EU AI Act from 2 August 2026: a business guide
The AI Act became generally applicable on 2 August 2026, with exceptions and different timelines. The right question is not “do we use AI?” but which system, which role your company holds, who is affected and which obligation follows.
Updated 24 August 2026. This summary is informational and does not replace legal advice for your case.
Current official timeline
The European Commission summarises the current timeline:
- prohibitions and certain AI-literacy duties have applied since February 2025;
- governance and obligations for general-purpose models have applied since August 2025, with specific transitions;
- the Regulation became generally applicable on 2 August 2026;
- Annex III high-risk rules apply from 2 December 2027;
- high-risk rules for AI embedded in regulated products apply from 2 August 2028.
The AI Omnibus entered into force on 27 July 2026. The earlier version of this article referred to final approval on 29 June; that date was incorrect and has been removed.
Article 50: transparency with a defined scope
Since 2 August 2026, systems intended to interact directly with people must be designed to inform them that they are interacting with AI, unless this is obvious to a reasonably well-informed person and subject to the article’s exceptions. That is not the same as saying “every chatbot, always and without exception” needs the same notice.
There are also specific duties for providers of systems generating synthetic content and for certain deepfakes or public-interest text. Not all generated or altered content receives the same treatment. The official Article 50 FAQ explains subjects, scope and the limited transition for certain earlier systems.
Companies do not all hold the same role
| Question | Why it matters |
|---|---|
| Are you a provider, deployer, importer or distributor? | Duties differ by role |
| Is the system high-risk? | Classification and timeline require intended-use analysis |
| Does it interact with people or generate content? | Article 50 transparency may apply |
| Does it process personal data? | GDPR applies separately |
| Are sensitive decisions involved? | Additional controls and sector law may apply |
Status of Spain’s national bill
The Draft Organic Law for the good use and governance of artificial intelligence was filed on 28 May 2026 and remains in parliamentary procedure. On 24 August it is listed at the amendments stage in the official Congress record. It should not be described as enacted law.
Assessment checklist
- Inventory systems, including undocumented or unauthorised uses.
- Record company role, purpose, users and affected people.
- Perform a preliminary risk classification and sector-law review.
- Record vendors, contracts, data, locations and transfers.
- Define notices, marking or labelling that apply to the case.
- Define human oversight, logs, incidents and complaint channel.
- Assign an owner, evidence and review date.
The previous claims about business adoption and readiness lacked a sufficiently defined source and sample for the Spanish market, so they have been removed.
How this fits into an implementation
A turnkey project can include inventory, technical documentation, notices, logs and controls where defined in scope. We do not promise universal “compliance included”: the outcome depends on role, use, data, vendors, client decisions and the relevant legal review.
To assess a specific system, tell us its use, vendor, data, users and decision. We will prepare a technical assessment and identify where specialist legal review is required.
Request an assessment
