If you build or use AI and have customers in the European Union, the EU AI Act applies to you — even if your company is based in the US, UK or Pakistan. 2026 brought the first big change to its timeline: a "Digital Omnibus" amendment that postponed the strictest requirements while keeping others on schedule. Here is a plain-English summary of where things stand.
This article is a general overview for business and technical teams, not legal advice. For decisions about your specific systems, consult a qualified lawyer.
The AI Act in one paragraph
The AI Act regulates AI by risk level. A short list of practices is banned outright. High-risk systems — for example AI used in hiring, credit scoring, education, critical infrastructure or certain medical and safety products — must meet strict requirements on risk management, data quality, documentation, human oversight and accuracy. Limited-risk systems such as chatbots and AI-generated content carry transparency duties. Most other AI, such as spam filters or recommendation features, faces no new obligations. General-purpose AI models (the large models behind ChatGPT, Claude or Gemini) have their own rules for the companies that develop them.
What changed in 2026: the Digital Omnibus
In 2026 the EU adopted the Digital Omnibus amendment to the AI Act, which entered into force in late July. Its headline effect is to delay the high-risk rules so that standards and guidance can catch up (Gibson Dunn):
- Stand-alone high-risk systems (the use cases listed in Annex III, such as recruitment or credit decisions) moved from August 2, 2026 to December 2, 2027.
- High-risk AI built into regulated products (Annex I, such as machinery or medical devices) moved to August 2, 2028.
The AI Act timeline as it stands
| Date | What applies |
|---|---|
| February 2, 2025 | Banned AI practices; AI-literacy duty for providers and deployers |
| August 2, 2025 | Rules for general-purpose AI model providers |
| August 2, 2026 | Transparency obligations (Article 50) |
| December 2, 2026 | Watermarking deadline for systems already on the market; new ban on AI "nudifier" and child-abuse image generation |
| December 2, 2027 | Stand-alone high-risk systems (Annex III) |
| August 2, 2028 | High-risk AI in regulated products (Annex I) |
Based on Gibson Dunn's analysis of the Digital Omnibus agreement. Always check the current official text.
What already applies to most businesses
AI literacy
Since February 2025, companies that provide or use AI systems must take steps to ensure their staff have sufficient AI literacy for their role. In practice: training on what the tools can and cannot do, and on your internal rules for using them. Our guide to AI skills to learn in 2026 is a good starting point.
Transparency (Article 50)
From August 2, 2026, transparency duties apply. In broad terms:
- Chatbots and AI assistants must make clear to people that they are interacting with AI, unless that is obvious.
- AI-generated or manipulated content — images, audio, video and certain text — must be marked as AI-generated in a machine-readable way, with labelling of deepfakes.
- Systems already on the market before August 2, 2026 have until December 2, 2026 to meet the marking requirement.
This is why you are seeing model providers add watermarking — Anthropic, for example, notes that Claude Opus 5.5 carries watermarking to comply with the EU AI Act (Anthropic).
Prohibited practices
Banned practices include manipulative AI that causes significant harm, social scoring, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools (with narrow exceptions), and certain biometric categorisation. The most serious breaches carry fines of up to €35 million or 7% of global annual turnover.
Does the AI Act apply to my company?
Ask three questions:
- Do we place AI systems on the EU market or use them in the EU? If your product or its outputs are used by people in the EU, the Act can apply even if you are based elsewhere.
- What is our role? "Providers" (who develop or brand an AI system) carry more obligations than "deployers" (who use one).
- What risk category is each use case? A customer-service chatbot, an AI hiring screener and an internal writing assistant fall into very different categories.
A practical compliance checklist for software teams
- Inventory your AI. List every AI feature and tool you build or use, who provides it and what it does.
- Classify each use as prohibited, high-risk, limited-risk (transparency) or minimal risk.
- Add transparency now. Disclose AI chatbots in the interface; mark AI-generated media; label deepfakes.
- Train your people and document the AI-literacy measures you take.
- Prepare high-risk documentation early. The deadline moved to December 2027, but risk management, data governance, logging and human-oversight design take time to build into products.
- Check your vendors. Ask model and tool providers for their AI Act documentation and data-processing terms.
- Keep records of decisions, model versions and evaluations — good engineering practice and good evidence.
What about outside the EU?
Regulation is moving elsewhere too. In the US, California's transparency law for frontier AI developers has applied since January 2026, and a December 2025 executive order created a federal effort to challenge state AI laws (Federal Register). Designing for transparency, human oversight and good documentation now will serve you in most jurisdictions.
How Zinetics can help
We build AI features with compliance in mind from the start — clear AI disclosure in interfaces, content marking, audit logs, human-in-the-loop review and documentation of models and data. If you are planning an AI product for European customers, talk to us about your use case or explore our AI development services. For the broader context, see what's new in AI in 2026.