AI Act: What your company needs to do, timeline and obligations (2026)

This article was published on October 24, 2026, and is based on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Omnibus IA), and on the websites of the European Commission and the CNIL consulted that day. This article explains the regulation; it does not replace the advice of your legal department.

The AI Act, also known as the AI Act or the European regulation on artificial intelligence, already applies to your company as soon as it uses ChatGPT, Copilot, Claude, Gemini, or any AI tool. Since February 2, 2025, certain practices have been prohibited, and you must take steps to train your teams. Since August 2, 2026, transparency rules have been in effect, and authorities can conduct audits. However, the most stringent obligations, those for high-risk systems, have been postponed until December 2, 2027, by the AI ​​Omnibus. Here's what really concerns you, in what order to act, and how to prove it.

The essentials in five lines

• Who is concerned: any organisation that develops an AI system (the provider) or uses one in a professional setting (the deployer) in the European Union, including companies located outside the Union whose results are used in Europe.
• Already in effect: prohibited practices and AI literacy (article 4) since February 2, 2025, transparency (article 50) since August 2, 2026.
• Postponed: the high risk of Annex III (recruitment, employee evaluation, credit, education…) on December 2, 2027, that of regulated products of Annex I on August 2, 2028.
• Sanctions: up to 35 million euros or 7% of global turnover for a prohibited practice, 15 million or 3% for most other breaches.
• For a user company, The work consists of three parts: inventorying uses, training teams according to their profile, preserving evidence.

What is the AI Act?

The AI Act is Regulation (EU) 2024/1689 of 13 June 2024. Published in the Official Journal of the European Union on 12 July 2024, it entered into force on 1 August 2024 and is being phased in until 2030. It is a regulation, not a directive: it applies directly in each Member State, without the need for implementing legislation. In France, a law is only required to designate the authorities responsible for its enforcement.

Its logic can be summed up in one sentence: The obligation depends on usage, not technology.The same language model can be used to write a report, which triggers almost no obligation, or to screen applications, making it a high-risk system. That's why the question "Is Copilot compliant with the AI Act?" doesn't have a general answer: what matters is how your teams use it.

The text was amended by Regulation (EU) 2026/1744, known as the AI ​​Omnibus Regulation. Proposed by the Commission on 19 November 2025 as part of the Digital Omnibus, voted on by the European Parliament on 16 June 2026 and adopted by the Council on 29 June, it was published on 24 July 2026 and has been applicable since 27 July 2026. It postpones the deadlines for high-risk activities, reformulates the AI ​​literacy requirement, reduces certain formalities for SMEs and adds two prohibited practices.

The four levels of risk

Level	Examples	What the regulation stipulates
Unacceptable risk	Social rating, manipulation, and recognition of emotions in the workplace	Banned since February 2, 2025
High risk	CV screening, employee evaluation or promotion, credit scoring, life and health insurance pricing, access to public benefits	Heavy bonds from December 2, 2027
Risk of transparency	Chatbots and conversational agents, deepfakes, generated text and images	Information for individuals and content tagging, since August 2, 2026
Minimal risk	Anti-spam filter, spell checker: the vast majority of office applications of generative AI	No specific requirement, apart from AI literacy

In addition to these four levels, the regulations govern the general-purpose AI modelsThose who run ChatGPT, Claude, Gemini, Copilot, or Mistral's Vibe are subject to these obligations (technical documentation, copyright policy, training data summary, and, for the most powerful models, systemic risk assessment), which apply to OpenAI, Anthropic, Google, or Mistral AI, not to you. These obligations have been in effect since August 2, 2025, and the Commission has been able to enforce and impose sanctions since August 2, 2026.

Supplier or deployer: what is your role?

The regulations assign responsibilities according to the role. provider develops an AI system, or has it developed, and markets or puts it into service under its own name. deployer uses an AI system under its own authority, within a professional framework. The vast majority of companies are deployers; some become suppliers without realizing it.

Your situation	Your role
Your employees use Copilot, ChatGPT, Claude, Gemini or Vibe	Deployer
You activate an AI function in your HR software, CRM or ERP	Deployer
You build an internal agent with Copilot Studio, a custom GPT, or a template API	As the supplier of the system you built, since you are putting it into operation under your name, the obligations remain light as long as its use is not high-risk.
You sell software or a service that incorporates AI	Supplier
You are putting your brand on a high-risk system, substantially modifying it, or changing its purpose to make it a high-risk use.	You become a supplier of this system (article 25)

The last scenario is the most common pitfall: a general-purpose assistant, repurposed to classify applications or rate employees, is then used for a different purpose. The company that configured it in this way then assumes the obligations of a provider of a high-risk system, which are the most burdensome under the regulations.

The AI Act timeline following the AI ​​Omnibus

Date	This applies	For a user company
1st August 2024	Entry into force of the regulation	No immediate obligation
2th February 2025	Prohibited practices (article 5), AI literacy (article 4)	Prohibited practices eliminated, training measures implemented
2th August 2025	Obligations of providers of general-purpose AI models	There's nothing to do except check that your publishers comply with them.
August 2, 2026	Transparency (Article 50), general application, sanctions regime, Commission's powers to monitor models	Chatbots identified, deepfakes and published texts reported, AI literacy plan documented
2th December 2026	End of the marking deadline for generative systems placed on the market before August 2, 2026; two new prohibited practices	Written commitment from your publishers regarding the tagging of generated content.
August 2, 2027	Compliance of models placed on the market before August 2025; national regulatory sandboxes	Nothing specific
2th December 2027	High risk from Annex III (previously scheduled for 2 August 2026)	Human supervision, journals, employee and personnel information, impact analysis where applicable
2th August 2028	High risk of Annex I: AI integrated into regulated products (machines, toys, medical devices…)	This mainly concerns manufacturers
2th August 2030	High-risk systems of public authorities already in service	Concerns the public sector

The postponement of high risk is a preparation period, not an exemption. Fifteen months is barely enough time for a large organization to identify its uses, have them assessed, renegotiate its contracts with publishers, and train the people who will supervise the systems.

This already applies to your business.

Prohibited practices (Article 5)

Since February 2, 2025, eight uses are prohibited, whether you develop them or purchase them:

• subliminal or manipulative techniques that alter a person's behavior to their detriment;
• the exploitation of vulnerabilities related to age, disability or social or economic situation;
• social rating which leads to unfavorable treatment unrelated to the original context of the data;
• predicting the risk of a person committing an offense, based solely on their profile or personality;
• the creation of facial recognition databases through untargeted harvesting of images from the internet or video surveillance;
• recognizing emotions in the workplace and in educational establishments, except for medical or safety reasons;
• biometric categorization aimed at inferring origin, political opinions, trade union membership, religious beliefs or sexual orientation;
• Real-time remote biometric identification in public spaces for law enforcement purposes, except in strict exceptions.

The AI ​​Omnibus Directive, effective December 2, 2026, adds a ban on systems that generate intimate or sexually explicit images, videos, or sounds of identifiable individuals without their consent, and on those that produce child pornography. For businesses, the most concrete area of ​​concern is the first on the list related to work: a tool for analyzing calls or video conferences that detects employees' mood or stress levels is prohibited.

AI literacy (article 4): an obligation that concerns everyone

Since the AI ​​Omnibus, Article 4 requires suppliers and deployers to take measures to promote the development of AI proficiency of their staff and those who use their systems on their behalf, taking into account their technical knowledge, experience, training, and the context of use. The text specifies that it does not require guaranteeing any particular level to anyone. The initial version, on the contrary, required ensuring a sufficient level "to the greatest extent possible": the obligation has shifted from one of result to one of means.

What remains unchanged: the requirement has been in effect since February 2025, it covers service providers and temporary workers who use your tools, and it must be proportionate to their roles. A lawyer reviewing contracts with AI and a salesperson preparing for meetings do not require the same content. No certificate or test is required; a dated plan, a session log, and coverage rates by user group are sufficient to demonstrate the measures taken. For those responsible for supervising a high-risk system, however, training remains fully mandatory (Article 26).

Therefore, there is no mandatory AI Act training in a prescribed format, contrary to what some offers claim. The simplest measure to document remains practical training on the tools actually deployed within the company, such as our AI training in companies, animated on real-life cases from each profession. To build the plan itself (populations, pathways, budget, register), the AI training plan template is freely accessible.

Transparency (Article 50)

Article 50 has been in effect since August 2, 2026, and has not been postponed, with one exception: generative systems already on the market before that date have until December 2, 2026, to mark their content. It sets out four obligations.

obligation	Who wears it	What you do
Inform people that they are interacting with AI (chatbots, voice agents)	Supplier	If you publish a chatbot on your website or internally, it presents itself as an AI.
Mark up generated content in a machine-readable format	Supplier	Check that your publishers do this
Inform people who are exposed to emotion recognition or biometric categorization	Deployer	Uses that are also prohibited at work
Report the hyper-manipulated and generated texts published to inform the public	Deployer	Visible mention, except for text that has undergone human editorial review under editorial responsibility.

In practical terms, communication and marketing are the first to be affected: a video in which a face or voice has been generated, or a press release produced by AI and published without review, must be reported as such.

High risk: what to prepare by December 2027

Annex III of the regulation lists the areas where an AI system is presumed to be high risk:

• biometrics (remote identification, categorization, recognition of emotions except in prohibited cases);
• critical infrastructures (energy, water, traffic, digital);
• education and vocational training (admission, assessment, exam supervision);
• employment and employee management : recruitment, screening of applications, promotion, dismissal, assignment of tasks, monitoring and evaluation of performance;
• access to essential services: public benefits, creditworthiness assessment and credit score, life and health insurance pricing, emergency call triage;
• repressive activities, migration and border control, justice and democratic processes.

A system in these areas is exempt from high risk if it performs only a narrow procedural task, improves the outcome of a human activity already carried out, or prepares an assessment without replacing it (Article 6, paragraph 3), provided that it does not engage in profiling individuals. The provider must document this exemption; the Omnibus AI has simplified the corresponding registration in the European database.

For a deployer, Article 26 translates into seven obligations to prepare now:

1. use the system in accordance with the supplier's instructions;
2. entrust human supervision to competent, trained individuals with the necessary authority;
3. ensure the relevance of the input data that it controls;
4. monitor operation and report serious risks and incidents to the supplier and the authority;
5. retain automatically generated logs for at least six months;
6. inform staff representatives and the employees concerned before putting a high-risk system into service at work;
7. inform people who are subject to a decision made or assisted by the system.

In addition to that...impact assessment on fundamental rights (Article 27), mandatory before commissioning for public bodies, private companies providing a public service, and operators who assess the creditworthiness of individuals or price life and health insurance. It complements the GDPR data protection impact assessment when one is already required.

In France, labor law goes further and earlier than regulations: the social and economic committee must be consulted on the introduction of any new technology, and several court decisions in 2025 and 2026 applied this rule to the deployment of generative AI tools. AI and Social Dialogue Kit provides an overview of this case law.

Who has the authority in France, and what sanctions are in place?

The oversight of user companies falls under the purview of national market surveillance authorities; the European AI Office, attached to the Commission, deals only with general-purpose models and systems built by the same supplier as the model or integrated into very large platforms. In France, the government presented a sector-based breakdown in September 2025, which was incorporated into the draft law adapting French law to EU law (DDADUE) adopted by the Senate on February 18, 2026.

• the DGCCRF coordinates market surveillance, serves as a single point of contact and controls in particular transparency and manipulative practices;
• the CNIL supports biometrics, emotion recognition and most high-risk areas, including employment and education;
• Arcom intervenes in the content generated and the democratic processes, ACPR on credit and insurance, ANSM on medical devices, and sectoral authorities on Annex I products;
• the DGE represents France at the European AI Committee, with technical support from ANSSI and PEReN.

At the time of this article, the text had not yet been definitively adopted: check the status of the law on Légifrance before referring to it in an official document.

Breach	Maximum fine
Prohibited practice (article 5)	35 million euros or 7% of annual global turnover, whichever is higher.
Other obligations include those of the deployer and transparency.	15 million euros or 3% of global turnover
Inaccurate or misleading information provided to the authorities	7,5 million euros or 1% of global turnover
General purpose template suppliers	15 million euros or 3%, as decided by the Commission

For SMEs, the lower of the two amounts applies, and the Omnibus IA extends this rule to small and medium-sized enterprises for the two highest tiers. Article 4 does not set a specific ceiling in the regulation: each Member State establishes its own system. However, a lack of training will be a significant factor in assessing an incident caused by improper use.

The seven-step action plan

1. Inventory the uses. Tools deployed by the IT department, AI functions activated in business software, agents built by teams, and tools used without authorization: the Shadow AI kit help to measure these without witch hunts.
2. To qualify each use. For each line item: your role (supplier or deployer), the risk level, and the applicable Annex III scope. Doubtful cases are referred to legal authorities along with the vendor's documentation.
3. Eliminate prohibited practices. Priority should be given to tools for analyzing calls, video conferences, or productivity that would infer emotions.
4. Training by profile. A common foundation for all users (authorized tools, data that should never be shared, verification, transparency), dedicated modules for managers, technical functions and professions exposed to high risk.
5. Organize transparency. Mention on chatbots, rules for reporting published generated content, written commitment from publishers on tagging before December 2, 2026.
6. Prepare for high risk. Contractual clauses with publishers (notice, journals, information on developments), appointment and training of supervisors, information of the CSE, impact analysis when required.
7. Document and prove. A register of systems and uses, the validated AI literacy plan, the training log, and the minutes of the meetings: the AI Systems Governance Kit provides the register and qualification grid.

This register does not replace the GDPR processing register, which continues to apply alongside it: for more on how the two interact, see our article AI and GDPR: Do we really need a second register? For an example of a program successfully completed, the feedback from...Alptis shows how compliance with the AI Act served as a starting point for a community of 31 AI Initiators.

F.A.Q

Are the AI Act and the AI Act the same thing?

Yes. AI Act is the English name, IA Act or "European AI Regulation" is its common French translation. The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.

Has the AI Act been postponed?

Only partially. The AI ​​Omnibus Directive has postponed the high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I). Prohibited practices, AI literacy, transparency, and model provider obligations apply as planned.

Is using ChatGPT or Copilot in a business setting affected by the AI Act?

Yes, you are a deployer. For office use (writing, summarizing, analyzing documents), the risk is minimal: your obligations are limited to AI literacy and transparency if you publish generated content. If the same tool is used to sort applications or evaluate employees, the use becomes high-risk.

Is AI training mandatory?

Taking steps to develop your teams' AI skills has been mandatory since February 2, 2025. The format is flexible: no certificate, no minimum duration, and no accredited organization are required. However, you must be able to demonstrate measures tailored to your team's profiles, and training for supervisors of high-risk systems remains essential.

Are SMEs affected?

Yes, with some relief measures: simplified technical documentation for suppliers, reduced fine caps, and priority access to regulatory sandboxes. The AI ​​Omnibus extends some of these measures to small and medium-sized enterprises (SMEs) and tasks the Commission and Member States with helping SMEs train their teams.

Does a company located outside the European Union have to comply with it?

Yes, as soon as it puts an AI system on the European market, or the results produced by its system are used in the Union. It's the same principle of territorial application as that of the GDPR.

Sources

• EUR-Lex, Regulation (EU) 2024/1689 on artificial intelligence.
• EUR-Lex, regulation (EU) 2026/1744, known as Omnibus IA, published on July 24, 2026.
• European Commission, entry into force of the omnibus bill on AI, July 27, 2026, updated on July 31, 2026.
• European Commission, AI regulatory framework, accessed October 24, 2026.
• CNIL, Initial questions and answers on the European regulation on AI.
• ActuIA, current obligations and postponements of omnibus 2026/1744.
• Law and Technology, the rewriting of article 4 by the digital omnibus.
• Quantic Avocats, The high-risk bond issuance calendar has been officially postponed., July 22, 2026.