AI Act: the obligations of businesses that use AI

The AI Act is often presented as a text for big tech. That is not accurate: Regulation (EU) 2024/1689 also targets deployers, i.e. any organisation using an AI system in a professional context. If your teams use a generative assistant, a chatbot on your website or a recruitment support tool, you are concerned. Here is what applies, and when.

The timeline, updated in 2026

The last two dates result from Regulation (EU) 2026/1744 (the “digital omnibus on AI”), in force since 27 July 2026, which postponed the high-risk rules. Always check the consolidated version of the text.

Step 1: list your uses of AI

List the AI tools used in the company, including AI features built into software you already use (email, office suite, CRM, HR tools). For each: who uses it, for what, with which data, and who the provider is.

Step 2: qualify your role

You are a deployer if you use a system under your authority. You may become a provider if you develop a system, market it under your name, or substantially modify a high-risk system. Obligations differ: this guide covers deployers.

Step 3: rule out prohibited practices

Article 5 prohibits in particular subliminal manipulation, exploitation of vulnerabilities, social scoring, emotion recognition in the workplace and in education (except for medical or safety reasons), some forms of biometric categorisation and building facial recognition databases through untargeted scraping. From 2 December 2026, the omnibus adds systems generating non-consensual intimate content or child sexual abuse material. Check that no use falls into these categories.

Step 4: ensure AI literacy

Article 4 requires measures so that the people using AI systems have a sufficient level of AI literacy: understanding capabilities and limits, risks (errors, bias, confidentiality) and good habits. The 2026 omnibus reworded this obligation, but you must still be able to demonstrate the measures taken: usage policy, awareness, records of participation.

Step 5: comply with transparency

Since 2 August 2026, Article 50 requires in particular:

• telling people they are interacting with an AI (a chatbot on your website, for example), unless it is obvious;
• for the deployer of a system creating deepfakes (images, audio, video), disclosing that the content was generated or manipulated;
• for text published to inform the public on matters of public interest, disclosing that it was AI-generated, unless it underwent human review with editorial responsibility;
• informing people exposed to an authorised emotion recognition or biometric categorisation system.

Step 6: anticipate high risk

If a use falls under Annex III — for example CV screening, employee evaluation, access to education, creditworthiness assessment —, prepare now for the Article 26 obligations applicable from 2 December 2027: use according to the provider’s instructions, human oversight by competent people, relevance of input data, monitoring of operation, log retention for at least six months, informing workers’ representatives and the employees concerned, informing people subject to decisions. Some deployers (public bodies, credit scoring, life and health insurance pricing) will also have to carry out a fundamental rights impact assessment.

Do not forget the GDPR

As soon as an AI system processes personal data, the GDPR applies in parallel: lawful basis, information, minimisation, the right not to be subject to a solely automated decision, and often a data protection impact assessment (DPIA). The two approaches benefit from being run together.

Penalties

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for most other obligations, €7.5 million or 1% for incorrect information supplied to authorities — the lower amount applying to SMEs.

How OK-GRC helps

OK-GRC includes the AI Act framework, up to date with the 2026 timeline, linked to shared controls also used by ISO/IEC 42001 and the GDPR. You list your AI systems, track their risks, distribute an AI usage policy with read acknowledgement and launch an AI usage training module, with a quiz and completion tracking.