The EU AI Act explained for businesses: risk levels, obligations in force, chatbot transparency from 2 August 2026 and new deadlines after the Digital Omnibus.
The AI Act is the European regulation on artificial intelligence (Regulation (EU) 2024/1689). It classifies AI systems according to the risk they pose to people and assigns proportionate obligations: some uses are prohibited, others are allowed subject to strict requirements, and most require only transparency or no specific obligation at all. It applies both to those who develop AI systems and to companies that use them, regardless of size.
This guide is for information only and is not a substitute for legal advice. Dates are up to date as of November 2026: before making formal decisions, check them against the official texts listed at the end.
| Level | What it means | Examples |
|---|---|---|
| Unacceptable risk | Prohibited | Social scoring of individuals, manipulation that exploits vulnerabilities, emotion recognition in the workplace and in schools (with some exceptions), untargeted scraping of facial images to build databases |
| High risk | Allowed with strict obligations | Recruitment and staff evaluation, access to credit, education, essential public services, safety components of regulated products |
| Limited risk | Transparency obligations | Chatbots, voice assistants, AI-generated or manipulated content, deepfakes |
| Minimal risk | No specific obligations | Spam filters, product recommendations, spell checkers, most internal uses |
Most SMEs use minimal- or limited-risk systems. High risk concerns those who use AI for decisions that significantly affect people, such as hiring, granting credit or assessing students.
| Date | What applies |
|---|---|
| 1 August 2024 | The regulation enters into force |
| 2 February 2025 | Prohibited practices and AI literacy |
| 2 August 2025 | Rules on general-purpose AI models, governance and the penalties regime |
| 2 August 2026 | Transparency obligations (Article 50) and most of the other provisions |
| 2 December 2026 | End of the transition period for marking generated content, for systems already on the market before 2 August 2026 |
| 2 December 2027 | Obligations for Annex III high-risk systems (after the Digital Omnibus) |
| 2 August 2028 | Obligations for high-risk systems embedded in regulated products, Annex I (after the Digital Omnibus) |
The Digital Omnibus on AI, proposed by the Commission on 19 November 2025 and adopted by the Council in June 2026, simplified some parts of the AI Act. The main changes for businesses:
The postponement does not apply to the prohibitions, the rules on general-purpose models or the transparency obligations.
Since 2 August 2026, AI systems that interact directly with people must be designed so that those people know they are talking to an artificial intelligence, unless this is obvious from the context. The obligation falls on the provider of the system, but it also closely concerns anyone who uses it with their own customers. In practice:
We cover this in our guide to AI phone assistants.
A company that uses a third-party chatbot or assistant is generally a deployer. A company that builds an AI system and sells it to customers is a provider. The roles can overlap: if you substantially modify a system or use it for a high-risk purpose, you may take on provider obligations.
Providers and deployers of AI systems must ensure that the people using them have adequate skills. No specific certificate is required: what you need is to be able to show that the measures you have taken are consistent with actual use. For example:
Our guide on how to use ChatGPT, Claude and Gemini without exposing your data is a good starting point.
The AI Act provides for fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for breaches of other obligations, and up to €7.5 million or 1% for supplying incorrect information to the authorities. For SMEs, the lower of the fixed amount and the percentage applies.
In Italy, the AI Act is complemented by Law No. 132 of 23 September 2025, in force since 10 October 2025. The law:
If you are integrating AI into your processes or into services for your customers, we can design it to be secure and transparent from the start.
Yes. It applies to anyone who develops or uses artificial intelligence systems in the European Union, regardless of size. SMEs do, however, benefit from some concessions, including fines calculated on whichever is lower: the fixed amount or the percentage of turnover.
If you use them internally, you are generally a deployer of a minimal- or limited-risk system: you need to make sure the people using them are trained, comply with the GDPR and, if you generate content intended for the public, meet the transparency obligations. If you build them into a service for your customers, such as a chatbot, you must disclose that it is an AI.
No. The postponement concerns the obligations for high-risk systems. Prohibitions, AI literacy, the rules on general-purpose models and the transparency obligations remain in force with their own deadlines.
What an AI agent is, how it differs from a chatbot, which SMB processes it can handle and how to introduce it with permissions, controls and costs in check.
6 min read
How an AI phone assistant works, what it can do for an SMB, which integrations it needs and what to check on quality, privacy and the AI Act.
4 min read
The Digital Omnibus pushes AI Act high-risk obligations back to 2027 and 2028. Prohibitions, transparency and AI literacy remain: here is what to do now.
2 min read