The European Union’s AI regulations have moved beyond preparation. With transparency requirements now applicable and another compliance milestone approaching in December, businesses need to assess how they use AI, what their systems produce, and whether their safeguards are sufficient.
Artificial intelligence has found its way into everyday business operations. Companies use it to screen job applicants, evaluate employee performance, generate marketing materials, answer customer queries, and develop training content.
For many organisations, these tools have become part of the ordinary workflow, sometimes without a clear picture of the compliance obligations attached to them.
That is becoming harder to overlook in Europe.
The EU Artificial Intelligence Act, a regulatory framework governing the development, supply and use of AI systems, has entered a significant enforcement phase. Since 2 August 2026, transparency obligations under Article 50 have applied to relevant AI systems, alongside enforcement of other applicable provisions. The regulation is being implemented in stages, meaning businesses cannot assume that every requirement starts on the same date.
For companies operating in the EU, selling into the European market or providing AI-powered services to European customers, the immediate priority is to understand which requirements apply to their operations and what needs to change.
What’s changing, and when?
The AI Act is not a single deadline followed by a blanket compliance requirement. Its obligations take effect progressively, with different dates depending on the type of AI system and the organisation’s role.
Here are the milestones businesses should have on their radar.
1. AI transparency requirements are already in effect
Effective date: 2 August 2026
Article 50 introduces transparency obligations for certain AI systems and their providers and deployers.
Depending on the use case, these include informing people when they are interacting directly with an AI system, making AI-generated or manipulated content detectable, and disclosing certain uses of emotion-recognition or biometric-categorisation systems.
Specific rules also apply to deepfakes and certain AI-generated text published on matters of public interest.
For businesses, this means AI transparency cannot be treated as an optional communications preference. Where the law requires disclosure, organisations need processes that ensure people receive the appropriate information.
Consider a company that uses an AI assistant to handle customer enquiries. Or a business that generates synthetic images and videos for its marketing campaigns. Or an organisation that deploys AI tools to analyse employees’ emotional responses.
Depending on the system and its use, the business may need to introduce disclosures, technical safeguards or additional controls.
What businesses should do now:
- Identify the AI systems used across customer service, marketing, HR, training and operations.
- Determine which systems fall within Article 50.
- Review how AI-generated or manipulated content is identified and disclosed.
- Assign responsibility for implementing and monitoring transparency requirements.
- Check that vendors can provide the technical information and safeguards needed for compliance.
The important distinction is that not every AI-generated document or image automatically triggers the same disclosure obligation. Applicability depends on the specific provision, use case and any relevant exception.
2. A deadline is approaching for certain existing AI systems
Deadline: 2 December 2026
Businesses should pay particular attention to the December milestone.
Under the current European Commission implementation timeline, certain providers of AI systems that generate synthetic audio, images, video or text and were already placed on the market before 2 August 2026 have until 2 December 2026 to meet the relevant marking and detection requirements under Article 50(2).
The timeline also introduces specific prohibitions relating to AI systems that generate or manipulate non-consensual intimate material and child sexual abuse material.
For organisations using generative AI, this is a practical reason to review the systems already in operation rather than focus exclusively on new technology purchases.
A company may have adopted a content-generation platform months ago, for example, and assumed that its existing settings were sufficient. It should now confirm whether the system is covered by the transitional provision, whether the provider has implemented the necessary technical measures, and whether the company has any separate obligations as a deployer.
What businesses should do before December:
- Contact AI vendors to confirm their compliance position.
- Check whether relevant content can be marked or detected as artificially generated.
- Review internal policies for the creation and distribution of synthetic content.
- Establish a process for escalating potentially unlawful or harmful uses of AI.
- Document decisions, system capabilities, and any outstanding compliance gaps.
Do not assume that the December transition applies to every business using generative AI. It is a specific provision for certain existing systems and particular obligations, not a general extension of all AI Act deadlines.
3. High-risk AI systems require forward planning
Current scheduled milestones: 2 December 2027 and 2 August 2028
The AI Act imposes additional requirements on high-risk AI systems, including requirements concerning risk management, documentation, human oversight and other safeguards.
Under the European Commission’s current timeline, the rules for high-risk systems listed in Annex III are scheduled to apply from 2 December 2027. These include relevant systems used in areas such as employment and worker management. The rules for high-risk AI embedded in regulated products covered by Annex I are scheduled for 2 August 2028.
These dates should be monitored because the EU’s AI legislation and implementation arrangements have been subject to amendments and proposed changes.
For HR teams, the employment category deserves particular attention. AI systems used for recruitment, candidate filtering, decisions about promotion or termination, task allocation based on individual behaviour or personal characteristics, and worker monitoring or evaluation may fall within the high-risk category, depending on their intended purpose and the applicable legal provisions.
Buying an AI product from a reputable vendor does not, by itself, establish that every use of that product is compliant.
A general-purpose tool used to draft a job description may present a different regulatory profile from a system that ranks candidates or recommends who should be dismissed.
What businesses should do now:
- Inventory AI systems used to make or influence employment decisions.
- Assess each system’s intended purpose and potential risk classification.
- Ask vendors for relevant technical documentation and compliance information.
- Define when human review is required and who is accountable for decisions.
- Establish processes for testing, monitoring, and addressing discriminatory outcomes.
Businesses should not wait until the scheduled application date to begin this work. Understanding the systems in use, reviewing vendor arrangements and changing established workflows can take time.
What does this mean for companies outside the technology sector?
The AI Act is not relevant only to AI developers.
A retailer using AI to generate product imagery, a consultancy deploying AI assistants, a manufacturer using AI in recruitment, or a company using an external platform to evaluate job candidates may all need to assess their responsibilities.
The regulation distinguishes between different roles, including providers and deployers. In practical terms, an organisation that develops or supplies an AI system may have different obligations from one that uses the system as part of its business operations.
The Act can also apply to organisations outside the EU where its territorial-scope requirements are met, including certain providers placing systems on the EU market and deployers located in third countries whose AI system output is used in the Union.
That makes a clear inventory of AI use particularly important for international businesses.
Five actions businesses should prioritise
Rather than approaching compliance as a last-minute legal exercise, organisations can use the current implementation phase to put a more durable governance process in place.
1. Build an inventory of AI use: identify the tools employees use, the departments relying on them, the data involved and the decisions they influence. Include tools purchased by individual teams, not just those approved centrally.
2. Assign accountability: establish who is responsible for reviewing AI systems, monitoring regulatory developments, approving sensitive uses, and coordinating with legal, HR, IT, and data-protection teams.
3. Review vendor contracts: ask providers about AI Act compliance, technical documentation, transparency features, incident escalation, and their ability to support the organisation’s own obligations.
4. Update internal policies and training: employees should understand which AI tools they can use, what information they may enter, when human review is necessary, and how to handle AI-generated content.
5. Maintain evidence of compliance: record system assessments, approvals, training, vendor reviews and corrective actions. Documentation helps demonstrate that the organisation has taken its obligations seriously and provides a foundation for ongoing oversight.
Compliance is becoming part of AI adoption
The EU AI Act signals a broader shift in how businesses need to think about artificial intelligence. The question is no longer simply whether a tool improves productivity. Organisations must also consider the purpose for which it is used, the people affected by its outputs and the safeguards needed to manage its risks.
The immediate task is to check compliance with requirements that already apply, address relevant December obligations and plan for the scheduled high-risk AI rules.
Companies that build these checks into procurement, HR, IT and operational decision-making will be better positioned to adopt AI responsibly than those that wait for a deadline or regulator inquiry to prompt action.
The next step is straightforward: know where AI is being used in your business, understand which rules apply, and make accountability part of the process.
Regulatory note: This article reflects the European Commission’s published AI Act implementation timeline as checked on 28 October 2026. Applicability depends on the system, the organisation’s role and the specific legal provision. Businesses should consult the current official guidance and obtain appropriate legal advice for their circumstances.
Leave a Reply