The AI Act in practice: what every company using AI has to do

About half of the companies that considered AI and decided against it name legal uncertainty as a reason. The EU Artificial Intelligence Act sounds complex, but for most companies the obligations are few and clear. The key is knowing which role you are in.

Provider or deployer

The regulation distinguishes a provider, who builds an AI system and puts it on the market, from a deployer, who uses it at work. If you use ChatGPT, Copilot or a ready-made AI module in your accounting software, you are a deployer. Careful: if you put a system on the market under your own name or modify it substantially, you may become a provider, with far more obligations.

What already applies

Prohibited practices. Since 2 February 2025, practices such as social scoring, manipulative techniques and emotion recognition at work and in education are banned. If someone offers you "AI that monitors employee mood", that is a signal to stop.

AI literacy. Article 4 requires all providers and deployers, whatever their size, to take measures to develop the AI literacy of the people who work with the systems. In July 2026 the wording was softened: you no longer have to guarantee a given level for every employee, but the duty to act remains. In practice: short training suited to each role, and records that it took place. No certificates are needed.

Transparency. From 2 August 2026 people must know when they interact with AI, for example a chatbot, and when content has been artificially generated or manipulated (a deepfake). If you publish AI-generated text on matters of public interest, that must be clear too, unless a person has edited it and takes responsibility for it.

What was postponed

Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the deadlines for high-risk systems. Systems in Annex III, including recruitment, credit scoring and education, will have to comply from 2 December 2027. Systems built into regulated products, from 2 August 2028. The requirements were not reduced, only the dates moved.

If you use AI to screen candidates or assess customers, use this time. As a deployer you will then have to use the system according to its instructions, ensure human oversight, keep records and inform employees before introducing it.

The fines

For prohibited practices up to €35 million or 7% of worldwide turnover. For most other breaches up to €15 million or 3%. For small and medium-sized enterprises the lower of the two amounts applies. As of early 2026 Bulgaria had not yet adopted national rules on supervision and sanctions, but the regulation applies directly.

What to do now

List the AI tools your people actually use, free ones included. For each, note what it is used for and whether it falls in a prohibited or high-risk category. Run a short training and document it. If you have a customer chatbot, check that it is clear it is AI.

For most companies this is a few days of work, not a project. This article is a general overview, not legal advice. If you would like to go through your list together, write to us.