AI in your business: what the AI Act has required of you since August 2026 – and what it hasn't

Is your team already using AI – for texts, quotes, translations or the chat on your website? Then the AI Act is your topic too. But probably a smaller one than you think.

The EU's AI Regulation, known as the “AI Act”, has been in force since August 2024 and applies in stages. In summer 2026, the EU made amendments: the amending regulation (EU) 2026/1744, known as the “Digital Omnibus on AI”, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Some deadlines were postponed, some obligations defined more clearly. Here's what matters for ordinary businesses.

Most companies are “deployers”

The regulation mainly distinguishes between providers, who develop AI systems or place them on the market under their own name, and deployers, who use AI systems professionally. If you use an AI assistant for writing or run a ready-made chatbot on your website, you're usually a deployer. That's a good thing, because the heavy obligations lie with the providers.

AI literacy: no licence required, but there's homework

Since February 2025, Article 4 has applied: companies must make sure their people know how to handle AI. The Omnibus has toned this down and worded it more clearly. What's required are measures that support employees' AI literacy. The Regulation doesn't prescribe a specific level for each individual – and no certificate either.

In practice, this means: explain to your team which AI tools are allowed, what they're used for and what they're not. What may go in? Customer data, for example, doesn't belong in freely available tools. How do you check results? Who is the contact person? A short training session and a one-page policy are a good start that you can prove.

Transparency: mandatory since 2 August 2026

Since 2 August 2026, the transparency obligations from Article 50 have applied. For businesses, two points matter most:

• Chatbots: Anyone writing or talking to an AI must be able to recognise it. This obligation falls first on the chatbot's provider. But make sure the notice is actually visible on your site – and that it's clear how to reach a human.
• Deepfakes: Anyone using AI to create images, videos or audio recordings that deceptively depict real people, places or events must disclose this. Clearly artistic or satirical works benefit from lighter rules.

Providers of AI systems that generate content must also label it in a machine-readable way. For systems already on the market before 2 August 2026, a transition period applies until 2 December 2026. This concerns the manufacturers, not you as a user.

High risk: later, but not forgotten

AI systems count as “high-risk” in areas such as applicant selection, credit checks or education. The rules for them were originally due to apply from August 2026. Now they apply from 2 December 2027 for stand-alone systems, and from 2 August 2028 for AI in regulated products such as medical devices or toys. Anyone using AI to pre-sort job applications should nevertheless document this properly today and let a human make the decision.

Newly banned, by the way, are AI systems that create intimate images of real people without their consent. That shouldn't be an issue for businesses – but it's good that it's clearly regulated.

An everyday example

Let's take a small tax firm with eight people. Two use an AI assistant to draft letters to clients, a colleague has English letters translated, and on the website a chat answers questions about opening hours and documents. What does the AI Act mean here in concrete terms?

• A one-page policy: yes for drafts and translations; with client data only in the approved tool with a contract. Every text is read by a human before it's sent.
• One hour of team training: how do you phrase good prompts, how do you spot made-up facts, what must never go in? Note down the date and names – and there's your proof.
• The website chat gets a clearly visible sentence: “An AI is answering here. For personal questions, you can reach us like this: …”

High risk? No. Fear of fines? Unnecessary. The effort: one afternoon and a bit of everyday discipline.

Data protection is still data protection

The AI Act doesn't replace the GDPR. Anyone entering personal data into an AI tool still needs a legal basis, often a data processing agreement and a look at where the data is processed. The GDPR Monster helps sort this out in an understandable way.

The AI Monster shows you which AI tools really save you time and helps with the policy and training. Together, calmly, with the price upfront.

Note: This article gives a general overview (as of: 08.10.2026) and is not legal advice. For your individual case, please ask a lawyer.