

Certain uses in recruitment, candidate assessment, and workforce management may fall within the high-risk systems of Annex III.

Checklist: What Company Management Should Know Today

You don’t need to start by reading 144 pages of regulations.

It is necessary to have answers available.

Inventory

Do we know which AI tools and functionalities the organization actually uses?
Do we also include AI embedded within CRM, ERP, marketing tools, HR, or SaaS software?

Purpose

What is each tool used for?
Does it generate content, make recommendations, classify, predict, or participate in a decision?

Affected individuals

Do you interact with customers?
Does it affect candidates or employees?
Do you participate in significant decisions regarding people?

Role of the company

Are we users of an external tool?
Do we integrate a third-party system into a product of our own?
Should we develop it or market it?

Transparency

Do we have chatbots or other interactive systems?
Do we publish deepfakes?
Do we produce specific texts on matters of public interest?

Prohibited uses

Is there any application that could fall under the prohibited practices of Article 5?

Team

Do the people who use AI know its main capabilities, limitations, and risks?

Suppliers

Do we know who provides each system and what obligations they assume?

New projects

Is the regulation being analyzed during the design phase, or will it come into play once the product has already been developed?

If management cannot answer several of these questions, there is a problem that predates regulatory compliance: the company lacks sufficient visibility into how it is using AI.

And that problem also affects security, data, efficiency, and internal control.

What happens if a company fails to comply with the AI Act?

The Regulation sets out different maximum penalty levels depending on the type of non-compliance.

Failure to comply with certain obligations—including the transparency obligations under Article 50—may be subject to administrative fines of up to €15 million or 3% of the total annual worldwide turnover of the preceding financial year, in accordance with the rules applicable to each type of company.

For SMEs, the Regulation stipulates that the lower of the corresponding amounts be applied as the maximum.

Infractions linked to prohibited practices may be subject to higher limits.
These are regulatory maximums, not automatic fines; their imposition and amount must take into account the specific circumstances and adhere to principles of proportionality.

But reducing the entire conversation to “How much could I be fined?” would be merely scratching the surface.

An organization that does not know which AI it is using also does not know precisely what information it is sending to vendors, what decisions it is automating, what risks it is introducing, or what experience it is offering to customers and employees.

The inventory required for good AI governance can also serve to inform better technology decisions.

The AI Act does not mean stopping the use of artificial intelligence.

The AI Act does not turn AI into a technology that companies should avoid.
It mandates the application of greater judgment regarding how it is used.

In many cases, the first step will not be to create a massive compliance program.

It will be much more basic:
knowing which AI we use, what we use it for, who is responsible, and what impact it might have.

From there, it is possible to determine what each case requires: transparency, training, technical review, product changes, specific legal analysis, or preparation for future obligations.

For companies developing a website, e-commerce site, application, or digital product with artificial intelligence, there is a particularly useful consequence:

AI should no longer be added as an isolated feature.

It must be designed with consideration from the outset for how it interacts with users, data, internal processes, and decisions.

At Pukkas, we work on the design and development of digital solutions and the integration of functionalities based on artificial intelligence.

If you are planning to integrate AI into a website, e-commerce platform, application, or digital process, we can help you implement the technical and user experience aspects, coordinating the design to align with the requirements defined by your legal or compliance team.

Because the question is not solely:
“Where can we use artificial intelligence?”

It is also worth answering:
“How do we want to use it within our business?”

Frequently Asked Questions about the AI Act for Businesses

Does the AI Act affect all companies?

Not in the same way. Obligations depend on the system used, its purpose, the role played by the organization, and the risks associated with the use case.

Do I have to indicate that a text was written using ChatGPT?

There is no general obligation to label any text in the creation of which ChatGPT or another AI tool has participated. Specific obligations exist for certain types of content—including texts intended to inform the public on matters of public interest—subject to exceptions where human review or editorial control and responsibility for publication are present.

Do I need to disclose that my website uses an AI chatbot?

Article 50 requires the provider of a system designed to interact directly with people to ensure that they are aware they are interacting with an AI, unless this is obvious from the context. If you use a third-party solution, it is advisable to review both the role of each organization and the final implementation.

Do I have to label all images created with AI?

There is no generic, visible obligation for every AI-generated image. A distinction must be made between the technical obligations incumbent upon providers of generative systems and the obligations of the deployer—for instance, when publishing content that constitutes a deepfake.

What should I do first if my company uses AI?

Create an actual inventory of tools and use cases. Before determining what obligations exist, you need to know which systems the organization uses, for what purpose, who controls them, and whom they may affect.

Do the obligations for high-risk AI systems already apply?

Not all of them. Following the amendment of July 2026, the main obligations applicable to the high-risk systems listed in Annex III will apply from 2 December 2027. For certain systems linked to regulated products listed in Annex I, the date is 2 August 2028.

Content updated in September 2026.

This article is for informational and educational purposes. It does not constitute legal advice nor does it replace the specific analysis that each organization may require.

Trends

AI Act 2026: What Your Company Needs to Review Starting August 2