AI Act: What a Company Adopting AI Must Do (2027 Timeline, Obligations, AI Skills)

The EU Artificial Intelligence Regulation (AI Act, Regulation 2024/1689) has been in force since August 2024 and is being applied in stages. In July 2026 the EU adopted the so-called Digital Omnibus (Regulation 2026/1744), which postponed some deadlines, mainly for high-risk systems. For a company deploying AI in its processes, this means two things: some obligations already apply, and there is more time for others than earlier guides assumed.

This text clarifies what applies to a company deploying AI (in the Regulation’s terminology: “deployer”), what the current dates are, and where to start. It is not legal advice; for high-risk systems, it is worth consulting a lawyer on the classification.

Key takeaways

• Prohibitions and AI literacy apply from 2 February 2025. Every company using AI must ensure that employees have an appropriate level of AI literacy (Art. 4).
• Transparency towards users applies from 2 August 2026. Chatbots, content generators and deepfakes must be labelled.
• High-risk systems: deadlines deferred. Annex III (recruitment, credit scoring, education, biometrics) from 2 December 2027; Annex I (AI in regulated products, e.g., medical devices) from 2 August 2028.
• Most business deployments are minimal risk. A document assistant, knowledge search, or demand forecasting are not high-risk systems, but AI literacy and transparency still apply.
• Fines up to 35 million EUR or 7% of turnover for prohibited practices; lower thresholds for SMEs and small mid-cap companies.

What the AI Act is and who it covers

The AI Act introduces uniform rules for AI systems across the EU. Obligations depend on two things: the company’s role in the value chain and the system’s risk level.

Roles defined in the Regulation:

• Provider: develops an AI system and places it on the market under its own name or brand.
• Deployer: uses an AI system in the course of a professional activity. This is most companies implementing AI.
• Importer and distributor: place on the EU market systems from outside the Union or make them available further.

The Regulation is extraterritorial: it also applies to companies outside the EU if the outputs of their AI systems are used in the Union.

An important rule from Art. 25: a company that deploys another party’s high-risk system under its own brand, substantially modifies it, or changes its intended purpose to a high-risk use becomes the provider and takes on the provider’s obligations.

Four risk levels

The same technology can fall into different categories depending on the use case. A language model that summarises documents in a company is minimal risk. The same model used for pre-screening candidates in recruitment is a high-risk system.

Timeline: what already applies and what has been deferred

Status after the Digital Omnibus (Regulation 2026/1744, in force since 27 July 2026):

• 1 August 2024: AI Act enters into force.
• 2 February 2025: prohibitions (Art. 5) and AI literacy (Art. 4). In force.
• 2 August 2025: obligations for general-purpose AI models (GPAI), oversight structure, penalty provisions. In force.
• 2 August 2026: transparency obligations (Art. 50), regulatory sandboxes in every Member State, general application of the Regulation outside high-risk systems. In force.
• 2 December 2026: end of the transitional period for labelling synthetic content in systems placed on the market before 2 August 2026; new prohibitions under Art. 5.
• 2 December 2027: high-risk systems under Annex III (previously: 2.08.2026). Systems placed on the market before this date fall under the rules only after a substantial modification.
• 2 August 2028: high-risk systems under Annex I, i.e., AI in products covered by other EU legislation, e.g., medical devices, machinery (previously: 2.08.2027).
• 2 August 2030: high-risk systems used by public authorities.

Deferring deadlines does not change the scope of obligations. For a high-risk system, implementing documentation, logging, and human oversight takes months, so 2027 is closer than it seems.

Obligations of a company deploying AI (the deployer)

For every AI system, regardless of risk

AI literacy (Art. 4). The company must ensure that people operating AI systems have sufficient knowledge of how they work, their limitations, and risks, appropriate to the context and the groups of people affected by the system. The Regulation does not prescribe the form; in practice, this means training, internal rules, and instructions.

Transparency (Art. 50). If employees or customers are chatting with a chatbot, they must be told so unless it is obvious. AI-generated content published in matters of public interest must be labelled as generated. Deepfakes must be labelled. Emotion recognition and biometric categorisation systems require informing the individuals concerned.

For high-risk systems (Arts. 26 and 27)

• Use in accordance with the provider’s instructions. The provider must supply instructions; the deployer must follow them.
• Human oversight. The company designates people with the competence, training, and authority to oversee the system, including to ignore or reverse its decisions.
• Input data. To the extent the company controls input data, they must be adequate and sufficiently representative for the system’s intended purpose. Management of training data is the provider’s obligation, not the deployer’s.
• Monitoring and reporting. The company monitors the system’s performance; if it identifies a risk to health, safety, or fundamental rights, it suspends use and informs the provider and the market surveillance authority. Serious incidents must be reported.
• Logs. The company retains logs automatically generated by the system (to the extent it controls them) for at least 6 months, unless other regulations require longer.
• Employees. Before deploying a high-risk system in the workplace, the company informs employees and their representatives.
• Individuals affected by decisions. The company informs individuals that they are subject to a decision supported by a high-risk system and, upon request, explains the system’s role in the decision.
• Fundamental rights impact assessment (Art. 27). Mandatory for public authorities and entities providing public services, and for companies using AI for credit scoring and risk pricing in life and health insurance.

An internal register of AI systems is not, strictly speaking, a legal obligation for most deployers (registration in the EU database covers providers and public authorities), but without an inventory it is impossible to meet the other obligations.

AI literacy in practice

Art. 4 has applied since February 2025 and covers every company that uses AI, including off-the-shelf tools. What upskilling should cover:

• How the tool works: what the model can and cannot do; where it gets data for answers.
• Limitations: hallucinations, dependence on data quality, the need to verify outputs in tasks that affect people or finances.
• Data: what must not be entered into public models (personal data, trade secrets, client data) and how a public chatbot differs from a business deployment.
• The human role: who is accountable for an AI-assisted decision and when they must challenge it.
• Procedures: where to report erroneous or concerning system behaviour.

The level of detail depends on the role: different for the management board, for day-to-day operators, and for the IT team maintaining the system.

How this works in practice

From a technical perspective, most AI Act obligations boil down to architectural decisions made at the start of a project. At Startup House, when deploying AI assistants, agents, and knowledge bases for enterprises, we apply principles that make later compliance easier regardless of risk class:

• Answers grounded in verified client data (RAG) with source citations, which reduces hallucinations and lets users verify where the answer came from.
• Integration with existing access policies (e.g., Okta), so AI only sees data the user is authorised to access.
• Deployment in the client’s cloud and use of models under business terms: client data does not train public AI models.
• Logging of prompts and responses from the first version, not as an afterthought.
• Human-in-the-loop wherever AI supports decisions about people or money: the system proposes, a human approves.
• Transparency to the user: the assistant introduces itself as AI and states when it doesn’t know the answer.
• An architecture that allows swapping the model (e.g., from OpenAI to Anthropic) without rebuilding the system, because GPAI requirements and the models themselves evolve faster than enterprise systems.

We work under ISO 27001 and tailor projects to clients’ requirements in regulated industries (fintech, healthcare, cybersecurity). Risk classification and legal obligations are determined by the client with their legal team; we deliver the technical side: documentation, logs, and mechanisms for oversight and transparency.

The inventory of AI systems, assignment of responsibilities, and tracking of deadlines is supported by Compliance Copilot (product page): an AI agent from Startup House for continuous compliance monitoring (e.g., GDPR, DORA, NIST, ISO) that flags documentation and process gaps before an audit does.

How to prepare your company: 5 steps

1. Inventory. A list of all AI-enabled tools in the company: from customer service chatbots and AI features in SaaS to models in the backend. For each: provider, use case, who uses it, what data goes in.
2. Risk classification. Assign each tool to one of the four categories by use case, not technology. Check separately whether, for any tool, the company becomes a provider (own brand, substantial modification).
3. Vendor due diligence. For high-risk systems: will the provider deliver instructions, documentation, and support for logging? For GPAI tools (general-purpose models): does the business contract exclude training on the company’s data?
4. AI use policy. Employee rules: permitted tools, a ban on entering sensitive data into public models, an obligation to verify outputs, a channel for reporting issues, labelling of AI-generated content.
5. Skills and procedures. Role-based training, appointing those responsible for system oversight, procedures for monitoring and incident reporting. For high-risk systems: a plan to achieve compliance before December 2027 (Annex III) or August 2028 (Annex I).

Penalties for non-compliance with the AI Act

• Up to 35 million EUR or 7% of global annual turnover (whichever is higher): prohibited practices.
• Up to 15 million EUR or 3%: breach of other obligations, including for high-risk systems and transparency.
• Up to 7.5 million EUR or 1.5%: providing false or incomplete information to authorities.

For SMEs and startups, and after the Digital Omnibus also for small mid-cap companies, the lower of the two amounts applies. Besides fines, the market surveillance authority may order the system to be withdrawn from use.

See also: How to choose an AI implementation partner: a 20-question checklist and contract elements · Microsoft 365 Copilot, ChatGPT Enterprise or your own AI assistant?

Frequently asked questions

Does the AI Act apply to small and medium-sized enterprises?

Yes. There is no exemption based on company size; obligations depend on the role and the system’s risk level. SMEs have lower fine thresholds, simplified documentation for providers, and access to regulatory sandboxes that each Member State had to launch by August 2026.

Is using ChatGPT or another chatbot in a company compliant with the AI Act?

Using it is, provided Art. 4 (employee AI literacy) and internal data protection rules are met. The issue begins when a company uses a model in a high-risk application (e.g., candidate selection) or integrates it into its own product under its own brand: then it may become the system’s provider and take on provider obligations.

Do I need to rebuild my current AI system?

It depends on the category. Minimal-risk systems do not require changes beyond transparency if they interact with users. High-risk systems placed on the market before 2 December 2027 fall under the rules only after a substantial modification; new ones must meet requirements from that date. Systems in the prohibited category (e.g., employee emotion recognition) had to be switched off by 2 February 2025.

What is the difference between a provider and a deployer?

A provider builds a system and places it on the market (e.g., a model developer or a company that sells its own AI tool). A deployer uses a system in its operations (e.g., a bank using an external tool for credit scoring). Conformity assessment, technical documentation, and registration burden the provider; human oversight, monitoring, logs, and informing employees fall on the deployer.

How do I check if my system is high-risk?

Annex III lists areas: biometrics, critical infrastructure, education, employment and worker management, access to essential services (including credit scoring and insurance), law enforcement, migration, justice. Annex I covers AI as a safety component of regulated products (medical devices, machinery, vehicles). If the system operates in these areas and influences decisions about individuals, it is high-risk unless it performs only a narrow ancillary task (exceptions under Art. 6(3)).

What about general-purpose models (GPAI) we use via API?

Obligations for GPAI models (documentation, copyright policy, additional testing for systemic-risk models) rest on their providers and apply from 2 August 2025. A company using a model via API is the deployer of the system built on that model, with obligations depending on the use case.

How does the AI Act affect AI development in Polish companies?

The AI Act regulates the deployment of AI solutions in business. It has significant implications for innovation, safety, and customer trust. Companies in Poland should factor its requirements into their investment and expansion strategy.

Does the AI Act cover the use of AI in marketing and e-commerce?

Yes, online stores and marketing agencies must also comply with applicable rules. AI used for content creation, revenue analysis, or spend optimisation usually falls under minimal-risk uses. Additional obligations may result from how data and generated content are used.

How should a company prepare for AI Act requirements in Q4 2026?

Start by analysing available AI tools and testing their compliance with the rules. Experts should identify risks, prepare checklists, and set up alert reporting procedures. Employees should also be trained before starting new deployments.

Does the AI Act regulate the use of AI in recruitment and compensation?

Yes, AI systems supporting recruitment, employee assessment, and pay decisions may be classified as high-risk. They require appropriate human oversight, documentation, and performance controls. This is particularly important for protecting workers’ rights and ensuring decision transparency.

This text is for information only and does not constitute legal advice. Legal status: October 2026, after the entry into force of Regulation 2026/1744 (Digital Omnibus).