How the EU AI Act impacts your business: deadlines, obligations and fines

The EU AI Act affects any business that develops, sells or uses AI systems in the European Union, including companies based outside it. What you must do depends on your system's risk category and your role: most companies are deployers of AI and face lighter duties than the providers who build it. As of September 2026, bans and transparency rules already apply, and obligations for high-risk AI start on 2 December 2027.

This guide covers who the Act applies to, the risk categories, the current timeline including the 2026 AI Omnibus changes, the fines, and practical steps to prepare. It is general information, not legal advice.

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's law on artificial intelligence. It was adopted by the European Parliament and the Council, entered into force on 1 August 2024, and applies in stages. It regulates AI by risk: the more an AI system can harm health, safety or fundamental rights, the stricter the rules.

It sits alongside existing law rather than replacing it. GDPR still governs personal data, and sector rules in finance, healthcare and product safety still apply. See our glossary entry on the EU AI Act for a short definition.

Does the EU AI Act apply to my business?

It applies if you are one of these, regardless of where your company is based:

Provider: you develop an AI system or model, or have one developed, and place it on the EU market or put it into service under your name.
Deployer: you use an AI system in a professional capacity in the EU, for example a bank using a chatbot or an employer using a screening tool.
Importer or distributor: you bring AI systems from outside the EU to the EU market or resell them.
Non-EU provider or deployer whose AI system's output is used in the EU.

Most enterprises are deployers. You can become a provider without meaning to, for example by putting your own name on a high-risk system or substantially modifying one.

What are the risk categories under the EU AI Act?

Category	Examples	What it means
Unacceptable risk	Social scoring, harmful manipulation, emotion recognition at work or school, untargeted scraping of facial images	Banned
High risk	Credit scoring of individuals, recruitment and promotion decisions, access to essential services, AI in medical devices and machinery	Strict requirements before and after launch
Transparency risk	Chatbots, AI-generated or altered images, audio and video	People must be told, and content must be marked
Minimal or no risk	Spam filters, recommendation of internal documents, most productivity tools	No new obligations

General-purpose AI models, such as the large language models behind most assistants, have their own set of rules for the companies that train and release them.

What applies now, and what comes next?

Date	What applies
1 August 2024	The Act enters into force
2 February 2025	Bans on unacceptable-risk practices and the AI literacy duty
2 August 2025	Rules for general-purpose AI models, governance and penalties framework
27 July 2026	The AI Omnibus amendment enters into force
2 August 2026	Transparency rules for chatbots and generated content; enforcement by the AI Office and national authorities begins
2 December 2026	Ban on AI that generates non-consensual intimate images or child sexual abuse material
2 December 2027	Obligations for high-risk AI systems listed in Annex III, such as credit scoring and recruitment
2 August 2028	Obligations for high-risk AI built into products covered by EU product safety law, listed in Annex I

The dates after July 2026 reflect the AI Omnibus, as summarized in the European Commission's announcement that it entered into force.

What changed with the 2026 AI Omnibus?

The European Commission proposed the AI Omnibus in November 2025 to simplify the Act. After a political agreement in May 2026, it entered into force on 27 July 2026. The main changes for businesses:

Later high-risk deadlines. Annex III systems now have until 2 December 2027, and AI in regulated products until 2 August 2028.
Simpler AI literacy duty. The requirement on companies was simplified, with the Commission and member states taking a larger role.
Lighter registration. Registering AI systems that are exempt from high-risk status in the EU database was simplified.
More relief for growing companies. Some measures previously reserved for small and medium-sized enterprises now also cover small mid-caps.
A new ban. AI systems that generate non-consensual sexually explicit images or child sexual abuse material are prohibited.

What must you do if your AI system is high-risk?

Providers of high-risk systems must have:

A risk management system that runs for the whole life of the system.
Data governance for training, validation and test data.
Technical documentation and automatic logging of events.
Clear instructions for deployers, including limitations.
Human oversight built into the design.
Appropriate accuracy, robustness and cybersecurity.
A quality management system, a conformity assessment, registration in the EU database and post-market monitoring, including reporting serious incidents.

Deployers of high-risk systems must use them as instructed, assign trained people to oversee them, monitor them, keep the logs they generate and inform affected workers. Public bodies, private entities providing public services, and any deployer using AI for credit scoring or for life and health insurance pricing must also carry out a fundamental rights impact assessment.

For banks, the most common high-risk case is creditworthiness assessment. Our post on generative AI in banking covers where that line falls.

What are the transparency obligations?

Since 2 August 2026, the transparency rules require that:

Chatbots and other AI systems that interact with people tell them they are dealing with an AI, unless it is obvious.
Deepfakes, meaning AI-generated or altered images, audio or video of real-looking people, places or events, are labeled.
AI-generated or altered content carries machine-readable marks so it can be detected.
AI-generated text published to inform the public on matters of public interest is disclosed as such, unless a person reviewed it and takes editorial responsibility.

For most enterprises, the chatbot rule is the one that applies today. A customer service agent is usually not high-risk, but it must say that it is an AI.

What are the penalties for non-compliance?

The Act sets maximum fines as a fixed amount or a share of worldwide annual turnover, whichever is higher:

Violation	Maximum fine
Using a prohibited AI practice	€35 million or 7% of worldwide annual turnover
Breaching most other obligations, including high-risk and transparency duties	€15 million or 3%
Supplying incorrect or misleading information to authorities	€7.5 million or 1%

For small and medium-sized enterprises, the lower of the two amounts applies. Providers of general-purpose AI models face separate fines of up to €15 million or 3%.

How should a business prepare?

Inventory your AI. List every AI system you build, buy or embed, including features inside vendor software.
Classify each system. Decide whether it is prohibited, high-risk, subject to transparency rules or minimal risk, and record why.
Confirm your role. Provider or deployer duties differ, and customizing a system can change your role.
Close the transparency gaps now. Make sure chatbots disclose that they are AI and generated media is labeled.
Plan for high-risk obligations. Use the time until December 2027 to build logging, human oversight, testing and documentation into those systems.
Question your vendors. Ask AI providers for documentation, logging capabilities and the data they keep.
Train your people. Staff who operate or oversee AI need to understand what it can and cannot do.

How does Dynamiq support EU AI Act compliance?

No platform makes you compliant on its own; compliance depends on your use case, your documentation and your processes. A platform can supply the controls and evidence the Act asks for. This is how Dynamiq's capabilities map to common obligations:

Obligation	How Dynamiq helps
Record-keeping and logging	Every run is traced step by step with inputs, outputs, cost and latency
Human oversight	Approvals pause any tool step for a reviewer, who can edit fields before approving
Accuracy and robustness	Evaluations on test datasets before release and real-time evaluations on live deployments
Risk controls	Guardrails detect PII and prompt injection before a model sees the text
Change control and documentation	Versioned workflows with rollback, so you can show what changed and when
Data governance	Self-hosting in your own cloud account or data center

These features are part of Dynamiq's guardrails and approvals, evaluations and observability. The platform runs in Dynamiq Cloud or self-hosted on AWS, Azure, GCP, IBM Cloud, Red Hat OpenShift, any Kubernetes cluster or on-prem, and Dynamiq has SOC 2, HIPAA and GDPR in place.

FAQ

When does the EU AI Act take effect?

It entered into force on 1 August 2024 and applies in stages. Bans apply since 2 February 2025, general-purpose AI model rules since 2 August 2025, and transparency rules since 2 August 2026. High-risk obligations apply from 2 December 2027, or 2 August 2028 for AI in regulated products.

Does the EU AI Act apply to companies outside the EU?

Yes. It applies to providers that place AI systems on the EU market and to providers and deployers outside the EU whose AI output is used in the EU, in the same way GDPR reaches non-EU companies that process EU residents' data.

Is a customer service chatbot high-risk under the EU AI Act?

Usually not. A customer service chatbot falls under the transparency rules, so it must tell people they are talking to an AI. It becomes high-risk only if it is used for a listed purpose, such as deciding on credit or on access to essential services.

What are the fines under the EU AI Act?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other breaches, and up to €7.5 million or 1% for misleading information to authorities, whichever is higher. For SMEs, the lower amount applies.

What did the AI Omnibus change?

It delayed high-risk obligations to 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products, simplified the AI literacy and registration duties, extended some SME relief to small mid-caps, and banned AI that generates non-consensual intimate imagery or child sexual abuse material.