The AI Act in 2026: what really changes for companies that use AI

In 2026 the AI Act, specifically on 2 August, entered a new phase of application. The European regulation on artificial intelligence imposes new transparency obligations on companies’ AI systems, starts the penalty regime for providers of large generative models and brings a series of requirements to put into practice straight away. In this blog post, we explain clearly and practically what changes and where to start.

What is the AI Act? Why is 2 August 2026 a key date?

Let’s start from the beginning: we covered it a few articles ago, remember? The AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive law on artificial intelligence. It introduces a common regulatory framework for the whole European market, with the aim of promoting trustworthy, transparent and human-centred AI while protecting fundamental rights, safety and innovation. The regulation takes a risk-based approach: the more an AI system can affect people’s lives, the greater the obligations for those who develop, market or use it.

Beware of a common mistake: the AI Act does not “come into force” on 2 August 2026. It has been in force since 1 August 2024 and applies in stages. 2 August 2026 is one of those stages, and one of the most important for anyone who uses or develops AI that deals with the public.

The 3 things that change from 2 August 2026 are:

1. Transparency of AI systems (Article 50). The transparency obligations become applicable for systems that interact with people (such as chatbots), for AI-generated synthetic content, for deepfakes and for certain texts intended to inform the public. In practice: users must know when they are talking to an AI and when content is artificial.
2. Penalties for GPAI model providers (Article 101). The obligations for general-purpose AI models (known as GPAI, such as large language models) have applied since 2 August 2025. From 2 August 2026, the related penalty regime, enforced by the European Commission, also becomes operational.
3. Innovation, database and oversight. The provisions on regulatory sandboxes, real-world testing, the EU database and market surveillance also apply, insofar as they are compatible with the postponement of the high-risk rules.

As mentioned, the AI Act does not become fully applicable in 2026: it follows a gradual implementation timetable. After the regulation came into force on 1 August 2024, the first major milestone was 2 August 2025, when the obligations for providers of general-purpose AI models (General Purpose AI, such as large language models) took effect.

2026 brings the most significant part of the legislation:

• On 27 July, some provisions on European governance and oversight become applicable
• From 2 August, most of the AI Act’s rules apply, including those on the transparency of AI systems, penalties for GPAI models, measures supporting innovation and market surveillance.
• On 2 December, some transitional periods also end and further restrictions on prohibited practices take effect

Organisations that develop or use high-risk AI systems, on the other hand, have more time to comply: the obligations for the systems listed in Annex III apply from 2 December 2027, those for systems embedded in regulated products (Annex I) from 2 August 2028, while public administrations must bring their existing high-risk systems into line by 2 August 2030.

This gradual application is designed to let companies, developers and public bodies comply step by step, with enough time to absorb the concepts and put them into practice.

What role does your company play? Provider or deployer?

If you are a deployer, meaning you use or integrate AI systems, the AI Act looks at whether you publish deepfakes or AI-generated texts of public interest, whether you use emotion recognition or biometric categorisation systems, whether labelling is clear and accessible, and whether human review remains in place, with clearly identified editorial responsibility.

If instead you are a provider, meaning you develop or supply AI systems, the regulation checks that transparency is built into the design, that synthetic content is marked in a machine-readable format where required, and that documentation and contracts enable the deployer to meet its obligations in the final interface.

Watch out! If you customise, integrate, rebrand or substantially modify an AI system, you may take on the role of provider, with the related obligations. It is one of the most underestimated aspects, so pay close attention!

5 practical steps to take right now

EU AI Act and GDPR

One last clarification: the AI Act does not replace the existing regulatory framework, it adds to it. The obligations it introduces must be coordinated with those of the GDPR, employment law, sector-specific rules and applicable national provisions. The AI Act regulates specific aspects of the development, marketing and use of AI systems, while other laws continue to govern different areas, such as personal data protection, employment relationships or product safety.

Likewise, the transparency obligation in Article 50 of the AI Act is not the same as the privacy notice required by the GDPR. They are two tools with different purposes:

• The privacy notice explains to data subjects how their personal data are collected, used and protected
• The AI Act’s transparency obligations aim to make interactions with AI systems, or the use of artificially generated content, recognisable, building awareness and trust among users.

In the same way, the postponement of the obligations for high-risk AI systems does not mean companies can wait before acting. Responsibilities under existing laws still fully apply, and many of the activities needed to prepare take time and coordination. Think of:

• Mapping the systems in use
• Risk assessment
• Defining internal roles
• Supplier management
• Staff training

The AI Act, then, fits into an existing ecosystem of rules and represents the European Union’s attempt to create a framework that encourages safe, transparent and trustworthy use of AI. For those involved, compliance should be seen not as a burden but as an opportunity to improve AI governance, reduce legal risk and strengthen the trust of customers and stakeholders.

2 August 2026 is a key milestone, but it is not the finish line. Companies that start now to list the AI systems they use, define internal responsibilities, update processes and train their staff will be ready for the next deadlines in 2027 and 2028, avoiding urgent and costly interventions.

Looking for an AI solution that complies with the AI Act by design?

We build Neurally, a private and secure platform for managing and querying documents, where transparency, content marking and traceability have been built into the product from the start.

Let’s talk about your use case and turn the AI Act into a real competitive advantage.

Contact us for a free Neurally demo